Merge remote-tracking branch 'upstream/master'

model/api/src/main/java/org/keycloak/models/ClientModel.java

@@ -24,6 +24,10 @@ public interface ClientModel extends RoleContainerModel {
 
     void setClientId(String clientId);
 
+    String getName();
+
+    void setName(String name);
+
     boolean isEnabled();
 
     void setEnabled(boolean enabled);

model/api/src/main/java/org/keycloak/models/ClientSessionModel.java

@@ -28,6 +28,9 @@ public interface ClientSessionModel {
     public Set<String> getRoles();
     public void setRoles(Set<String> roles);
 
+    public Set<String> getProtocolMappers();
+    public void setProtocolMappers(Set<String> protocolMappers);
+
     /**
      * Authentication request type, i.e. OAUTH, SAML 2.0, SAML 1.1, etc.
      *

model/api/src/main/java/org/keycloak/models/RealmModel.java

@@ -145,6 +145,7 @@ public interface RealmModel extends RoleContainerModel {
 
     void updateDefaultRoles(String[] defaultRoles);
 
+    // Key is clientId
     Map<String, ClientModel> getClientNameMap();
 
     List<ClientModel> getClients();

model/api/src/main/java/org/keycloak/models/UserConsentModel.java

@@ -8,31 +8,20 @@ import java.util.Set;
  */
 public class UserConsentModel {
 
-    private final RealmModel realm;
     private final ClientModel client;
     private Set<ProtocolMapperModel> protocolMappers = new HashSet<ProtocolMapperModel>();
     private Set<RoleModel> roles = new HashSet<RoleModel>();
 
-    public UserConsentModel(RealmModel realm, String clientId) {
-        this.realm = realm;
-        this.client = realm.getClientById(clientId);
-
-        if (client == null) {
-            throw new ModelException("Client with id [" + clientId + "] is not available");
-        }
+    public UserConsentModel(ClientModel client) {
+        this.client = client;
     }
 
     public ClientModel getClient() {
         return client;
     }
 
-    public void addGrantedRole(String roleId) {
-        RoleModel role = realm.getRoleById(roleId);
-
-        // Chance that role was already deleted by other transaction and is not available anymore
-        if (role != null) {
-            roles.add(role);
-        }
+    public void addGrantedRole(RoleModel role) {
+        roles.add(role);
     }
 
     public Set<RoleModel> getGrantedRoles() {
@@ -46,13 +35,8 @@ public class UserConsentModel {
         return false;
     }
 
-    public void addGrantedProtocolMapper(String protocolMapperId) {
-        ProtocolMapperModel protocolMapper = client.getProtocolMapperById(protocolMapperId);
-
-        // Chance that protocolMapper was already deleted by other transaction and is not available anymore
-        if (protocolMapper != null) {
-            protocolMappers.add(protocolMapper);
-        }
+    public void addGrantedProtocolMapper(ProtocolMapperModel protocolMapper) {
+        protocolMappers.add(protocolMapper);
     }
 
     public Set<ProtocolMapperModel> getGrantedProtocolMappers() {

model/api/src/main/java/org/keycloak/models/entities/ClientEntity.java

@@ -11,6 +11,7 @@ import java.util.Map;
 public class ClientEntity extends AbstractIdentifiableEntity {
 
     private String clientId;
+    private String name;
     private String realmId;
     private boolean enabled;
     private String secret;
@@ -49,6 +50,14 @@ public class ClientEntity extends AbstractIdentifiableEntity {
         this.clientId = clientId;
     }
 
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
     public boolean isEnabled() {
         return enabled;
     }

model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java

@@ -226,6 +226,7 @@ public class ModelToRepresentation {
         ClientRepresentation rep = new ClientRepresentation();
         rep.setId(clientModel.getId());
         rep.setClientId(clientModel.getClientId());
+        rep.setName(clientModel.getName());
         rep.setEnabled(clientModel.isEnabled());
         rep.setAdminUrl(clientModel.getManagementUrl());
         rep.setPublicClient(clientModel.isPublicClient());

model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java

@@ -523,6 +523,7 @@ public class RepresentationToModel {
         logger.debug("Create client: {0}" + resourceRep.getClientId());
 
         ClientModel client = resourceRep.getId()!=null ? realm.addClient(resourceRep.getId(), resourceRep.getClientId()) : realm.addClient(resourceRep.getClientId());
+        if (resourceRep.getName() != null) client.setName(resourceRep.getName());
         if (resourceRep.isEnabled() != null) client.setEnabled(resourceRep.isEnabled());
         client.setManagementUrl(resourceRep.getAdminUrl());
         if (resourceRep.isSurrogateAuthRequired() != null)
@@ -614,6 +615,7 @@ public class RepresentationToModel {
 
     public static void updateClient(ClientRepresentation rep, ClientModel resource) {
         if (rep.getClientId() != null) resource.setClientId(rep.getClientId());
+        if (rep.getName() != null) resource.setName(rep.getName());
         if (rep.isEnabled() != null) resource.setEnabled(rep.isEnabled());
         if (rep.isBearerOnly() != null) resource.setBearerOnly(rep.isBearerOnly());
         if (rep.isConsentRequired() != null) resource.setConsentRequired(rep.isConsentRequired());
@@ -792,23 +794,25 @@ public class RepresentationToModel {
                     throw new RuntimeException("Unable to find client consent mappings for client: " + entry.getKey());
                 }
 
-                UserConsentModel consentModel = new UserConsentModel(newRealm, client.getId());
+                UserConsentModel consentModel = new UserConsentModel(client);
 
                 UserConsentRepresentation consentRep = entry.getValue();
                 if (consentRep.getGrantedRoles() != null) {
                     for (String roleId : consentRep.getGrantedRoles()) {
-                        if (newRealm.getRoleById(roleId) == null) {
+                        RoleModel role = newRealm.getRoleById(roleId);
+                        if (role == null) {
                             throw new RuntimeException("Unable to find realm role referenced in consent mappings of user " + user.getUsername() + ". Role ID: " + roleId);
                         }
-                        consentModel.addGrantedRole(roleId);
+                        consentModel.addGrantedRole(role);
                     }
                 }
                 if (consentRep.getGrantedProtocolMappers() != null) {
                     for (String mapperId : consentRep.getGrantedProtocolMappers()) {
-                        if (client.getProtocolMapperById(mapperId) == null) {
+                        ProtocolMapperModel protocolMapper = client.getProtocolMapperById(mapperId);
+                        if (protocolMapper == null) {
                             throw new RuntimeException("Unable to find protocol mapper referenced in consent mappings of user " + user.getUsername() + ". Protocol mapper ID: " + mapperId);
                         }
-                        consentModel.addGrantedProtocolMapper(mapperId);;
+                        consentModel.addGrantedProtocolMapper(protocolMapper);
                     }
                 }
                 user.addConsent(consentModel);

model/file/src/main/java/org/keycloak/models/file/adapter/ClientAdapter.java

@@ -68,6 +68,16 @@ public class ClientAdapter implements ClientModel {
         return entity.getId();
     }
 
+    @Override
+    public String getName() {
+        return entity.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+       entity.setName(name);
+    }
+
     @Override
     public Set<String> getWebOrigins() {
         Set<String> result = new HashSet<String>();

model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java

@@ -293,7 +293,7 @@ public class ClientAdapter implements ClientModel {
     @Override
     public String getClientId() {
         if (updated != null) return updated.getClientId();
-        return cached.getName();
+        return cached.getClientId();
     }
 
     @Override
@@ -303,6 +303,18 @@ public class ClientAdapter implements ClientModel {
         cacheSession.registerRealmInvalidation(cachedRealm.getId());
     }
 
+    @Override
+    public String getName() {
+        if (updated != null) return updated.getName();
+        return cached.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        getDelegateForUpdate();
+        updated.setName(name);
+    }
+
     @Override
     public boolean isSurrogateAuthRequired() {
         if (updated != null) return updated.isSurrogateAuthRequired();

model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java

@@ -21,6 +21,7 @@ import java.util.TreeMap;
  */
 public class CachedClient {
     private String id;
+    private String clientId;
     private String name;
     private String realm;
     private Set<String> redirectUris = new HashSet<String>();
@@ -49,7 +50,8 @@ public class CachedClient {
     public CachedClient(RealmCache cache, RealmProvider delegate, RealmModel realm, ClientModel model) {
         id = model.getId();
         secret = model.getSecret();
-        name = model.getClientId();
+        clientId = model.getClientId();
+        name = model.getName();
         this.realm = realm.getId();
         enabled = model.isEnabled();
         protocol = model.getProtocol();
@@ -85,6 +87,10 @@ public class CachedClient {
         return id;
     }
 
+    public String getClientId() {
+        return clientId;
+    }
+
     public String getName() {
         return name;
     }

model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java

@@ -54,6 +54,16 @@ public class ClientAdapter implements ClientModel {
         return realm;
     }
 
+    @Override
+    public String getName() {
+        return entity.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        entity.setName(name);
+    }
+
     @Override
     public boolean isEnabled() {
         return entity.isEnabled();

model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java

@@ -561,19 +561,27 @@ public class UserAdapter implements UserModel {
             return null;
         }
 
-        UserConsentModel model = new UserConsentModel(realm, entity.getClientId());
+        ClientModel client = realm.getClientById(entity.getClientId());
+        if (client == null) {
+            throw new ModelException("Client with id " + entity.getClientId() + " is not available");
+        }
+        UserConsentModel model = new UserConsentModel(client);
 
         Collection<UserConsentRoleEntity> grantedRoleEntities = entity.getGrantedRoles();
         if (grantedRoleEntities != null) {
             for (UserConsentRoleEntity grantedRole : grantedRoleEntities) {
-                model.addGrantedRole(grantedRole.getRoleId());
+                RoleModel grantedRoleModel = realm.getRoleById(grantedRole.getRoleId());
+                if (grantedRoleModel != null) {
+                    model.addGrantedRole(grantedRoleModel);
+                }
             }
         }
 
         Collection<UserConsentProtocolMapperEntity> grantedProtocolMapperEntities = entity.getGrantedProtocolMappers();
         if (grantedProtocolMapperEntities != null) {
             for (UserConsentProtocolMapperEntity grantedProtMapper : grantedProtocolMapperEntities) {
-                model.addGrantedProtocolMapper(grantedProtMapper.getProtocolMapperId());
+                ProtocolMapperModel protocolMapper = client.getProtocolMapperById(grantedProtMapper.getProtocolMapperId());
+                model.addGrantedProtocolMapper(protocolMapper );
             }
         }
 

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java

@@ -32,6 +32,8 @@ public class ClientEntity {
     @Id
     @Column(name="ID", length = 36)
     private String id;
+    @Column(name = "NAME")
+    private String name;
     @Column(name = "CLIENT_ID")
     private String clientId;
     @Column(name="ENABLED")
@@ -125,6 +127,14 @@ public class ClientEntity {
         this.id = id;
     }
 
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
     public boolean isEnabled() {
         return enabled;
     }

model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java

@@ -27,20 +27,20 @@ import java.util.Set;
  */
 public class ClientAdapter extends AbstractMongoAdapter<MongoClientEntity> implements ClientModel {
 
-    protected final MongoClientEntity applicationEntity;
+    protected final MongoClientEntity clientEntity;
     private final RealmModel realm;
     protected  KeycloakSession session;
 
-    public ClientAdapter(KeycloakSession session, RealmModel realm, MongoClientEntity applicationEntity, MongoStoreInvocationContext invContext) {
+    public ClientAdapter(KeycloakSession session, RealmModel realm, MongoClientEntity clientEntity, MongoStoreInvocationContext invContext) {
         super(invContext);
         this.session = session;
         this.realm = realm;
-        this.applicationEntity = applicationEntity;
+        this.clientEntity = clientEntity;
     }
 
     @Override
     public MongoClientEntity getMongoEntity() {
-        return applicationEntity;
+        return clientEntity;
     }
 
     @Override
@@ -59,6 +59,17 @@ public class ClientAdapter extends AbstractMongoAdapter<MongoClientEntity> imple
         return getMongoEntity().getClientId();
     }
 
+    @Override
+    public String getName() {
+        return getMongoEntity().getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        getMongoEntity().setName(name);
+        updateMongoEntity();
+    }
+
     @Override
     public void setClientId(String clientId) {
         getMongoEntity().setClientId(clientId);
@@ -84,12 +95,12 @@ public class ClientAdapter extends AbstractMongoAdapter<MongoClientEntity> imple
 
     @Override
     public void addWebOrigin(String webOrigin) {
-        getMongoStore().pushItemToList(applicationEntity, "webOrigins", webOrigin, true, invocationContext);
+        getMongoStore().pushItemToList(clientEntity, "webOrigins", webOrigin, true, invocationContext);
     }
 
     @Override
     public void removeWebOrigin(String webOrigin) {
-        getMongoStore().pullItemFromList(applicationEntity, "webOrigins", webOrigin, invocationContext);
+        getMongoStore().pullItemFromList(clientEntity, "webOrigins", webOrigin, invocationContext);
     }
 
     @Override
@@ -111,12 +122,12 @@ public class ClientAdapter extends AbstractMongoAdapter<MongoClientEntity> imple
 
     @Override
     public void addRedirectUri(String redirectUri) {
-        getMongoStore().pushItemToList(applicationEntity, "redirectUris", redirectUri, true, invocationContext);
+        getMongoStore().pushItemToList(clientEntity, "redirectUris", redirectUri, true, invocationContext);
     }
 
     @Override
     public void removeRedirectUri(String redirectUri) {
-        getMongoStore().pullItemFromList(applicationEntity, "redirectUris", redirectUri, invocationContext);
+        getMongoStore().pullItemFromList(clientEntity, "redirectUris", redirectUri, invocationContext);
     }
 
     @Override

model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java

@@ -462,12 +462,22 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
     }
 
     private UserConsentModel toConsentModel(UserConsentEntity entity) {
-        UserConsentModel model = new UserConsentModel(realm, entity.getClientId());
-        for (String roleId : entity.getGrantedRoles()) {
-            model.addGrantedRole(roleId);
+        ClientModel client = realm.getClientById(entity.getClientId());
+        if (client == null) {
+            throw new ModelException("Client with id " + entity.getClientId() + " is not available");
         }
+        UserConsentModel model = new UserConsentModel(client);
+
+        for (String roleId : entity.getGrantedRoles()) {
+            RoleModel roleModel = realm.getRoleById(roleId);
+            if (roleModel != null) {
+                model.addGrantedRole(roleModel);
+            }
+        }
+
         for (String protMapperId : entity.getGrantedProtocolMappers()) {
-            model.addGrantedProtocolMapper(protMapperId);
+            ProtocolMapperModel protocolMapper = client.getProtocolMapperById(protMapperId);
+            model.addGrantedProtocolMapper(protocolMapper);
         }
         return model;
     }

model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/ClientSessionAdapter.java

@@ -118,6 +118,17 @@ public class ClientSessionAdapter implements ClientSessionModel {
         update();
     }
 
+    @Override
+    public Set<String> getProtocolMappers() {
+        return entity.getProtocolMappers();
+    }
+
+    @Override
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        entity.setProtocolMappers(protocolMappers);
+        update();
+    }
+
     @Override
     public String getAuthMethod() {
         return entity.getAuthMethod();

model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/ClientSessionEntity.java

@@ -25,6 +25,7 @@ public class ClientSessionEntity extends SessionEntity {
     private ClientSessionModel.Action action;
 
     private Set<String> roles;
+    private Set<String> protocolMappers;
     private Map<String, String> notes;
 
     public String getClient() {
@@ -91,6 +92,14 @@ public class ClientSessionEntity extends SessionEntity {
         this.roles = roles;
     }
 
+    public Set<String> getProtocolMappers() {
+        return protocolMappers;
+    }
+
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        this.protocolMappers = protocolMappers;
+    }
+
     public Map<String, String> getNotes() {
         return notes;
     }

model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/ClientSessionAdapter.java

@@ -7,6 +7,7 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.sessions.jpa.entities.ClientSessionEntity;
 import org.keycloak.models.sessions.jpa.entities.ClientSessionNoteEntity;
+import org.keycloak.models.sessions.jpa.entities.ClientSessionProtocolMapperEntity;
 import org.keycloak.models.sessions.jpa.entities.ClientSessionRoleEntity;
 import org.keycloak.models.sessions.jpa.entities.UserSessionEntity;
 
@@ -177,4 +178,36 @@ public class ClientSessionAdapter implements ClientSessionModel {
         }
         return roles;
     }
+
+    @Override
+    public Set<String> getProtocolMappers() {
+        Set<String> protMappers = new HashSet<String>();
+        if (entity.getProtocolMappers() != null) {
+            for (ClientSessionProtocolMapperEntity e : entity.getProtocolMappers()) {
+                protMappers.add(e.getProtocolMapperId());
+            }
+        }
+        return protMappers;
+    }
+
+    @Override
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        if (protocolMappers != null) {
+            for (String pm : protocolMappers) {
+                ClientSessionProtocolMapperEntity protMapperEntity = new ClientSessionProtocolMapperEntity();
+                protMapperEntity.setClientSession(entity);
+                protMapperEntity.setProtocolMapperId(pm);
+                em.persist(protMapperEntity);
+
+                entity.getProtocolMappers().add(protMapperEntity);
+            }
+        } else {
+            if (entity.getProtocolMappers() != null) {
+                for (ClientSessionProtocolMapperEntity pm : entity.getProtocolMappers()) {
+                    em.remove(pm);
+                }
+                entity.getProtocolMappers().clear();
+            }
+        }
+    }
 }

model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProvider.java

@@ -214,6 +214,10 @@ public class JpaUserSessionProvider implements UserSessionProvider {
                 .setParameter("realmId", realm.getId())
                 .setParameter("userId", user.getId())
                 .executeUpdate();
+        em.createNamedQuery("removeClientSessionProtMapperByUser")
+                .setParameter("realmId", realm.getId())
+                .setParameter("userId", user.getId())
+                .executeUpdate();
         em.createNamedQuery("removeClientSessionByUser")
                 .setParameter("realmId", realm.getId())
                 .setParameter("userId", user.getId())
@@ -238,6 +242,10 @@ public class JpaUserSessionProvider implements UserSessionProvider {
                 .setParameter("realmId", realm.getId())
                 .setParameter("maxTime", dettachedClientSessionExpired)
                 .executeUpdate();
+        em.createNamedQuery("removeDetachedClientSessionProtMapperByExpired")
+                .setParameter("realmId", realm.getId())
+                .setParameter("maxTime", dettachedClientSessionExpired)
+                .executeUpdate();
         em.createNamedQuery("removeDetachedClientSessionNoteByExpired")
                 .setParameter("realmId", realm.getId())
                 .setParameter("maxTime", dettachedClientSessionExpired)
@@ -251,6 +259,11 @@ public class JpaUserSessionProvider implements UserSessionProvider {
                 .setParameter("maxTime", maxTime)
                 .setParameter("idleTime", idleTime)
                 .executeUpdate();
+        em.createNamedQuery("removeClientSessionProtMapperByExpired")
+                .setParameter("realmId", realm.getId())
+                .setParameter("maxTime", maxTime)
+                .setParameter("idleTime", idleTime)
+                .executeUpdate();
         em.createNamedQuery("removeClientSessionNoteByExpired")
                 .setParameter("realmId", realm.getId())
                 .setParameter("maxTime", maxTime)
@@ -277,6 +290,7 @@ public class JpaUserSessionProvider implements UserSessionProvider {
     public void removeUserSessions(RealmModel realm) {
         em.createNamedQuery("removeClientSessionNoteByRealm").setParameter("realmId", realm.getId()).executeUpdate();
         em.createNamedQuery("removeClientSessionRoleByRealm").setParameter("realmId", realm.getId()).executeUpdate();
+        em.createNamedQuery("removeClientSessionProtMapperByRealm").setParameter("realmId", realm.getId()).executeUpdate();
         em.createNamedQuery("removeClientSessionByRealm").setParameter("realmId", realm.getId()).executeUpdate();
         em.createNamedQuery("removeUserSessionNoteByRealm").setParameter("realmId", realm.getId()).executeUpdate();
         em.createNamedQuery("removeUserSessionByRealm").setParameter("realmId", realm.getId()).executeUpdate();
@@ -292,6 +306,7 @@ public class JpaUserSessionProvider implements UserSessionProvider {
     public void onClientRemoved(RealmModel realm, ClientModel client) {
         em.createNamedQuery("removeClientSessionNoteByClient").setParameter("realmId", realm.getId()).setParameter("clientId", client.getId()).executeUpdate();
         em.createNamedQuery("removeClientSessionRoleByClient").setParameter("realmId", realm.getId()).setParameter("clientId", client.getId()).executeUpdate();
+        em.createNamedQuery("removeClientSessionProtMapperByClient").setParameter("realmId", realm.getId()).setParameter("clientId", client.getId()).executeUpdate();
         em.createNamedQuery("removeClientSessionByClient").setParameter("realmId", realm.getId()).setParameter("clientId", client.getId()).executeUpdate();
     }
 

model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/entities/ClientSessionEntity.java

@@ -60,6 +60,9 @@ public class ClientSessionEntity {
     @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="clientSession")
     protected Collection<ClientSessionRoleEntity> roles = new ArrayList<ClientSessionRoleEntity>();
 
+    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="clientSession")
+    protected Collection<ClientSessionProtocolMapperEntity> protocolMappers = new ArrayList<ClientSessionProtocolMapperEntity>();
+
     @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="clientSession")
     protected Collection<ClientSessionNoteEntity> notes = new ArrayList<ClientSessionNoteEntity>();
 
@@ -127,6 +130,14 @@ public class ClientSessionEntity {
         this.roles = roles;
     }
 
+    public Collection<ClientSessionProtocolMapperEntity> getProtocolMappers() {
+        return protocolMappers;
+    }
+
+    public void setProtocolMappers(Collection<ClientSessionProtocolMapperEntity> protocolMappers) {
+        this.protocolMappers = protocolMappers;
+    }
+
     public Collection<ClientSessionNoteEntity> getNotes() {
         return notes;
     }

model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/entities/ClientSessionProtocolMapperEntity.java

@@ -0,0 +1,98 @@
+package org.keycloak.models.sessions.jpa.entities;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@NamedQueries({
+        @NamedQuery(name = "removeClientSessionProtMapperByUser", query="delete from ClientSessionProtocolMapperEntity pm where pm.clientSession IN (select c from ClientSessionEntity c where c.session IN (select s from UserSessionEntity s where s.realmId = :realmId and s.userId = :userId))"),
+        @NamedQuery(name = "removeClientSessionProtMapperByClient", query="delete from ClientSessionProtocolMapperEntity pm where pm.clientSession IN (select c from ClientSessionEntity c where c.clientId = :clientId and c.realmId = :realmId)"),
+        @NamedQuery(name = "removeClientSessionProtMapperByRealm", query="delete from ClientSessionProtocolMapperEntity pm where pm.clientSession IN (select c from ClientSessionEntity c where c.realmId = :realmId)"),
+        @NamedQuery(name = "removeClientSessionProtMapperByExpired", query = "delete from ClientSessionProtocolMapperEntity pm where pm.clientSession IN (select c from ClientSessionEntity c where c.session IN (select s from UserSessionEntity s where s.realmId = :realmId and (s.started < :maxTime or s.lastSessionRefresh < :idleTime)))"),
+        @NamedQuery(name = "removeDetachedClientSessionProtMapperByExpired", query = "delete from ClientSessionProtocolMapperEntity pm where pm.clientSession IN (select c from ClientSessionEntity c where c.session IS NULL and c.realmId = :realmId and c.timestamp < :maxTime )")
+})
+@Table(name="CLIENT_SESSION_PROT_MAPPER")
+@Entity
+@IdClass(ClientSessionProtocolMapperEntity.Key.class)
+public class ClientSessionProtocolMapperEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name="CLIENT_SESSION")
+    protected ClientSessionEntity clientSession;
+
+    @Id
+    @Column(name="PROTOCOL_MAPPER_ID")
+    protected String protocolMapperId;
+
+    public ClientSessionEntity getClientSession() {
+        return clientSession;
+    }
+
+    public void setClientSession(ClientSessionEntity clientSession) {
+        this.clientSession = clientSession;
+    }
+
+    public String getProtocolMapperId() {
+        return protocolMapperId;
+    }
+
+    public void setProtocolMapperId(String protocolMapperId) {
+        this.protocolMapperId = protocolMapperId;
+    }
+
+    public static class Key implements Serializable {
+
+        protected ClientSessionEntity clientSession;
+
+        protected String protocolMapperId;
+
+        public Key() {
+        }
+
+        public Key(ClientSessionEntity clientSession, String protocolMapperId) {
+            this.clientSession = clientSession;
+            this.protocolMapperId = protocolMapperId;
+        }
+
+        public ClientSessionEntity getClientSession() {
+            return clientSession;
+        }
+
+        public String getProtocolMapperId() {
+            return protocolMapperId;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (!protocolMapperId.equals(key.protocolMapperId)) return false;
+            if (!clientSession.getId().equals(key.clientSession.getId())) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = clientSession.getId().hashCode();
+            result = 31 * result + protocolMapperId.hashCode();
+            return result;
+        }
+    }
+}

model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/ClientSessionAdapter.java

@@ -105,6 +105,16 @@ public class ClientSessionAdapter implements ClientSessionModel {
         return entity.getRoles();
     }
 
+    @Override
+    public Set<String> getProtocolMappers() {
+        return entity.getProtocolMappers();
+    }
+
+    @Override
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        entity.setProtocolMappers(protocolMappers);
+    }
+
     @Override
     public String getNote(String name) {
         return entity.getNotes().get(name);

model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/ClientSessionEntity.java

@@ -23,6 +23,7 @@ public class ClientSessionEntity {
     private int timestamp;
     private ClientSessionModel.Action action;
     private Set<String> roles;
+    private Set<String> protocolMappers;
     private Map<String, String> notes = new HashMap<String, String>();
 
     public String getId() {
@@ -89,6 +90,14 @@ public class ClientSessionEntity {
         this.roles = roles;
     }
 
+    public Set<String> getProtocolMappers() {
+        return protocolMappers;
+    }
+
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        this.protocolMappers = protocolMappers;
+    }
+
     public Map<String, String> getNotes() {
         return notes;
     }

model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/ClientSessionAdapter.java

@@ -120,6 +120,23 @@ public class ClientSessionAdapter extends AbstractMongoAdapter<MongoClientSessio
         return entity.getRoles() != null ? new HashSet<String>(entity.getRoles()) : null;
     }
 
+    @Override
+    public Set<String> getProtocolMappers() {
+        return entity.getProtocolMappers() != null ? new HashSet<String>(entity.getProtocolMappers()) : null;
+    }
+
+    @Override
+    public void setProtocolMappers(Set<String> protocolMappers) {
+        if (protocolMappers == null) {
+            entity.setProtocolMappers(null);
+        } else {
+            List<String> list = new LinkedList<String>();
+            list.addAll(protocolMappers);
+            entity.setProtocolMappers(list);
+        }
+        updateMongoEntity();
+    }
+
     @Override
     public String getNote(String name) {
         return entity.getNotes().get(name);

model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/entities/MongoClientSessionEntity.java

@@ -27,6 +27,7 @@ public class MongoClientSessionEntity extends AbstractIdentifiableEntity impleme
     private int timestamp;
     private ClientSessionModel.Action action;
     private List<String> roles;
+    private List<String> protocolMappers;
     private Map<String, String> notes = new HashMap<String, String>();
 
     public String getId() {
@@ -93,6 +94,14 @@ public class MongoClientSessionEntity extends AbstractIdentifiableEntity impleme
         this.roles = roles;
     }
 
+    public List<String> getProtocolMappers() {
+        return protocolMappers;
+    }
+
+    public void setProtocolMappers(List<String> protocolMappers) {
+        this.protocolMappers = protocolMappers;
+    }
+
     public Map<String, String> getNotes() {
         return notes;
     }