KEYCLOAK-6630 Client scopes initial support (#5076)

* KEYCLOAK-6630 KEYCLOAK-349 Client Scopes

Co-authored-by: vramik <vramik@redhat.com>

* KEYCLOAK-6630 Change some clientTemplate occurences to clientScope

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/ClientAdapter.java

@@ -18,7 +18,7 @@
 package org.keycloak.models.cache.infinispan;
 
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
@@ -97,60 +97,37 @@ public class ClientAdapter implements ClientModel, CachedObject {
     }
 
     @Override
-    public ClientTemplateModel getClientTemplate() {
-        if (isUpdated()) return updated.getClientTemplate();
-        if (cached.getClientTemplate() == null) return null;
-        return cacheSession.getClientTemplateById(cached.getClientTemplate(), cachedRealm);
-    }
-
-    @Override
-    public void setClientTemplate(ClientTemplateModel template) {
+    public void addClientScope(ClientScopeModel clientScope, boolean defaultScope) {
         getDelegateForUpdate();
-        updated.setClientTemplate(template);
-
+        updated.addClientScope(clientScope, defaultScope);
     }
 
     @Override
-    public boolean useTemplateScope() {
-        if (isUpdated()) return updated.useTemplateScope();
-        return cached.isUseTemplateScope();
-    }
-
-    @Override
-    public void setUseTemplateScope(boolean value) {
+    public void removeClientScope(ClientScopeModel clientScope) {
         getDelegateForUpdate();
-        updated.setUseTemplateScope(value);
-
+        updated.removeClientScope(clientScope);
     }
 
     @Override
-    public boolean useTemplateConfig() {
-        if (isUpdated()) return updated.useTemplateConfig();
-        return cached.isUseTemplateConfig();
+    public Map<String, ClientScopeModel> getClientScopes(boolean defaultScope, boolean filterByProtocol) {
+        if (isUpdated()) return updated.getClientScopes(defaultScope, filterByProtocol);
+        List<String> clientScopeIds = defaultScope ? cached.getDefaultClientScopesIds() : cached.getOptionalClientScopesIds();
+
+        // Defaults to openid-connect
+        String clientProtocol = getProtocol() == null ? "openid-connect" : getProtocol();
+
+        Map<String, ClientScopeModel> clientScopes = new HashMap<>();
+        for (String scopeId : clientScopeIds) {
+            ClientScopeModel clientScope = cacheSession.getClientScopeById(scopeId, cachedRealm);
+            if (clientScope != null) {
+                if (!filterByProtocol || clientScope.getProtocol().equals(clientProtocol)) {
+                    clientScopes.put(clientScope.getName(), clientScope);
+                }
+            }
+        }
+        return clientScopes;
     }
 
-    @Override
-    public void setUseTemplateConfig(boolean value) {
-        getDelegateForUpdate();
-        updated.setUseTemplateConfig(value);
-
-    }
-
-    @Override
-    public boolean useTemplateMappers() {
-        if (isUpdated()) return updated.useTemplateMappers();
-        return cached.isUseTemplateMappers();
-    }
-
-    @Override
-    public void setUseTemplateMappers(boolean value) {
-        getDelegateForUpdate();
-        updated.setUseTemplateMappers(value);
-
-    }
-
-
-
     public void addWebOrigin(String webOrigin) {
         getDelegateForUpdate();
         updated.addWebOrigin(webOrigin);

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/ClientScopeAdapter.java

@@ -18,12 +18,12 @@
 package org.keycloak.models.cache.infinispan;
 
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.cache.infinispan.entities.CachedClientTemplate;
+import org.keycloak.models.cache.infinispan.entities.CachedClientScope;
 
 import java.util.HashMap;
 import java.util.HashSet;
@@ -34,14 +34,14 @@ import java.util.Set;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class ClientTemplateAdapter implements ClientTemplateModel {
+public class ClientScopeAdapter implements ClientScopeModel {
     protected RealmCacheSession cacheSession;
     protected RealmModel cachedRealm;
 
-    protected ClientTemplateModel updated;
-    protected CachedClientTemplate cached;
+    protected ClientScopeModel updated;
+    protected CachedClientScope cached;
 
-    public ClientTemplateAdapter(RealmModel cachedRealm, CachedClientTemplate cached, RealmCacheSession cacheSession) {
+    public ClientScopeAdapter(RealmModel cachedRealm, CachedClientScope cached, RealmCacheSession cacheSession) {
         this.cachedRealm = cachedRealm;
         this.cacheSession = cacheSession;
         this.cached = cached;
@@ -49,8 +49,8 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
 
     private void getDelegateForUpdate() {
         if (updated == null) {
-            cacheSession.registerClientTemplateInvalidation(cached.getId());
-            updated = cacheSession.getRealmDelegate().getClientTemplateById(cached.getId(), cachedRealm);
+            cacheSession.registerClientScopeInvalidation(cached.getId());
+            updated = cacheSession.getRealmDelegate().getClientScopeById(cached.getId(), cachedRealm);
             if (updated == null) throw new IllegalStateException("Not found in database");
         }
     }
@@ -63,7 +63,7 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
     protected boolean isUpdated() {
         if (updated != null) return true;
         if (!invalidated) return false;
-        updated = cacheSession.getRealmDelegate().getClientTemplateById(cached.getId(), cachedRealm);
+        updated = cacheSession.getRealmDelegate().getClientScopeById(cached.getId(), cachedRealm);
         if (updated == null) throw new IllegalStateException("Not found in database");
         return true;
     }
@@ -157,19 +157,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
         updated.setProtocol(protocol);
     }
 
-    @Override
-    public boolean isFullScopeAllowed() {
-        if (isUpdated()) return updated.isFullScopeAllowed();
-        return cached.isFullScopeAllowed();
-    }
-
-    @Override
-    public void setFullScopeAllowed(boolean value) {
-        getDelegateForUpdate();
-        updated.setFullScopeAllowed(value);
-
-    }
-
     public Set<RoleModel> getScopeMappings() {
         if (isUpdated()) return updated.getScopeMappings();
         Set<RoleModel> roles = new HashSet<RoleModel>();
@@ -209,7 +196,7 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
     @Override
     public boolean hasScope(RoleModel role) {
         if (isUpdated()) return updated.hasScope(role);
-        if (cached.isFullScopeAllowed() || cached.getScope().contains(role.getId())) return true;
+        if (cached.getScope().contains(role.getId())) return true;
 
         Set<RoleModel> roles = getScopeMappings();
 
@@ -219,25 +206,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
        return false;
     }
 
-    public boolean isPublicClient() {
-        if (isUpdated()) return updated.isPublicClient();
-        return cached.isPublicClient();
-    }
-
-    public void setPublicClient(boolean flag) {
-        getDelegateForUpdate();
-        updated.setPublicClient(flag);
-    }
-
-    public boolean isFrontchannelLogout() {
-        if (isUpdated()) return updated.isPublicClient();
-        return cached.isFrontchannelLogout();
-    }
-
-    public void setFrontchannelLogout(boolean flag) {
-        getDelegateForUpdate();
-        updated.setFrontchannelLogout(flag);
-    }
 
     @Override
     public void setAttribute(String name, String value) {
@@ -267,87 +235,13 @@ public class ClientTemplateAdapter implements ClientTemplateModel {
         return copy;
     }
 
-    @Override
-    public boolean isBearerOnly() {
-        if (isUpdated()) return updated.isBearerOnly();
-        return cached.isBearerOnly();
-    }
-
-    @Override
-    public void setBearerOnly(boolean only) {
-        getDelegateForUpdate();
-        updated.setBearerOnly(only);
-    }
-
-    @Override
-    public boolean isConsentRequired() {
-        if (isUpdated()) return updated.isConsentRequired();
-        return cached.isConsentRequired();
-    }
-
-    @Override
-    public void setConsentRequired(boolean consentRequired) {
-        getDelegateForUpdate();
-        updated.setConsentRequired(consentRequired);
-    }
-
-    @Override
-    public boolean isStandardFlowEnabled() {
-        if (isUpdated()) return updated.isStandardFlowEnabled();
-        return cached.isStandardFlowEnabled();
-    }
-
-    @Override
-    public void setStandardFlowEnabled(boolean standardFlowEnabled) {
-        getDelegateForUpdate();
-        updated.setStandardFlowEnabled(standardFlowEnabled);
-    }
-
-    @Override
-    public boolean isImplicitFlowEnabled() {
-        if (isUpdated()) return updated.isImplicitFlowEnabled();
-        return cached.isImplicitFlowEnabled();
-    }
-
-    @Override
-    public void setImplicitFlowEnabled(boolean implicitFlowEnabled) {
-        getDelegateForUpdate();
-        updated.setImplicitFlowEnabled(implicitFlowEnabled);
-    }
-
-    @Override
-    public boolean isDirectAccessGrantsEnabled() {
-        if (isUpdated()) return updated.isDirectAccessGrantsEnabled();
-        return cached.isDirectAccessGrantsEnabled();
-    }
-
-    @Override
-    public void setDirectAccessGrantsEnabled(boolean directAccessGrantsEnabled) {
-        getDelegateForUpdate();
-        updated.setDirectAccessGrantsEnabled(directAccessGrantsEnabled);
-    }
-
-    @Override
-    public boolean isServiceAccountsEnabled() {
-        if (isUpdated()) return updated.isServiceAccountsEnabled();
-        return cached.isServiceAccountsEnabled();
-    }
-
-    @Override
-    public void setServiceAccountsEnabled(boolean serviceAccountsEnabled) {
-        getDelegateForUpdate();
-        updated.setServiceAccountsEnabled(serviceAccountsEnabled);
-    }
-
-
-
 
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || !(o instanceof ClientModel)) return false;
 
-        ClientTemplateModel that = (ClientTemplateModel) o;
+        ClientScopeModel that = (ClientScopeModel) o;
         return that.getId().equals(getId());
     }
 

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmAdapter.java

@@ -1287,15 +1287,15 @@ public class RealmAdapter implements CachedRealmModel {
     }
 
     @Override
-    public List<ClientTemplateModel> getClientTemplates() {
-        if (isUpdated()) return updated.getClientTemplates();
-        List<String> clientTemplates = cached.getClientTemplates();
-        if (clientTemplates.isEmpty()) return Collections.EMPTY_LIST;
-        List<ClientTemplateModel> apps = new LinkedList<ClientTemplateModel>();
-        for (String id : clientTemplates) {
-            ClientTemplateModel model = cacheSession.getClientTemplateById(id, this);
+    public List<ClientScopeModel> getClientScopes() {
+        if (isUpdated()) return updated.getClientScopes();
+        List<String> clientScopes = cached.getClientScopes();
+        if (clientScopes.isEmpty()) return Collections.EMPTY_LIST;
+        List<ClientScopeModel> apps = new LinkedList<ClientScopeModel>();
+        for (String id : clientScopes) {
+            ClientScopeModel model = cacheSession.getClientScopeById(id, this);
             if (model == null) {
-                throw new IllegalStateException("Cached clientemplate not found: " + id);
+                throw new IllegalStateException("Cached clientScope not found: " + id);
             }
             apps.add(model);
         }
@@ -1304,32 +1304,60 @@ public class RealmAdapter implements CachedRealmModel {
     }
 
     @Override
-    public ClientTemplateModel addClientTemplate(String name) {
+    public ClientScopeModel addClientScope(String name) {
         getDelegateForUpdate();
-        ClientTemplateModel app = updated.addClientTemplate(name);
-        cacheSession.registerClientTemplateInvalidation(app.getId());
+        ClientScopeModel app = updated.addClientScope(name);
+        cacheSession.registerClientScopeInvalidation(app.getId());
         return app;
     }
 
     @Override
-    public ClientTemplateModel addClientTemplate(String id, String name) {
+    public ClientScopeModel addClientScope(String id, String name) {
         getDelegateForUpdate();
-        ClientTemplateModel app =  updated.addClientTemplate(id, name);
-        cacheSession.registerClientTemplateInvalidation(app.getId());
+        ClientScopeModel app =  updated.addClientScope(id, name);
+        cacheSession.registerClientScopeInvalidation(app.getId());
         return app;
     }
 
     @Override
-    public boolean removeClientTemplate(String id) {
-        cacheSession.registerClientTemplateInvalidation(id);
+    public boolean removeClientScope(String id) {
+        cacheSession.registerClientScopeInvalidation(id);
         getDelegateForUpdate();
-        return updated.removeClientTemplate(id);
+        return updated.removeClientScope(id);
     }
 
     @Override
-    public ClientTemplateModel getClientTemplateById(String id) {
-        if (isUpdated()) return updated.getClientTemplateById(id);
-        return cacheSession.getClientTemplateById(id, this);
+    public ClientScopeModel getClientScopeById(String id) {
+        if (isUpdated()) return updated.getClientScopeById(id);
+        return cacheSession.getClientScopeById(id, this);
+    }
+
+    @Override
+    public void addDefaultClientScope(ClientScopeModel clientScope, boolean defaultScope) {
+        getDelegateForUpdate();
+        updated.addDefaultClientScope(clientScope, defaultScope);
+    }
+
+    @Override
+    public void removeDefaultClientScope(ClientScopeModel clientScope) {
+        getDelegateForUpdate();
+        updated.removeDefaultClientScope(clientScope);
+    }
+
+    @Override
+    public List<ClientScopeModel> getDefaultClientScopes(boolean defaultScope) {
+        if (isUpdated()) return updated.getDefaultClientScopes(defaultScope);
+
+        List<String> clientScopeIds = defaultScope ? cached.getDefaultDefaultClientScopes() : cached.getOptionalDefaultClientScopes();
+
+        List<ClientScopeModel> clientScopes = new LinkedList<>();
+        for (String scopeId : clientScopeIds) {
+            ClientScopeModel clientScope = cacheSession.getClientScopeById(scopeId, this);
+            if (clientScope != null) {
+                clientScopes.add(clientScope);
+            }
+        }
+        return clientScopes;
     }
 
     @Override

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RealmCacheSession.java

@@ -27,7 +27,6 @@ import org.keycloak.models.cache.CachedRealmModel;
 import org.keycloak.models.cache.infinispan.entities.*;
 import org.keycloak.models.cache.infinispan.events.*;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.storage.CacheableStorageProviderModel;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.client.ClientStorageProviderModel;
 
@@ -105,7 +104,7 @@ public class RealmCacheSession implements CacheRealmProvider {
 
     protected Map<String, RealmAdapter> managedRealms = new HashMap<>();
     protected Map<String, ClientModel> managedApplications = new HashMap<>();
-    protected Map<String, ClientTemplateAdapter> managedClientTemplates = new HashMap<>();
+    protected Map<String, ClientScopeAdapter> managedClientScopes = new HashMap<>();
     protected Map<String, RoleAdapter> managedRoles = new HashMap<>();
     protected Map<String, GroupAdapter> managedGroups = new HashMap<>();
     protected Set<String> listInvalidations = new HashSet<>();
@@ -182,16 +181,16 @@ public class RealmCacheSession implements CacheRealmProvider {
     }
 
     @Override
-    public void registerClientTemplateInvalidation(String id) {
-        invalidateClientTemplate(id);
-        // Note: Adding/Removing client template is supposed to invalidate CachedRealm as well, so the list of clientTemplates is invalidated.
+    public void registerClientScopeInvalidation(String id) {
+        invalidateClientScope(id);
+        // Note: Adding/Removing client template is supposed to invalidate CachedRealm as well, so the list of clientScopes is invalidated.
         // But separate RealmUpdatedEvent will be sent for it. So ClientTemplateEvent don't need to take care of it.
         invalidationEvents.add(ClientTemplateEvent.create(id));
     }
 
-    private void invalidateClientTemplate(String id) {
+    private void invalidateClientScope(String id) {
         invalidations.add(id);
-        ClientTemplateAdapter adapter = managedClientTemplates.get(id);
+        ClientScopeAdapter adapter = managedClientScopes.get(id);
         if (adapter != null) adapter.invalidate();
     }
 
@@ -218,9 +217,9 @@ public class RealmCacheSession implements CacheRealmProvider {
                 group.invalidate();
                 continue;
             }
-            ClientTemplateAdapter clientTemplate = managedClientTemplates.get(id);
-            if (clientTemplate != null) {
-                clientTemplate.invalidate();
+            ClientScopeAdapter clientScope = managedClientScopes.get(id);
+            if (clientScope != null) {
+                clientScope.invalidate();
                 continue;
             }
             RoleAdapter role = managedRoles.get(id);
@@ -1134,26 +1133,26 @@ public class RealmCacheSession implements CacheRealmProvider {
     }
 
     @Override
-    public ClientTemplateModel getClientTemplateById(String id, RealmModel realm) {
-        CachedClientTemplate cached = cache.get(id, CachedClientTemplate.class);
+    public ClientScopeModel getClientScopeById(String id, RealmModel realm) {
+        CachedClientScope cached = cache.get(id, CachedClientScope.class);
         if (cached != null && !cached.getRealm().equals(realm.getId())) {
             cached = null;
         }
 
         if (cached == null) {
             Long loaded = cache.getCurrentRevision(id);
-            ClientTemplateModel model = getRealmDelegate().getClientTemplateById(id, realm);
+            ClientScopeModel model = getRealmDelegate().getClientScopeById(id, realm);
             if (model == null) return null;
             if (invalidations.contains(id)) return model;
-            cached = new CachedClientTemplate(loaded, realm, model);
+            cached = new CachedClientScope(loaded, realm, model);
             cache.addRevisioned(cached, startupRevision);
         } else if (invalidations.contains(id)) {
-            return getRealmDelegate().getClientTemplateById(id, realm);
-        } else if (managedClientTemplates.containsKey(id)) {
-            return managedClientTemplates.get(id);
+            return getRealmDelegate().getClientScopeById(id, realm);
+        } else if (managedClientScopes.containsKey(id)) {
+            return managedClientScopes.get(id);
         }
-        ClientTemplateAdapter adapter = new ClientTemplateAdapter(realm, cached, this);
-        managedClientTemplates.put(id, adapter);
+        ClientScopeAdapter adapter = new ClientScopeAdapter(realm, cached, this);
+        managedClientScopes.put(id, adapter);
         return adapter;
     }
 

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/RoleAdapter.java

@@ -88,18 +88,6 @@ public class RoleAdapter implements RoleModel {
         updated.setDescription(description);
     }
 
-    @Override
-    public boolean isScopeParamRequired() {
-        if (isUpdated()) return updated.isScopeParamRequired();
-        return cached.isScopeParamRequired();
-    }
-
-    @Override
-    public void setScopeParamRequired(boolean scopeParamRequired) {
-        getDelegateForUpdate();
-        updated.setScopeParamRequired(scopeParamRequired);
-    }
-
     @Override
     public String getId() {
         if (isUpdated()) return updated.getId();

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserCacheSession.java

@@ -19,6 +19,7 @@ package org.keycloak.models.cache.infinispan;
 
 import org.jboss.logging.Logger;
 import org.keycloak.cluster.ClusterProvider;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.cache.CachedObject;
 import org.keycloak.models.cache.infinispan.events.InvalidationEvent;
 import org.keycloak.common.constants.ServiceAccountConstants;
@@ -49,6 +50,7 @@ import org.keycloak.models.cache.infinispan.events.UserFederationLinkRemovedEven
 import org.keycloak.models.cache.infinispan.events.UserFederationLinkUpdatedEvent;
 import org.keycloak.models.cache.infinispan.events.UserFullInvalidationEvent;
 import org.keycloak.models.cache.infinispan.events.UserUpdatedEvent;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.ReadOnlyUserModelDelegate;
 import org.keycloak.storage.CacheableStorageProviderModel;
 import org.keycloak.storage.StorageId;
@@ -715,15 +717,13 @@ public class UserCacheSession implements UserCache {
         consentModel.setCreatedDate(cachedConsent.getCreatedDate());
         consentModel.setLastUpdatedDate(cachedConsent.getLastUpdatedDate());
 
-        for (String roleId : cachedConsent.getRoleIds()) {
-            RoleModel role = session.realms().getRoleById(roleId, realm);
-            if (role != null) {
-                consentModel.addGrantedRole(role);
+        for (String clientScopeId : cachedConsent.getClientScopeIds()) {
+            ClientScopeModel clientScope = KeycloakModelUtils.findClientScopeById(realm, clientScopeId);
+            if (clientScope != null) {
+                consentModel.addGrantedClientScope(clientScope);
             }
         }
-        for (ProtocolMapperModel protocolMapper : cachedConsent.getProtocolMappers()) {
-            consentModel.addGrantedProtocolMapper(protocolMapper);
-        }
+
         return consentModel;
     }
 
@@ -852,6 +852,12 @@ public class UserCacheSession implements UserCache {
         getDelegate().preRemove(protocolMapper);
     }
 
+    @Override
+    public void preRemove(ClientScopeModel clientScope) {
+        // Not needed to invalidate realm probably. Just consents are affected ATM and they are checked if they exists
+        getDelegate().preRemove(clientScope);
+    }
+
     @Override
     public void preRemove(RealmModel realm, ComponentModel component) {
         if (!component.getProviderType().equals(UserStorageProvider.class.getName()) && !component.getProviderType().equals(ClientStorageProvider.class.getName())) return;

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedClient.java

@@ -18,6 +18,7 @@
 package org.keycloak.models.cache.infinispan.entities;
 
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -67,10 +68,8 @@ public class CachedClient extends AbstractRevisioned implements InRealm {
     protected boolean serviceAccountsEnabled;
     protected int nodeReRegistrationTimeout;
     protected Map<String, Integer> registeredNodes;
-    protected String clientTemplate;
-    protected boolean useTemplateScope;
-    protected boolean useTemplateConfig;
-    protected boolean useTemplateMappers;
+    protected List<String> defaultClientScopesIds;
+    protected List<String> optionalClientScopesIds;
 
     public CachedClient(Long revision, RealmModel realm, ClientModel model) {
         super(revision, model.getId());
@@ -111,12 +110,15 @@ public class CachedClient extends AbstractRevisioned implements InRealm {
 
         nodeReRegistrationTimeout = model.getNodeReRegistrationTimeout();
         registeredNodes = new TreeMap<>(model.getRegisteredNodes());
-        if (model.getClientTemplate() != null) {
-            clientTemplate = model.getClientTemplate().getId();
+
+        defaultClientScopesIds = new LinkedList<>();
+        for (ClientScopeModel clientScope : model.getClientScopes(true, false).values()) {
+            defaultClientScopesIds.add(clientScope.getId());
+        }
+        optionalClientScopesIds = new LinkedList<>();
+        for (ClientScopeModel clientScope : model.getClientScopes(false, false).values()) {
+            optionalClientScopesIds.add(clientScope.getId());
         }
-        useTemplateConfig = model.useTemplateConfig();
-        useTemplateMappers = model.useTemplateMappers();
-        useTemplateScope = model.useTemplateScope();
     }
 
     public String getClientId() {
@@ -243,20 +245,12 @@ public class CachedClient extends AbstractRevisioned implements InRealm {
         return registeredNodes;
     }
 
-    public String getClientTemplate() {
-        return clientTemplate;
+    public List<String> getDefaultClientScopesIds() {
+        return defaultClientScopesIds;
     }
 
-    public boolean isUseTemplateScope() {
-        return useTemplateScope;
-    }
-
-    public boolean isUseTemplateConfig() {
-        return useTemplateConfig;
-    }
-
-    public boolean isUseTemplateMappers() {
-        return useTemplateMappers;
+    public List<String> getOptionalClientScopesIds() {
+        return optionalClientScopesIds;
     }
 
     public Map<String, String> getAuthFlowBindings() {

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedClientScope.java

@@ -17,7 +17,7 @@
 
 package org.keycloak.models.cache.infinispan.entities;
 
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -31,32 +31,22 @@ import java.util.Set;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class CachedClientTemplate extends AbstractRevisioned implements InRealm {
+public class CachedClientScope extends AbstractRevisioned implements InRealm {
 
     private String name;
     private String description;
     private String realm;
     private String protocol;
-    private boolean fullScopeAllowed;
-    private boolean publicClient;
-    private boolean frontchannelLogout;
-    private boolean bearerOnly;
-    private boolean consentRequired;
-    private boolean standardFlowEnabled;
-    private boolean implicitFlowEnabled;
-    private boolean directAccessGrantsEnabled;
-    private boolean serviceAccountsEnabled;
     private Set<String> scope = new HashSet<>();
     private Set<ProtocolMapperModel> protocolMappers = new HashSet<ProtocolMapperModel>();
     private Map<String, String> attributes = new HashMap<>();
 
-    public CachedClientTemplate(Long revision, RealmModel realm, ClientTemplateModel model) {
+    public CachedClientScope(Long revision, RealmModel realm, ClientScopeModel model) {
         super(revision, model.getId());
         name = model.getName();
         description = model.getDescription();
         this.realm = realm.getId();
         protocol = model.getProtocol();
-        fullScopeAllowed = model.isFullScopeAllowed();
         for (ProtocolMapperModel mapper : model.getProtocolMappers()) {
             this.protocolMappers.add(mapper);
         }
@@ -64,14 +54,6 @@ public class CachedClientTemplate extends AbstractRevisioned implements InRealm
             scope.add(role.getId());
         }
         attributes.putAll(model.getAttributes());
-        frontchannelLogout = model.isFrontchannelLogout();
-        publicClient = model.isPublicClient();
-        bearerOnly = model.isBearerOnly();
-        consentRequired = model.isConsentRequired();
-        standardFlowEnabled = model.isStandardFlowEnabled();
-        implicitFlowEnabled = model.isImplicitFlowEnabled();
-        directAccessGrantsEnabled = model.isDirectAccessGrantsEnabled();
-        serviceAccountsEnabled = model.isServiceAccountsEnabled();
     }
 
     public String getName() {
@@ -93,46 +75,10 @@ public class CachedClientTemplate extends AbstractRevisioned implements InRealm
         return protocol;
     }
 
-    public boolean isFullScopeAllowed() {
-        return fullScopeAllowed;
-    }
-
     public Set<String> getScope() {
         return scope;
     }
 
-    public boolean isPublicClient() {
-        return publicClient;
-    }
-
-    public boolean isFrontchannelLogout() {
-        return frontchannelLogout;
-    }
-
-    public boolean isBearerOnly() {
-        return bearerOnly;
-    }
-
-    public boolean isConsentRequired() {
-        return consentRequired;
-    }
-
-    public boolean isStandardFlowEnabled() {
-        return standardFlowEnabled;
-    }
-
-    public boolean isImplicitFlowEnabled() {
-        return implicitFlowEnabled;
-    }
-
-    public boolean isDirectAccessGrantsEnabled() {
-        return directAccessGrantsEnabled;
-    }
-
-    public boolean isServiceAccountsEnabled() {
-        return serviceAccountsEnabled;
-    }
-
     public Map<String, String> getAttributes() {
         return attributes;
     }

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRealm.java

@@ -24,7 +24,7 @@ import org.keycloak.models.AuthenticationExecutionModel;
 import org.keycloak.models.AuthenticationFlowModel;
 import org.keycloak.models.AuthenticatorConfigModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.IdentityProviderMapperModel;
 import org.keycloak.models.IdentityProviderModel;
@@ -135,7 +135,9 @@ public class CachedRealm extends AbstractExtendableRevisioned {
     }
 
     protected List<String> defaultGroups = new LinkedList<String>();
-    protected List<String> clientTemplates= new LinkedList<>();
+    protected List<String> clientScopes = new LinkedList<>();
+    protected List<String> defaultDefaultClientScopes = new LinkedList<>();
+    protected List<String> optionalDefaultClientScopes = new LinkedList<>();
     protected boolean internationalizationEnabled;
     protected Set<String> supportedLocales;
     protected String defaultLocale;
@@ -227,7 +229,7 @@ public class CachedRealm extends AbstractExtendableRevisioned {
         ClientModel masterAdminClient = model.getMasterAdminClient();
         this.masterAdminClient = (masterAdminClient != null) ? masterAdminClient.getId() : null;
 
-        cacheClientTemplates(model);
+        cacheClientScopes(model);
 
         internationalizationEnabled = model.isInternationalizationEnabled();
         supportedLocales = model.getSupportedLocales();
@@ -279,9 +281,15 @@ public class CachedRealm extends AbstractExtendableRevisioned {
 
     }
 
-    protected void cacheClientTemplates(RealmModel model) {
-        for (ClientTemplateModel template : model.getClientTemplates()) {
-            clientTemplates.add(template.getId());
+    protected void cacheClientScopes(RealmModel model) {
+        for (ClientScopeModel clientScope : model.getClientScopes()) {
+            clientScopes.add(clientScope.getId());
+        }
+        for (ClientScopeModel clientScope : model.getDefaultClientScopes(true)) {
+            defaultDefaultClientScopes.add(clientScope.getId());
+        }
+        for (ClientScopeModel clientScope : model.getDefaultClientScopes(false)) {
+            optionalDefaultClientScopes.add(clientScope.getId());
         }
     }
 
@@ -585,8 +593,16 @@ public class CachedRealm extends AbstractExtendableRevisioned {
         return defaultGroups;
     }
 
-    public List<String> getClientTemplates() {
-        return clientTemplates;
+    public List<String> getClientScopes() {
+        return clientScopes;
+    }
+
+    public List<String> getDefaultDefaultClientScopes() {
+        return defaultDefaultClientScopes;
+    }
+
+    public List<String> getOptionalDefaultClientScopes() {
+        return optionalDefaultClientScopes;
     }
 
     public List<AuthenticationFlowModel> getAuthenticationFlowList() {

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedRole.java

@@ -32,7 +32,6 @@ public class CachedRole extends AbstractRevisioned implements InRealm {
     final protected String name;
     final protected String realm;
     final protected String description;
-    final protected Boolean scopeParamRequired;
     final protected boolean composite;
     final protected Set<String> composites = new HashSet<String>();
 
@@ -41,7 +40,6 @@ public class CachedRole extends AbstractRevisioned implements InRealm {
         composite = model.isComposite();
         description = model.getDescription();
         name = model.getName();
-        scopeParamRequired = model.isScopeParamRequired();
         this.realm = realm.getId();
         if (composite) {
             for (RoleModel child : model.getComposites()) {
@@ -63,10 +61,6 @@ public class CachedRole extends AbstractRevisioned implements InRealm {
         return description;
     }
 
-    public Boolean isScopeParamRequired() {
-        return scopeParamRequired;
-    }
-
     public boolean isComposite() {
         return composite;
     }

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/entities/CachedUserConsent.java

@@ -17,6 +17,7 @@
 
 package org.keycloak.models.cache.infinispan.entities;
 
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserConsentModel;
@@ -30,16 +31,14 @@ import java.util.Set;
 public class CachedUserConsent {
 
     private final String clientDbId;
-    private final Set<ProtocolMapperModel> protocolMappers = new HashSet<>();
-    private final Set<String> roleIds = new HashSet<>();
+    private final Set<String> clientScopeIds = new HashSet<>();
     private final Long createdDate;
     private final Long lastUpdatedDate;
 
     public CachedUserConsent(UserConsentModel consentModel) {
         this.clientDbId = consentModel.getClient().getId();
-        this.protocolMappers.addAll(consentModel.getGrantedProtocolMappers());
-        for (RoleModel role : consentModel.getGrantedRoles()) {
-            this.roleIds.add(role.getId());
+        for (ClientScopeModel clientScope : consentModel.getGrantedClientScopes()) {
+            this.clientScopeIds.add(clientScope.getId());
         }
         this.createdDate = consentModel.getCreatedDate();
         this.lastUpdatedDate = consentModel.getLastUpdatedDate();
@@ -49,12 +48,8 @@ public class CachedUserConsent {
         return clientDbId;
     }
 
-    public Set<ProtocolMapperModel> getProtocolMappers() {
-        return protocolMappers;
-    }
-
-    public Set<String> getRoleIds() {
-        return roleIds;
+    public Set<String> getClientScopeIds() {
+        return clientScopeIds;
     }
 
     public Long getCreatedDate() {

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/events/ClientTemplateEvent.java

@@ -28,6 +28,9 @@ import org.infinispan.commons.marshall.MarshallUtil;
 import org.infinispan.commons.marshall.SerializeWith;
 
 /**
+ * TODO Leave the name ClientTemplateEvent just due the backwards compatibility of infinispan migration. See if can be renamed based on
+ * rolling upgrades plan...
+ *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 @SerializeWith(ClientTemplateEvent.ExternalizerImpl.class)

model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/stream/HasRolePredicate.java

@@ -1,7 +1,7 @@
 package org.keycloak.models.cache.infinispan.stream;
 
 import org.keycloak.models.cache.infinispan.entities.CachedClient;
-import org.keycloak.models.cache.infinispan.entities.CachedClientTemplate;
+import org.keycloak.models.cache.infinispan.entities.CachedClientScope;
 import org.keycloak.models.cache.infinispan.entities.CachedGroup;
 import org.keycloak.models.cache.infinispan.entities.CachedRole;
 import org.keycloak.models.cache.infinispan.entities.Revisioned;
@@ -55,9 +55,9 @@ public class HasRolePredicate implements Predicate<Map.Entry<String, Revisioned>
             if (cachedClient.getScope().contains(role)) return true;
 
         }
-        if (value instanceof CachedClientTemplate) {
-            CachedClientTemplate cachedClientTemplate = (CachedClientTemplate)value;
-            if (cachedClientTemplate.getScope().contains(role)) return true;
+        if (value instanceof CachedClientScope) {
+            CachedClientScope cachedClientScope = (CachedClientScope)value;
+            if (cachedClientScope.getScope().contains(role)) return true;
 
         }
         return false;

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java

@@ -238,44 +238,6 @@ public class AuthenticatedClientSessionAdapter implements AuthenticatedClientSes
         update(task);
     }
 
-    @Override
-    public Set<String> getRoles() {
-        return entity.getRoles();
-    }
-
-    @Override
-    public void setRoles(Set<String> roles) {
-        ClientSessionUpdateTask task = new ClientSessionUpdateTask() {
-
-            @Override
-            public void runUpdate(AuthenticatedClientSessionEntity entity) {
-                entity.setRoles(roles); // TODO not thread-safe. But we will remove setRoles anyway...?
-            }
-
-        };
-
-        update(task);
-    }
-
-    @Override
-    public Set<String> getProtocolMappers() {
-        return entity.getProtocolMappers();
-    }
-
-    @Override
-    public void setProtocolMappers(Set<String> protocolMappers) {
-        ClientSessionUpdateTask task = new ClientSessionUpdateTask() {
-
-            @Override
-            public void runUpdate(AuthenticatedClientSessionEntity entity) {
-                entity.setProtocolMappers(protocolMappers); // TODO not thread-safe. But we will remove setProtocolMappers anyway...?
-            }
-
-        };
-
-        update(task);
-    }
-
     @Override
     public String getNote(String name) {
         return entity.getNotes().get(name);

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticationSessionAdapter.java

@@ -99,26 +99,14 @@ public class AuthenticationSessionAdapter implements AuthenticationSessionModel
     }
 
     @Override
-    public Set<String> getRoles() {
-        if (entity.getRoles() == null || entity.getRoles().isEmpty()) return Collections.emptySet();
-        return new HashSet<>(entity.getRoles());
+    public Set<String> getClientScopes() {
+        if (entity.getClientScopes() == null || entity.getClientScopes().isEmpty()) return Collections.emptySet();
+        return new HashSet<>(entity.getClientScopes());
     }
 
     @Override
-    public void setRoles(Set<String> roles) {
-        entity.setRoles(roles);
-        update();
-    }
-
-    @Override
-    public Set<String> getProtocolMappers() {
-        if (entity.getProtocolMappers() == null || entity.getProtocolMappers().isEmpty()) return Collections.emptySet();
-        return new HashSet<>(entity.getProtocolMappers());
-    }
-
-    @Override
-    public void setProtocolMappers(Set<String> protocolMappers) {
-        entity.setProtocolMappers(protocolMappers);
+    public void setClientScopes(Set<String> clientScopes) {
+        entity.setClientScopes(clientScopes);
         update();
     }
 

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java

@@ -925,9 +925,7 @@ public class InfinispanUserSessionProvider implements UserSessionProvider {
         entity.setAuthMethod(clientSession.getProtocol());
 
         entity.setNotes(clientSession.getNotes() == null ? new ConcurrentHashMap<>() : clientSession.getNotes());
-        entity.setProtocolMappers(clientSession.getProtocolMappers());
         entity.setRedirectUri(clientSession.getRedirectUri());
-        entity.setRoles(clientSession.getRoles());
         entity.setTimestamp(clientSession.getTimestamp());
 
         SessionUpdateTask<AuthenticatedClientSessionEntity> createClientSessionTask = Tasks.addIfAbsentSync();

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java

@@ -41,7 +41,6 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.UUID;
 import java.util.stream.Collectors;
-import java.util.stream.StreamSupport;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/AuthenticatedClientSessionEntity.java

@@ -21,7 +21,6 @@ import java.io.IOException;
 import java.io.ObjectInput;
 import java.io.ObjectOutput;
 import java.util.Map;
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
 import org.infinispan.commons.marshall.Externalizer;
@@ -49,8 +48,6 @@ public class AuthenticatedClientSessionEntity extends SessionEntity {
     private volatile int timestamp;
     private String action;
 
-    private Set<String> roles;
-    private Set<String> protocolMappers;
     private Map<String, String> notes = new ConcurrentHashMap<>();
 
     private String currentRefreshToken;
@@ -94,22 +91,6 @@ public class AuthenticatedClientSessionEntity extends SessionEntity {
         this.action = action;
     }
 
-    public Set<String> getRoles() {
-        return roles;
-    }
-
-    public void setRoles(Set<String> roles) {
-        this.roles = roles;
-    }
-
-    public Set<String> getProtocolMappers() {
-        return protocolMappers;
-    }
-
-    public void setProtocolMappers(Set<String> protocolMappers) {
-        this.protocolMappers = protocolMappers;
-    }
-
     public Map<String, String> getNotes() {
         return notes;
     }
@@ -199,9 +180,6 @@ public class AuthenticatedClientSessionEntity extends SessionEntity {
             Map<String, String> notes = session.getNotes();
             KeycloakMarshallUtil.writeMap(notes, KeycloakMarshallUtil.STRING_EXT, KeycloakMarshallUtil.STRING_EXT, output);
 
-            KeycloakMarshallUtil.writeCollection(session.getProtocolMappers(), KeycloakMarshallUtil.STRING_EXT, output);
-            KeycloakMarshallUtil.writeCollection(session.getRoles(), KeycloakMarshallUtil.STRING_EXT, output);
-
             MarshallUtil.marshallString(session.getCurrentRefreshToken(), output);
             MarshallUtil.marshallInt(output, session.getCurrentRefreshTokenUseCount());
         }
@@ -222,12 +200,6 @@ public class AuthenticatedClientSessionEntity extends SessionEntity {
                     new KeycloakMarshallUtil.ConcurrentHashMapBuilder<>());
             sessionEntity.setNotes(notes);
 
-            Set<String> protocolMappers = KeycloakMarshallUtil.readCollection(input, KeycloakMarshallUtil.STRING_EXT, new KeycloakMarshallUtil.HashSetBuilder<>());
-            sessionEntity.setProtocolMappers(protocolMappers);
-
-            Set<String> roles = KeycloakMarshallUtil.readCollection(input, KeycloakMarshallUtil.STRING_EXT, new KeycloakMarshallUtil.HashSetBuilder<>());
-            sessionEntity.setRoles(roles);
-
             sessionEntity.setCurrentRefreshToken(MarshallUtil.unmarshallString(input));
             sessionEntity.setCurrentRefreshTokenUseCount(MarshallUtil.unmarshallInt(input));
 

model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/AuthenticationSessionEntity.java

@@ -45,8 +45,7 @@ public class AuthenticationSessionEntity implements Serializable {
 
     private String redirectUri;
     private String action;
-    private Set<String> roles;
-    private Set<String> protocolMappers;
+    private Set<String> clientScopes;
 
     private Map<String, AuthenticationSessionModel.ExecutionStatus> executionStatus = new ConcurrentHashMap<>();
     private String protocol;
@@ -62,7 +61,7 @@ public class AuthenticationSessionEntity implements Serializable {
     public AuthenticationSessionEntity(
       String clientUUID,
       String authUserId,
-      String redirectUri, String action, Set<String> roles, Set<String> protocolMappers,
+      String redirectUri, String action, Set<String> clientScopes,
       Map<String, AuthenticationSessionModel.ExecutionStatus> executionStatus, String protocol,
       Map<String, String> clientNotes, Map<String, String> authNotes, Set<String> requiredActions, Map<String, String> userSessionNotes) {
         this.clientUUID = clientUUID;
@@ -71,8 +70,7 @@ public class AuthenticationSessionEntity implements Serializable {
 
         this.redirectUri = redirectUri;
         this.action = action;
-        this.roles = roles;
-        this.protocolMappers = protocolMappers;
+        this.clientScopes = clientScopes;
 
         this.executionStatus = executionStatus;
         this.protocol = protocol;
@@ -115,20 +113,12 @@ public class AuthenticationSessionEntity implements Serializable {
         this.action = action;
     }
 
-    public Set<String> getRoles() {
-        return roles;
+    public Set<String> getClientScopes() {
+        return clientScopes;
     }
 
-    public void setRoles(Set<String> roles) {
-        this.roles = roles;
-    }
-
-    public Set<String> getProtocolMappers() {
-        return protocolMappers;
-    }
-
-    public void setProtocolMappers(Set<String> protocolMappers) {
-        this.protocolMappers = protocolMappers;
+    public void setClientScopes(Set<String> clientScopes) {
+        this.clientScopes = clientScopes;
     }
 
     public Map<String, AuthenticationSessionModel.ExecutionStatus> getExecutionStatus() {
@@ -215,8 +205,7 @@ public class AuthenticationSessionEntity implements Serializable {
 
             MarshallUtil.marshallString(value.redirectUri, output);
             MarshallUtil.marshallString(value.action, output);
-            KeycloakMarshallUtil.writeCollection(value.roles, KeycloakMarshallUtil.STRING_EXT, output);
-            KeycloakMarshallUtil.writeCollection(value.protocolMappers, KeycloakMarshallUtil.STRING_EXT, output);
+            KeycloakMarshallUtil.writeCollection(value.clientScopes, KeycloakMarshallUtil.STRING_EXT, output);
 
             KeycloakMarshallUtil.writeMap(value.executionStatus, KeycloakMarshallUtil.STRING_EXT, EXECUTION_STATUS_EXT, output);
             MarshallUtil.marshallString(value.protocol, output);
@@ -245,8 +234,7 @@ public class AuthenticationSessionEntity implements Serializable {
 
               MarshallUtil.unmarshallString(input),     // redirectUri
               MarshallUtil.unmarshallString(input),     // action
-              KeycloakMarshallUtil.readCollection(input, KeycloakMarshallUtil.STRING_EXT, size -> new ConcurrentHashSet<>()),  // roles
-              KeycloakMarshallUtil.readCollection(input, KeycloakMarshallUtil.STRING_EXT, size -> new ConcurrentHashSet<>()),  // protocolMappers
+              KeycloakMarshallUtil.readCollection(input, KeycloakMarshallUtil.STRING_EXT, size -> new ConcurrentHashSet<>()),  // clientScopes
 
               KeycloakMarshallUtil.readMap(input, KeycloakMarshallUtil.STRING_EXT, EXECUTION_STATUS_EXT, size -> new ConcurrentHashMap<>(size)), // executionStatus
               MarshallUtil.unmarshallString(input),     // protocol

model/infinispan/src/test/java/org/keycloak/cluster/infinispan/ConcurrencyJDGRemoveSessionTest.java

@@ -178,8 +178,6 @@ public class ConcurrencyJDGRemoveSessionTest {
         clientSession.setAuthMethod("saml");
         clientSession.setAction("something");
         clientSession.setTimestamp(1234);
-        clientSession.setProtocolMappers(new HashSet<>(Arrays.asList("mapper1", "mapper2")));
-        clientSession.setRoles(new HashSet<>(Arrays.asList("role1", "role2")));
         session.getAuthenticatedClientSessions().put(CLIENT_1_UUID.toString(), clientSession.getId());
 
         SessionEntityWrapper<UserSessionEntity> wrappedSession = new SessionEntityWrapper<>(session);

model/infinispan/src/test/java/org/keycloak/cluster/infinispan/ConcurrencyJDGSessionsCacheTest.java

@@ -18,8 +18,6 @@
 package org.keycloak.cluster.infinispan;
 
 import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashSet;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -97,8 +95,6 @@ public class ConcurrencyJDGSessionsCacheTest {
         clientSession.setAuthMethod("saml");
         clientSession.setAction("something");
         clientSession.setTimestamp(1234);
-        clientSession.setProtocolMappers(new HashSet<>(Arrays.asList("mapper1", "mapper2")));
-        clientSession.setRoles(new HashSet<>(Arrays.asList("role1", "role2")));
         session.getAuthenticatedClientSessions().put(CLIENT_1_UUID.toString(), clientSession.getId());
 
         SessionEntityWrapper<UserSessionEntity> wrappedSession = new SessionEntityWrapper<>(session);

model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/DistributedCacheConcurrentWritesTest.java

@@ -75,8 +75,6 @@ public class DistributedCacheConcurrentWritesTest {
         clientSession.setAuthMethod("saml");
         clientSession.setAction("something");
         clientSession.setTimestamp(1234);
-        clientSession.setProtocolMappers(new HashSet<>(Arrays.asList("mapper1", "mapper2")));
-        clientSession.setRoles(new HashSet<>(Arrays.asList("role1", "role2")));
         session.getAuthenticatedClientSessions().put(CLIENT_1_UUID.toString(), clientSession.getId());
 
         cache1.put("123", session);

model/infinispan/src/test/java/org/keycloak/models/sessions/infinispan/initializer/DistributedCacheWriteSkewTest.java

@@ -17,8 +17,6 @@
 
 package org.keycloak.models.sessions.infinispan.initializer;
 
-import java.util.Arrays;
-import java.util.HashSet;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 
@@ -75,8 +73,6 @@ public class DistributedCacheWriteSkewTest {
         clientSession.setAuthMethod("saml");
         clientSession.setAction("something");
         clientSession.setTimestamp(1234);
-        clientSession.setProtocolMappers(new HashSet<>(Arrays.asList("mapper1", "mapper2")));
-        clientSession.setRoles(new HashSet<>(Arrays.asList("role1", "role2")));
         session.getAuthenticatedClientSessions().put(CLIENT_1_UUID.toString(), clientSession.getId());
 
         cache1.put("123", session);

model/jpa/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/JpaUpdate1_2_0_Beta1.java

@@ -327,8 +327,7 @@ public class JpaUpdate1_2_0_Beta1 extends CustomKeycloakTask {
                                 .addColumnValue("ID", mapperId)
                                 .addColumnValue("PROTOCOL", protocolMapper.getProtocol())
                                 .addColumnValue("NAME", protocolMapper.getName())
-                                .addColumnValue("CONSENT_REQUIRED", protocolMapper.isConsentRequired())
-                                .addColumnValue("CONSENT_TEXT", protocolMapper.getConsentText())
+                                .addColumnValue("CONSENT_REQUIRED", false)
                                 .addColumnValue("PROTOCOL_MAPPER_NAME", protocolMapper.getProtocolMapper())
                                 .addColumnValue("CLIENT_ID", resultSet.getString("ID"));
                         statements.add(insert);

model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java

@@ -18,20 +18,27 @@
 package org.keycloak.models.jpa;
 
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.jpa.entities.ClientEntity;
-import org.keycloak.models.jpa.entities.ClientTemplateEntity;
+import org.keycloak.models.jpa.entities.ClientScopeClientMappingEntity;
+import org.keycloak.models.jpa.entities.ClientScopeEntity;
+import org.keycloak.models.jpa.entities.ClientScopeRoleMappingEntity;
 import org.keycloak.models.jpa.entities.ProtocolMapperEntity;
 import org.keycloak.models.jpa.entities.RoleEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.OIDCLoginProtocolFactory;
 
 import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+
 import java.security.MessageDigest;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -317,56 +324,48 @@ public class ClientAdapter implements ClientModel, JpaModel<ClientEntity> {
     }
 
     @Override
-    public ClientTemplateModel getClientTemplate() {
-        ClientTemplateEntity templateEntity = entity.getClientTemplate();
-        if (templateEntity == null) return null;
-        return session.realms().getClientTemplateById(templateEntity.getId(), realm);
+    public void addClientScope(ClientScopeModel clientScope, boolean defaultScope) {
+        if (getClientScopes(defaultScope, false).containsKey(clientScope.getName())) return;
+
+        ClientScopeClientMappingEntity entity = new ClientScopeClientMappingEntity();
+        entity.setClientScope(ClientScopeAdapter.toClientScopeEntity(clientScope, em));
+        entity.setClient(getEntity());
+        entity.setDefaultScope(defaultScope);
+        em.persist(entity);
+        em.flush();
+        em.detach(entity);
     }
 
     @Override
-    public void setClientTemplate(ClientTemplateModel template) {
-        if (template == null) {
-            entity.setClientTemplate(null);
+    public void removeClientScope(ClientScopeModel clientScope) {
+        int numRemoved = em.createNamedQuery("deleteClientScopeClientMapping")
+                .setParameter("clientScope", ClientScopeAdapter.toClientScopeEntity(clientScope, em))
+                .setParameter("client", getEntity())
+                .executeUpdate();
+        em.flush();
+    }
 
-        } else {
-            ClientTemplateEntity templateEntity = em.getReference(ClientTemplateEntity.class, template.getId());
-            entity.setClientTemplate(templateEntity);
+    @Override
+    public Map<String, ClientScopeModel> getClientScopes(boolean defaultScope, boolean filterByProtocol) {
+        TypedQuery<String> query = em.createNamedQuery("clientScopeClientMappingIdsByClient", String.class);
+        query.setParameter("client", getEntity());
+        query.setParameter("defaultScope", defaultScope);
+        List<String> ids = query.getResultList();
+
+        // Defaults to openid-connect
+        String clientProtocol = getProtocol() == null ? OIDCLoginProtocol.LOGIN_PROTOCOL : getProtocol();
+
+        Map<String, ClientScopeModel> clientScopes = new HashMap<>();
+        for (String clientScopeId : ids) {
+            ClientScopeModel clientScope = realm.getClientScopeById(clientScopeId);
+            if (clientScope == null) continue;
+            if (!filterByProtocol || clientScope.getProtocol().equals(clientProtocol)) {
+                clientScopes.put(clientScope.getName(), clientScope);
+            }
         }
-
+        return clientScopes;
     }
 
-    @Override
-    public boolean useTemplateScope() {
-        return entity.isUseTemplateScope();
-    }
-
-    @Override
-    public void setUseTemplateScope(boolean flag) {
-        entity.setUseTemplateScope(flag);
-
-    }
-
-    @Override
-    public boolean useTemplateMappers() {
-        return entity.isUseTemplateMappers();
-    }
-
-    @Override
-    public void setUseTemplateMappers(boolean flag) {
-        entity.setUseTemplateMappers(flag);
-
-    }
-
-    @Override
-    public boolean useTemplateConfig() {
-        return entity.isUseTemplateConfig();
-    }
-
-    @Override
-    public void setUseTemplateConfig(boolean flag) {
-        entity.setUseTemplateConfig(flag);
-
-    }
 
     public static boolean contains(String str, String[] array) {
         for (String s : array) {
@@ -384,8 +383,6 @@ public class ClientAdapter implements ClientModel, JpaModel<ClientEntity> {
             mapping.setName(entity.getName());
             mapping.setProtocol(entity.getProtocol());
             mapping.setProtocolMapper(entity.getProtocolMapper());
-            mapping.setConsentRequired(entity.isConsentRequired());
-            mapping.setConsentText(entity.getConsentText());
             Map<String, String> config = new HashMap<String, String>();
             if (entity.getConfig() != null) {
                 config.putAll(entity.getConfig());
@@ -409,8 +406,6 @@ public class ClientAdapter implements ClientModel, JpaModel<ClientEntity> {
         entity.setProtocolMapper(model.getProtocolMapper());
         entity.setClient(this.entity);
         entity.setConfig(model.getConfig());
-        entity.setConsentRequired(model.isConsentRequired());
-        entity.setConsentText(model.getConsentText());
 
         em.persist(entity);
         this.entity.getProtocolMappers().add(entity);
@@ -453,8 +448,6 @@ public class ClientAdapter implements ClientModel, JpaModel<ClientEntity> {
     public void updateProtocolMapper(ProtocolMapperModel mapping) {
         ProtocolMapperEntity entity = getProtocolMapperEntity(mapping.getId());
         entity.setProtocolMapper(mapping.getProtocolMapper());
-        entity.setConsentRequired(mapping.isConsentRequired());
-        entity.setConsentText(mapping.getConsentText());
         if (entity.getConfig() == null) {
             entity.setConfig(mapping.getConfig());
         } else {
@@ -485,8 +478,6 @@ public class ClientAdapter implements ClientModel, JpaModel<ClientEntity> {
         mapping.setName(entity.getName());
         mapping.setProtocol(entity.getProtocol());
         mapping.setProtocolMapper(entity.getProtocolMapper());
-        mapping.setConsentRequired(entity.isConsentRequired());
-        mapping.setConsentText(entity.getConsentText());
         Map<String, String> config = new HashMap<String, String>();
         if (entity.getConfig() != null) config.putAll(entity.getConfig());
         mapping.setConfig(config);

model/jpa/src/main/java/org/keycloak/models/jpa/ClientScopeAdapter.java

@@ -17,17 +17,17 @@
 
 package org.keycloak.models.jpa;
 
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelDuplicateException;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.jpa.entities.ClientTemplateEntity;
+import org.keycloak.models.jpa.entities.ClientScopeEntity;
+import org.keycloak.models.jpa.entities.ClientScopeRoleMappingEntity;
 import org.keycloak.models.jpa.entities.ProtocolMapperEntity;
 import org.keycloak.models.jpa.entities.RoleEntity;
-import org.keycloak.models.jpa.entities.TemplateScopeMappingEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
 import javax.persistence.EntityManager;
@@ -42,21 +42,21 @@ import java.util.Set;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<ClientTemplateEntity> {
+public class ClientScopeAdapter implements ClientScopeModel, JpaModel<ClientScopeEntity> {
 
     protected KeycloakSession session;
     protected RealmModel realm;
     protected EntityManager em;
-    protected ClientTemplateEntity entity;
+    protected ClientScopeEntity entity;
 
-    public ClientTemplateAdapter(RealmModel realm, EntityManager em, KeycloakSession session, ClientTemplateEntity entity) {
+    public ClientScopeAdapter(RealmModel realm, EntityManager em, KeycloakSession session, ClientScopeEntity entity) {
         this.session = session;
         this.realm = realm;
         this.em = em;
         this.entity = entity;
     }
 
-    public ClientTemplateEntity getEntity() {
+    public ClientScopeEntity getEntity() {
         return entity;
     }
 
@@ -77,6 +77,7 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
 
     @Override
     public void setName(String name) {
+        name = KeycloakModelUtils.convertClientScopeName(name);
         entity.setName(name);
     }
 
@@ -106,8 +107,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
             mapping.setName(entity.getName());
             mapping.setProtocol(entity.getProtocol());
             mapping.setProtocolMapper(entity.getProtocolMapper());
-            mapping.setConsentRequired(entity.isConsentRequired());
-            mapping.setConsentText(entity.getConsentText());
             Map<String, String> config = new HashMap<String, String>();
             if (entity.getConfig() != null) {
                 config.putAll(entity.getConfig());
@@ -129,10 +128,8 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         entity.setName(model.getName());
         entity.setProtocol(model.getProtocol());
         entity.setProtocolMapper(model.getProtocolMapper());
-        entity.setClientTemplate(this.entity);
+        entity.setClientScope(this.entity);
         entity.setConfig(model.getConfig());
-        entity.setConsentRequired(model.isConsentRequired());
-        entity.setConsentText(model.getConsentText());
 
         em.persist(entity);
         this.entity.getProtocolMappers().add(entity);
@@ -175,8 +172,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
     public void updateProtocolMapper(ProtocolMapperModel mapping) {
         ProtocolMapperEntity entity = getProtocolMapperEntity(mapping.getId());
         entity.setProtocolMapper(mapping.getProtocolMapper());
-        entity.setConsentRequired(mapping.isConsentRequired());
-        entity.setConsentText(mapping.getConsentText());
         if (entity.getConfig() == null) {
             entity.setConfig(mapping.getConfig());
         } else {
@@ -207,24 +202,12 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         mapping.setName(entity.getName());
         mapping.setProtocol(entity.getProtocol());
         mapping.setProtocolMapper(entity.getProtocolMapper());
-        mapping.setConsentRequired(entity.isConsentRequired());
-        mapping.setConsentText(entity.getConsentText());
         Map<String, String> config = new HashMap<String, String>();
         if (entity.getConfig() != null) config.putAll(entity.getConfig());
         mapping.setConfig(config);
         return mapping;
     }
 
-    @Override
-    public boolean isFullScopeAllowed() {
-        return entity.isFullScopeAllowed();
-    }
-
-    @Override
-    public void setFullScopeAllowed(boolean value) {
-        entity.setFullScopeAllowed(value);
-    }
-
     @Override
     public Set<RoleModel> getRealmScopeMappings() {
         Set<RoleModel> roleMappings = getScopeMappings();
@@ -233,7 +216,7 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         for (RoleModel role : roleMappings) {
             RoleContainerModel container = role.getContainer();
             if (container instanceof RealmModel) {
-                if (((RealmModel) container).getId().equals(realm.getId())) {
+                if (container.getId().equals(realm.getId())) {
                     appRoles.add(role);
                 }
             }
@@ -244,8 +227,8 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
 
     @Override
     public Set<RoleModel> getScopeMappings() {
-        TypedQuery<String> query = em.createNamedQuery("clientTemplateScopeMappingIds", String.class);
-        query.setParameter("template", getEntity());
+        TypedQuery<String> query = em.createNamedQuery("clientScopeRoleMappingIds", String.class);
+        query.setParameter("clientScope", getEntity());
         List<String> ids = query.getResultList();
         Set<RoleModel> roles = new HashSet<RoleModel>();
         for (String roleId : ids) {
@@ -259,8 +242,8 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
     @Override
     public void addScopeMapping(RoleModel role) {
         if (hasScope(role)) return;
-        TemplateScopeMappingEntity entity = new TemplateScopeMappingEntity();
-        entity.setTemplate(getEntity());
+        ClientScopeRoleMappingEntity entity = new ClientScopeRoleMappingEntity();
+        entity.setClientScope(getEntity());
         RoleEntity roleEntity = RoleAdapter.toRoleEntity(role, em);
         entity.setRole(roleEntity);
         em.persist(entity);
@@ -270,17 +253,17 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
 
     @Override
     public void deleteScopeMapping(RoleModel role) {
-        TypedQuery<TemplateScopeMappingEntity> query = getRealmScopeMappingQuery(role);
-        List<TemplateScopeMappingEntity> results = query.getResultList();
+        TypedQuery<ClientScopeRoleMappingEntity> query = getRealmScopeMappingQuery(role);
+        List<ClientScopeRoleMappingEntity> results = query.getResultList();
         if (results.size() == 0) return;
-        for (TemplateScopeMappingEntity entity : results) {
+        for (ClientScopeRoleMappingEntity entity : results) {
             em.remove(entity);
         }
     }
 
-    protected TypedQuery<TemplateScopeMappingEntity> getRealmScopeMappingQuery(RoleModel role) {
-        TypedQuery<TemplateScopeMappingEntity> query = em.createNamedQuery("templateHasScope", TemplateScopeMappingEntity.class);
-        query.setParameter("template", getEntity());
+    protected TypedQuery<ClientScopeRoleMappingEntity> getRealmScopeMappingQuery(RoleModel role) {
+        TypedQuery<ClientScopeRoleMappingEntity> query = em.createNamedQuery("clientScopeHasRole", ClientScopeRoleMappingEntity.class);
+        query.setParameter("clientScope", getEntity());
         RoleEntity roleEntity = RoleAdapter.toRoleEntity(role, em);
         query.setParameter("role", roleEntity);
         return query;
@@ -288,7 +271,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
 
     @Override
     public boolean hasScope(RoleModel role) {
-        if (isFullScopeAllowed()) return true;
         Set<RoleModel> roles = getScopeMappings();
         if (roles.contains(role)) return true;
 
@@ -298,26 +280,6 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         return false;
     }
 
-    @Override
-    public boolean isPublicClient() {
-        return entity.isPublicClient();
-    }
-
-    @Override
-    public void setPublicClient(boolean flag) {
-        entity.setPublicClient(flag);
-    }
-
-    @Override
-    public boolean isFrontchannelLogout() {
-        return entity.isFrontchannelLogout();
-    }
-
-    @Override
-    public void setFrontchannelLogout(boolean flag) {
-        entity.setFrontchannelLogout(flag);
-    }
-
     @Override
     public void setAttribute(String name, String value) {
         entity.getAttributes().put(name, value);
@@ -334,6 +296,13 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         return entity.getAttributes().get(name);
     }
 
+    public static ClientScopeEntity toClientScopeEntity(ClientScopeModel model, EntityManager em) {
+        if (model instanceof ClientScopeAdapter) {
+            return ((ClientScopeAdapter)model).getEntity();
+        }
+        return em.getReference(ClientScopeEntity.class, model.getId());
+    }
+
     @Override
     public Map<String, String> getAttributes() {
         Map<String, String> copy = new HashMap<>();
@@ -341,74 +310,13 @@ public class ClientTemplateAdapter implements ClientTemplateModel , JpaModel<Cli
         return copy;
     }
 
-    @Override
-    public boolean isBearerOnly() {
-        return entity.isBearerOnly();
-    }
-
-    @Override
-    public void setBearerOnly(boolean only) {
-        entity.setBearerOnly(only);
-    }
-
-    @Override
-    public boolean isConsentRequired() {
-        return entity.isConsentRequired();
-    }
-
-    @Override
-    public void setConsentRequired(boolean consentRequired) {
-        entity.setConsentRequired(consentRequired);
-    }
-
-    @Override
-    public boolean isStandardFlowEnabled() {
-        return entity.isStandardFlowEnabled();
-    }
-
-    @Override
-    public void setStandardFlowEnabled(boolean standardFlowEnabled) {
-        entity.setStandardFlowEnabled(standardFlowEnabled);
-    }
-
-    @Override
-    public boolean isImplicitFlowEnabled() {
-        return entity.isImplicitFlowEnabled();
-    }
-
-    @Override
-    public void setImplicitFlowEnabled(boolean implicitFlowEnabled) {
-        entity.setImplicitFlowEnabled(implicitFlowEnabled);
-    }
-
-    @Override
-    public boolean isDirectAccessGrantsEnabled() {
-        return entity.isDirectAccessGrantsEnabled();
-    }
-
-    @Override
-    public void setDirectAccessGrantsEnabled(boolean directAccessGrantsEnabled) {
-        entity.setDirectAccessGrantsEnabled(directAccessGrantsEnabled);
-    }
-
-    @Override
-    public boolean isServiceAccountsEnabled() {
-        return entity.isServiceAccountsEnabled();
-    }
-
-    @Override
-    public void setServiceAccountsEnabled(boolean serviceAccountsEnabled) {
-        entity.setServiceAccountsEnabled(serviceAccountsEnabled);
-    }
-
-
 
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
-        if (o == null || !(o instanceof ClientTemplateModel)) return false;
+        if (o == null || !(o instanceof ClientScopeModel)) return false;
 
-        ClientTemplateModel that = (ClientTemplateModel) o;
+        ClientScopeModel that = (ClientScopeModel) o;
         return that.getId().equals(getId());
     }
 

model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java

@@ -23,7 +23,7 @@ import org.keycloak.connections.jpa.util.JpaUtils;
 import org.keycloak.migration.MigrationModel;
 import org.keycloak.models.ClientInitialAccessModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelDuplicateException;
@@ -33,7 +33,7 @@ import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.jpa.entities.ClientEntity;
 import org.keycloak.models.jpa.entities.ClientInitialAccessEntity;
-import org.keycloak.models.jpa.entities.ClientTemplateEntity;
+import org.keycloak.models.jpa.entities.ClientScopeEntity;
 import org.keycloak.models.jpa.entities.GroupEntity;
 import org.keycloak.models.jpa.entities.RealmEntity;
 import org.keycloak.models.jpa.entities.RoleEntity;
@@ -142,8 +142,11 @@ public class JpaRealmProvider implements RealmProvider {
             removeClient(client, adapter);
         }
 
-        for (ClientTemplateEntity a : new LinkedList<>(realm.getClientTemplates())) {
-            adapter.removeClientTemplate(a.getId());
+        num = em.createNamedQuery("deleteDefaultClientScopeRealmMappingByRealm")
+                .setParameter("realm", realm).executeUpdate();
+
+        for (ClientScopeEntity a : new LinkedList<>(realm.getClientScopes())) {
+            adapter.removeClientScope(a.getId());
         }
 
         for (RoleModel role : adapter.getRoles()) {
@@ -285,7 +288,7 @@ public class JpaRealmProvider implements RealmProvider {
         String compositeRoleTable = JpaUtils.getTableNameForNativeQuery("COMPOSITE_ROLE", em);
         em.createNativeQuery("delete from " + compositeRoleTable + " where CHILD_ROLE = :role").setParameter("role", roleEntity).executeUpdate();
         realm.getClients().forEach(c -> c.deleteScopeMapping(role));
-        em.createNamedQuery("deleteTemplateScopeMappingByRole").setParameter("role", roleEntity).executeUpdate();
+        em.createNamedQuery("deleteClientScopeRoleMappingByRole").setParameter("role", roleEntity).executeUpdate();
         int val = em.createNamedQuery("deleteGroupRoleMappingsByRole").setParameter("roleId", roleEntity.getId()).executeUpdate();
 
         em.flush();
@@ -567,6 +570,9 @@ public class JpaRealmProvider implements RealmProvider {
             }
         });
 
+        int countRemoved = em.createNamedQuery("deleteClientScopeClientMappingByClient")
+                .setParameter("client", clientEntity)
+                .executeUpdate();
         em.remove(clientEntity);  // i have no idea why, but this needs to come before deleteScopeMapping
 
         try {
@@ -580,12 +586,12 @@ public class JpaRealmProvider implements RealmProvider {
     }
 
     @Override
-    public ClientTemplateModel getClientTemplateById(String id, RealmModel realm) {
-        ClientTemplateEntity app = em.find(ClientTemplateEntity.class, id);
+    public ClientScopeModel getClientScopeById(String id, RealmModel realm) {
+        ClientScopeEntity app = em.find(ClientScopeEntity.class, id);
 
         // Check if application belongs to this realm
         if (app == null || !realm.getId().equals(app.getRealm().getId())) return null;
-        ClientTemplateAdapter adapter = new ClientTemplateAdapter(realm, em, session, app);
+        ClientScopeAdapter adapter = new ClientScopeAdapter(realm, em, session, app);
         return adapter;
     }
 

model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java

@@ -23,7 +23,7 @@ import org.keycloak.component.ComponentModel;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.UserCredentialStore;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ClientTemplateModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
@@ -39,9 +39,8 @@ import org.keycloak.models.UserProvider;
 import org.keycloak.models.jpa.entities.CredentialAttributeEntity;
 import org.keycloak.models.jpa.entities.CredentialEntity;
 import org.keycloak.models.jpa.entities.FederatedIdentityEntity;
+import org.keycloak.models.jpa.entities.UserConsentClientScopeEntity;
 import org.keycloak.models.jpa.entities.UserConsentEntity;
-import org.keycloak.models.jpa.entities.UserConsentProtocolMapperEntity;
-import org.keycloak.models.jpa.entities.UserConsentRoleEntity;
 import org.keycloak.models.jpa.entities.UserEntity;
 import org.keycloak.models.utils.DefaultRoles;
 import org.keycloak.models.utils.KeycloakModelUtils;
@@ -132,8 +131,7 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
         em.createNamedQuery("deleteUserRoleMappingsByUser").setParameter("user", user).executeUpdate();
         em.createNamedQuery("deleteUserGroupMembershipsByUser").setParameter("user", user).executeUpdate();
         em.createNamedQuery("deleteFederatedIdentityByUser").setParameter("user", user).executeUpdate();
-        em.createNamedQuery("deleteUserConsentRolesByUser").setParameter("user", user).executeUpdate();
-        em.createNamedQuery("deleteUserConsentProtMappersByUser").setParameter("user", user).executeUpdate();
+        em.createNamedQuery("deleteUserConsentClientScopesByUser").setParameter("user", user).executeUpdate();
         em.createNamedQuery("deleteUserConsentsByUser").setParameter("user", user).executeUpdate();
         em.flush();
         // not sure why i have to do a clear() here.  I was getting some messed up errors that Hibernate couldn't
@@ -297,36 +295,12 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
         model.setCreatedDate(entity.getCreatedDate());
         model.setLastUpdatedDate(entity.getLastUpdatedDate());
 
-        Collection<UserConsentRoleEntity> grantedRoleEntities = entity.getGrantedRoles();
-        if (grantedRoleEntities != null) {
-            for (UserConsentRoleEntity grantedRole : grantedRoleEntities) {
-                RoleModel grantedRoleModel = realm.getRoleById(grantedRole.getRoleId());
-                if (grantedRoleModel != null) {
-                    model.addGrantedRole(grantedRoleModel);
-                }
-            }
-        }
-
-        Collection<UserConsentProtocolMapperEntity> grantedProtocolMapperEntities = entity.getGrantedProtocolMappers();
-        if (grantedProtocolMapperEntities != null) {
-
-            ClientTemplateModel clientTemplate = null;
-            if (client.useTemplateMappers()) {
-                clientTemplate = client.getClientTemplate();
-            }
-
-            for (UserConsentProtocolMapperEntity grantedProtMapper : grantedProtocolMapperEntities) {
-                ProtocolMapperModel protocolMapper = client.getProtocolMapperById(grantedProtMapper.getProtocolMapperId());
-
-                // Fallback to client template
-                if (protocolMapper == null) {
-                    if (clientTemplate != null) {
-                        protocolMapper = clientTemplate.getProtocolMapperById(grantedProtMapper.getProtocolMapperId());
-                    }
-                }
-
-                if (protocolMapper != null) {
-                    model.addGrantedProtocolMapper(protocolMapper);
+        Collection<UserConsentClientScopeEntity> grantedClientScopeEntities = entity.getGrantedClientScopes();
+        if (grantedClientScopeEntities != null) {
+            for (UserConsentClientScopeEntity grantedClientScope : grantedClientScopeEntities) {
+                ClientScopeModel grantedClientScopeModel = KeycloakModelUtils.findClientScopeById(realm, grantedClientScope.getScopeId());
+                if (grantedClientScopeModel != null) {
+                    model.addGrantedClientScope(grantedClientScopeModel);
                 }
             }
         }
@@ -336,48 +310,26 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
 
     // Update roles and protocolMappers to given consentEntity from the consentModel
     private void updateGrantedConsentEntity(UserConsentEntity consentEntity, UserConsentModel consentModel) {
-        Collection<UserConsentProtocolMapperEntity> grantedProtocolMapperEntities = consentEntity.getGrantedProtocolMappers();
-        Collection<UserConsentProtocolMapperEntity> mappersToRemove = new HashSet<UserConsentProtocolMapperEntity>(grantedProtocolMapperEntities);
+        Collection<UserConsentClientScopeEntity> grantedClientScopeEntities = consentEntity.getGrantedClientScopes();
+        Collection<UserConsentClientScopeEntity> scopesToRemove = new HashSet<>(grantedClientScopeEntities);
 
-        for (ProtocolMapperModel protocolMapper : consentModel.getGrantedProtocolMappers()) {
-            UserConsentProtocolMapperEntity grantedProtocolMapperEntity = new UserConsentProtocolMapperEntity();
-            grantedProtocolMapperEntity.setUserConsent(consentEntity);
-            grantedProtocolMapperEntity.setProtocolMapperId(protocolMapper.getId());
+        for (ClientScopeModel clientScope : consentModel.getGrantedClientScopes()) {
+            UserConsentClientScopeEntity grantedClientScopeEntity = new UserConsentClientScopeEntity();
+            grantedClientScopeEntity.setUserConsent(consentEntity);
+            grantedClientScopeEntity.setScopeId(clientScope.getId());
 
             // Check if it's already there
-            if (!grantedProtocolMapperEntities.contains(grantedProtocolMapperEntity)) {
-                em.persist(grantedProtocolMapperEntity);
+            if (!grantedClientScopeEntities.contains(grantedClientScopeEntity)) {
+                em.persist(grantedClientScopeEntity);
                 em.flush();
-                grantedProtocolMapperEntities.add(grantedProtocolMapperEntity);
+                grantedClientScopeEntities.add(grantedClientScopeEntity);
             } else {
-                mappersToRemove.remove(grantedProtocolMapperEntity);
+                scopesToRemove.remove(grantedClientScopeEntity);
             }
         }
-        // Those mappers were no longer on consentModel and will be removed
-        for (UserConsentProtocolMapperEntity toRemove : mappersToRemove) {
-            grantedProtocolMapperEntities.remove(toRemove);
-            em.remove(toRemove);
-        }
-
-        Collection<UserConsentRoleEntity> grantedRoleEntities = consentEntity.getGrantedRoles();
-        Set<UserConsentRoleEntity> rolesToRemove = new HashSet<UserConsentRoleEntity>(grantedRoleEntities);
-        for (RoleModel role : consentModel.getGrantedRoles()) {
-            UserConsentRoleEntity consentRoleEntity = new UserConsentRoleEntity();
-            consentRoleEntity.setUserConsent(consentEntity);
-            consentRoleEntity.setRoleId(role.getId());
-
-            // Check if it's already there
-            if (!grantedRoleEntities.contains(consentRoleEntity)) {
-                em.persist(consentRoleEntity);
-                em.flush();
-                grantedRoleEntities.add(consentRoleEntity);
-            } else {
-                rolesToRemove.remove(consentRoleEntity);
-            }
-        }
-        // Those roles were no longer on consentModel and will be removed
-        for (UserConsentRoleEntity toRemove : rolesToRemove) {
-            grantedRoleEntities.remove(toRemove);
+        // Those client scopes were no longer on consentModel and will be removed
+        for (UserConsentClientScopeEntity toRemove : scopesToRemove) {
+            grantedClientScopeEntities.remove(toRemove);
             em.remove(toRemove);
         }
 
@@ -409,9 +361,7 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
 
     @Override
     public void preRemove(RealmModel realm) {
-        int num = em.createNamedQuery("deleteUserConsentRolesByRealm")
-                .setParameter("realmId", realm.getId()).executeUpdate();
-        num = em.createNamedQuery("deleteUserConsentProtMappersByRealm")
+        int num = em.createNamedQuery("deleteUserConsentClientScopesByRealm")
                 .setParameter("realmId", realm.getId()).executeUpdate();
         num = em.createNamedQuery("deleteUserConsentsByRealm")
                 .setParameter("realmId", realm.getId()).executeUpdate();
@@ -463,11 +413,7 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
                 .setParameter("realmId", realm.getId())
                 .setParameter("link", storageProviderId)
                 .executeUpdate();
-        num = em.createNamedQuery("deleteUserConsentProtMappersByRealmAndLink")
-                .setParameter("realmId", realm.getId())
-                .setParameter("link", storageProviderId)
-                .executeUpdate();
-        num = em.createNamedQuery("deleteUserConsentRolesByRealmAndLink")
+        num = em.createNamedQuery("deleteUserConsentClientScopesByRealmAndLink")
                 .setParameter("realmId", realm.getId())
                 .setParameter("link", storageProviderId)
                 .executeUpdate();
@@ -491,7 +437,6 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
 
     @Override
     public void preRemove(RealmModel realm, RoleModel role) {
-        em.createNamedQuery("deleteUserConsentRolesByRole").setParameter("roleId", role.getId()).executeUpdate();
         em.createNamedQuery("deleteUserRoleMappingsByRole").setParameter("roleId", role.getId()).executeUpdate();
     }
 
@@ -499,21 +444,14 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
     public void preRemove(RealmModel realm, ClientModel client) {
         StorageId clientStorageId = new StorageId(client.getId());
         if (clientStorageId.isLocal()) {
-            em.createNamedQuery("deleteUserConsentProtMappersByClient")
+            int num = em.createNamedQuery("deleteUserConsentClientScopesByClient")
                     .setParameter("clientId", client.getId())
                     .executeUpdate();
-            em.createNamedQuery("deleteUserConsentRolesByClient")
-                    .setParameter("clientId", client.getId())
-                    .executeUpdate();
-            em.createNamedQuery("deleteUserConsentsByClient")
+            num = em.createNamedQuery("deleteUserConsentsByClient")
                     .setParameter("clientId", client.getId())
                     .executeUpdate();
         } else {
-            em.createNamedQuery("deleteUserConsentProtMappersByExternalClient")
-                    .setParameter("clientStorageProvider", clientStorageId.getProviderId())
-                    .setParameter("externalClientId",clientStorageId.getExternalId())
-                    .executeUpdate();
-            em.createNamedQuery("deleteUserConsentRolesByExternalClient")
+            em.createNamedQuery("deleteUserConsentClientScopesByExternalClient")
                     .setParameter("clientStorageProvider", clientStorageId.getProviderId())
                     .setParameter("externalClientId", clientStorageId.getExternalId())
                     .executeUpdate();
@@ -527,8 +465,13 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
 
     @Override
     public void preRemove(ProtocolMapperModel protocolMapper) {
-        em.createNamedQuery("deleteUserConsentProtMappersByProtocolMapper")
-                .setParameter("protocolMapperId", protocolMapper.getId())
+        // No-op
+    }
+
+    @Override
+    public void preRemove(ClientScopeModel clientScope) {
+        em.createNamedQuery("deleteUserConsentClientScopesByClientScope")
+                .setParameter("scopeId", clientScope.getId())
                 .executeUpdate();
     }
 
@@ -863,10 +806,7 @@ public class JpaUserProvider implements UserProvider, UserCredentialStore {
     }
 
     protected void removeConsentByClientStorageProvider(RealmModel realm, String providerId) {
-        em.createNamedQuery("deleteUserConsentProtMappersByClientStorageProvider")
-                .setParameter("clientStorageProvider", providerId)
-                .executeUpdate();
-        em.createNamedQuery("deleteUserConsentRolesByClientStorageProvider")
+        em.createNamedQuery("deleteUserConsentClientScopesByClientStorageProvider")
                 .setParameter("clientStorageProvider", providerId)
                 .executeUpdate();
         em.createNamedQuery("deleteUserConsentsByClientStorageProvider")

model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java

@@ -28,6 +28,8 @@ import org.keycloak.models.utils.ComponentUtil;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
 import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+
 import java.util.*;
 import java.util.function.Predicate;
 import java.util.stream.Collectors;
@@ -1769,60 +1771,64 @@ public class RealmAdapter implements RealmModel, JpaModel<RealmEntity> {
     }
 
     @Override
-    public List<ClientTemplateModel> getClientTemplates() {
-        Collection<ClientTemplateEntity> entities = realm.getClientTemplates();
+    public List<ClientScopeModel> getClientScopes() {
+        Collection<ClientScopeEntity> entities = realm.getClientScopes();
         if (entities == null || entities.isEmpty()) return Collections.EMPTY_LIST;
-        List<ClientTemplateModel> list = new LinkedList<>();
-        for (ClientTemplateEntity entity : entities) {
-            list.add(session.realms().getClientTemplateById(entity.getId(), this));
+        List<ClientScopeModel> list = new LinkedList<>();
+        for (ClientScopeEntity entity : entities) {
+            list.add(session.realms().getClientScopeById(entity.getId(), this));
         }
         return Collections.unmodifiableList(list);
     }
 
     @Override
-    public ClientTemplateModel addClientTemplate(String name) {
-        return this.addClientTemplate(KeycloakModelUtils.generateId(), name);
+    public ClientScopeModel addClientScope(String name) {
+        return this.addClientScope(KeycloakModelUtils.generateId(), name);
     }
 
     @Override
-    public ClientTemplateModel addClientTemplate(String id, String name) {
-        ClientTemplateEntity entity = new ClientTemplateEntity();
+    public ClientScopeModel addClientScope(String id, String name) {
+        ClientScopeEntity entity = new ClientScopeEntity();
         entity.setId(id);
+        name = KeycloakModelUtils.convertClientScopeName(name);
         entity.setName(name);
         entity.setRealm(realm);
-        realm.getClientTemplates().add(entity);
+        realm.getClientScopes().add(entity);
         em.persist(entity);
         em.flush();
-        final ClientTemplateModel resource = new ClientTemplateAdapter(this, em, session, entity);
+        final ClientScopeModel resource = new ClientScopeAdapter(this, em, session, entity);
         em.flush();
         return resource;
     }
 
     @Override
-    public boolean removeClientTemplate(String id) {
+    public boolean removeClientScope(String id) {
         if (id == null) return false;
-        ClientTemplateModel client = getClientTemplateById(id);
-        if (client == null) return false;
-        if (KeycloakModelUtils.isClientTemplateUsed(this, client)) {
-            throw new ModelException("Cannot remove client template, it is currently in use");
+        ClientScopeModel clientScope = getClientScopeById(id);
+        if (clientScope == null) return false;
+        if (KeycloakModelUtils.isClientScopeUsed(this, clientScope)) {
+            throw new ModelException("Cannot remove client scope, it is currently in use");
         }
 
-        ClientTemplateEntity clientEntity = null;
-        Iterator<ClientTemplateEntity> it = realm.getClientTemplates().iterator();
+        ClientScopeEntity clientScopeEntity = null;
+        Iterator<ClientScopeEntity> it = realm.getClientScopes().iterator();
         while (it.hasNext()) {
-            ClientTemplateEntity ae = it.next();
+            ClientScopeEntity ae = it.next();
             if (ae.getId().equals(id)) {
-                clientEntity = ae;
+                clientScopeEntity = ae;
                 it.remove();
                 break;
             }
         }
-        if (client == null) {
+        if (clientScope == null) {
             return false;
         }
-        em.createNamedQuery("deleteTemplateScopeMappingByClient").setParameter("template", clientEntity).executeUpdate();
+
+        session.users().preRemove(clientScope);
+
+        em.createNamedQuery("deleteClientScopeRoleMappingByClientScope").setParameter("clientScope", clientScopeEntity).executeUpdate();
         em.flush();
-        em.remove(clientEntity);
+        em.remove(clientScopeEntity);
         em.flush();
 
 
@@ -1830,8 +1836,44 @@ public class RealmAdapter implements RealmModel, JpaModel<RealmEntity> {
     }
 
     @Override
-    public ClientTemplateModel getClientTemplateById(String id) {
-        return session.realms().getClientTemplateById(id, this);
+    public ClientScopeModel getClientScopeById(String id) {
+        return session.realms().getClientScopeById(id, this);
+    }
+
+    @Override
+    public void addDefaultClientScope(ClientScopeModel clientScope, boolean defaultScope) {
+        DefaultClientScopeRealmMappingEntity entity = new DefaultClientScopeRealmMappingEntity();
+        entity.setClientScope(ClientScopeAdapter.toClientScopeEntity(clientScope, em));
+        entity.setRealm(getEntity());
+        entity.setDefaultScope(defaultScope);
+        em.persist(entity);
+        em.flush();
+        em.detach(entity);
+    }
+
+    @Override
+    public void removeDefaultClientScope(ClientScopeModel clientScope) {
+        int numRemoved = em.createNamedQuery("deleteDefaultClientScopeRealmMapping")
+                .setParameter("clientScope", ClientScopeAdapter.toClientScopeEntity(clientScope, em))
+                .setParameter("realm", getEntity())
+                .executeUpdate();
+        em.flush();
+    }
+
+    @Override
+    public List<ClientScopeModel> getDefaultClientScopes(boolean defaultScope) {
+        TypedQuery<String> query = em.createNamedQuery("defaultClientScopeRealmMappingIdsByRealm", String.class);
+        query.setParameter("realm", getEntity());
+        query.setParameter("defaultScope", defaultScope);
+        List<String> ids = query.getResultList();
+
+        List<ClientScopeModel>  clientScopes = new LinkedList<>();
+        for (String clientScopeId : ids) {
+            ClientScopeModel clientScope = getClientScopeById(clientScopeId);
+            if (clientScope == null) continue;
+            clientScopes.add(clientScope);
+        }
+        return clientScopes;
     }
 
     @Override

model/jpa/src/main/java/org/keycloak/models/jpa/RoleAdapter.java

@@ -68,16 +68,6 @@ public class RoleAdapter implements RoleModel, JpaModel<RoleEntity> {
         role.setDescription(description);
     }
 
-    @Override
-    public boolean isScopeParamRequired() {
-        return role.isScopeParamRequired();
-    }
-
-    @Override
-    public void setScopeParamRequired(boolean scopeParamRequired) {
-        role.setScopeParamRequired(scopeParamRequired);
-    }
-
     @Override
     public String getId() {
         return role.getId();

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java

@@ -90,19 +90,6 @@ public class ClientEntity {
     @Column(name="FULL_SCOPE_ALLOWED")
     private boolean fullScopeAllowed;
 
-    @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "CLIENT_TEMPLATE_ID")
-    protected ClientTemplateEntity clientTemplate;
-
-    @Column(name="USE_TEMPLATE_CONFIG")
-    private boolean useTemplateConfig;
-
-    @Column(name="USE_TEMPLATE_SCOPE")
-    private boolean useTemplateScope;
-
-    @Column(name="USE_TEMPLATE_MAPPERS")
-    private boolean useTemplateMappers;
-
     @ManyToOne(fetch = FetchType.LAZY)
     @JoinColumn(name = "REALM_ID")
     protected RealmEntity realm;
@@ -435,38 +422,6 @@ public class ClientEntity {
         this.registeredNodes = registeredNodes;
     }
 
-    public ClientTemplateEntity getClientTemplate() {
-        return clientTemplate;
-    }
-
-    public void setClientTemplate(ClientTemplateEntity clientTemplate) {
-        this.clientTemplate = clientTemplate;
-    }
-
-    public boolean isUseTemplateConfig() {
-        return useTemplateConfig;
-    }
-
-    public void setUseTemplateConfig(boolean useTemplateConfig) {
-        this.useTemplateConfig = useTemplateConfig;
-    }
-
-    public boolean isUseTemplateScope() {
-        return useTemplateScope;
-    }
-
-    public void setUseTemplateScope(boolean useTemplateScope) {
-        this.useTemplateScope = useTemplateScope;
-    }
-
-    public boolean isUseTemplateMappers() {
-        return useTemplateMappers;
-    }
-
-    public void setUseTemplateMappers(boolean useTemplateMappers) {
-        this.useTemplateMappers = useTemplateMappers;
-    }
-
     public Set<RoleEntity> getScopeMapping() {
         return scopeMapping;
     }

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeClientMappingEntity.java

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.jpa.entities;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+/**
+ * Binding between client and clientScope
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@NamedQueries({
+        @NamedQuery(name="clientScopeClientMappingIdsByClient", query="select m.clientScope.id from ClientScopeClientMappingEntity m where m.client = :client and m.defaultScope = :defaultScope"),
+        @NamedQuery(name="deleteClientScopeClientMapping", query="delete from ClientScopeClientMappingEntity where client = :client and clientScope = :clientScope"),
+        @NamedQuery(name="deleteClientScopeClientMappingByClient", query="delete from ClientScopeClientMappingEntity where client = :client")
+})
+@Entity
+@Table(name="CLIENT_SCOPE_CLIENT")
+@IdClass(ClientScopeClientMappingEntity.Key.class)
+public class ClientScopeClientMappingEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "SCOPE_ID")
+    protected ClientScopeEntity clientScope;
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name="CLIENT_ID")
+    protected ClientEntity client;
+
+    @Column(name="DEFAULT_SCOPE")
+    protected boolean defaultScope;
+
+    public ClientScopeEntity getClientScope() {
+        return clientScope;
+    }
+
+    public void setClientScope(ClientScopeEntity clientScope) {
+        this.clientScope = clientScope;
+    }
+
+    public ClientEntity getClient() {
+        return client;
+    }
+
+    public void setClient(ClientEntity client) {
+        this.client = client;
+    }
+
+    public boolean isDefaultScope() {
+        return defaultScope;
+    }
+
+    public void setDefaultScope(boolean defaultScope) {
+        this.defaultScope = defaultScope;
+    }
+
+    public static class Key implements Serializable {
+
+        protected ClientScopeEntity clientScope;
+
+        protected ClientEntity client;
+
+        public Key() {
+        }
+
+        public Key(ClientScopeEntity clientScope, ClientEntity client) {
+            this.clientScope = clientScope;
+            this.client = client;
+        }
+
+        public ClientScopeEntity getClientScope() {
+            return clientScope;
+        }
+
+        public ClientEntity getClient() {
+            return client;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            ClientScopeClientMappingEntity.Key key = (ClientScopeClientMappingEntity.Key) o;
+
+            if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
+            if (client != null ? !client.getId().equals(key.client != null ? key.client.getId() : null) : key.client != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = clientScope != null ? clientScope.getId().hashCode() : 0;
+            result = 31 * result + (client != null ? client.getId().hashCode() : 0);
+            return result;
+        }
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+        if (!(o instanceof ClientScopeClientMappingEntity)) return false;
+
+        ClientScopeClientMappingEntity key = (ClientScopeClientMappingEntity) o;
+
+        if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
+        if (client != null ? !client.getId().equals(key.client != null ? key.client.getId() : null) : key.client != null) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = clientScope != null ? clientScope.getId().hashCode() : 0;
+        result = 31 * result + (client != null ? client.getId().hashCode() : 0);
+        return result;
+    }
+}

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeEntity.java

@@ -44,8 +44,8 @@ import java.util.Map;
  * @version $Revision: 1 $
  */
 @Entity
-@Table(name="CLIENT_TEMPLATE", uniqueConstraints = {@UniqueConstraint(columnNames = {"REALM_ID", "NAME"})})
-public class ClientTemplateEntity {
+@Table(name="CLIENT_SCOPE", uniqueConstraints = {@UniqueConstraint(columnNames = {"REALM_ID", "NAME"})})
+public class ClientScopeEntity {
 
     @Id
     @Column(name="ID", length = 36)
@@ -56,7 +56,7 @@ public class ClientTemplateEntity {
     @Nationalized
     @Column(name = "DESCRIPTION")
     private String description;
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "clientTemplate")
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "clientScope")
     Collection<ProtocolMapperEntity> protocolMappers = new ArrayList<ProtocolMapperEntity>();
     @ManyToOne(fetch = FetchType.LAZY)
     @JoinColumn(name = "REALM_ID")
@@ -65,36 +65,11 @@ public class ClientTemplateEntity {
     @Column(name="PROTOCOL")
     private String protocol;
 
-    @Column(name="FULL_SCOPE_ALLOWED")
-    private boolean fullScopeAllowed;
-
-    @Column(name="CONSENT_REQUIRED")
-    private boolean consentRequired;
-
-    @Column(name="STANDARD_FLOW_ENABLED")
-    private boolean standardFlowEnabled;
-
-    @Column(name="IMPLICIT_FLOW_ENABLED")
-    private boolean implicitFlowEnabled;
-
-    @Column(name="DIRECT_ACCESS_GRANTS_ENABLED")
-    private boolean directAccessGrantsEnabled;
-
-    @Column(name="SERVICE_ACCOUNTS_ENABLED")
-    private boolean serviceAccountsEnabled;
-
-    @Column(name="FRONTCHANNEL_LOGOUT")
-    private boolean frontchannelLogout;
-    @Column(name="PUBLIC_CLIENT")
-    private boolean publicClient;
-    @Column(name="BEARER_ONLY")
-    private boolean bearerOnly;
-
 
     @ElementCollection
     @MapKeyColumn(name="NAME")
     @Column(name="VALUE", length = 2048)
-    @CollectionTable(name="CLIENT_TEMPLATE_ATTRIBUTES", joinColumns={ @JoinColumn(name="TEMPLATE_ID") })
+    @CollectionTable(name="CLIENT_SCOPE_ATTRIBUTES", joinColumns={ @JoinColumn(name="SCOPE_ID") })
     protected Map<String, String> attributes = new HashMap<String, String>();
 
     public RealmEntity getRealm() {
@@ -145,14 +120,6 @@ public class ClientTemplateEntity {
         this.protocol = protocol;
     }
 
-    public boolean isFullScopeAllowed() {
-        return fullScopeAllowed;
-    }
-
-    public void setFullScopeAllowed(boolean fullScopeAllowed) {
-        this.fullScopeAllowed = fullScopeAllowed;
-    }
-
     public Map<String, String> getAttributes() {
         return attributes;
     }
@@ -161,77 +128,13 @@ public class ClientTemplateEntity {
         this.attributes = attributes;
     }
 
-    public boolean isConsentRequired() {
-        return consentRequired;
-    }
-
-    public void setConsentRequired(boolean consentRequired) {
-        this.consentRequired = consentRequired;
-    }
-
-    public boolean isStandardFlowEnabled() {
-        return standardFlowEnabled;
-    }
-
-    public void setStandardFlowEnabled(boolean standardFlowEnabled) {
-        this.standardFlowEnabled = standardFlowEnabled;
-    }
-
-    public boolean isImplicitFlowEnabled() {
-        return implicitFlowEnabled;
-    }
-
-    public void setImplicitFlowEnabled(boolean implicitFlowEnabled) {
-        this.implicitFlowEnabled = implicitFlowEnabled;
-    }
-
-    public boolean isDirectAccessGrantsEnabled() {
-        return directAccessGrantsEnabled;
-    }
-
-    public void setDirectAccessGrantsEnabled(boolean directAccessGrantsEnabled) {
-        this.directAccessGrantsEnabled = directAccessGrantsEnabled;
-    }
-
-    public boolean isServiceAccountsEnabled() {
-        return serviceAccountsEnabled;
-    }
-
-    public void setServiceAccountsEnabled(boolean serviceAccountsEnabled) {
-        this.serviceAccountsEnabled = serviceAccountsEnabled;
-    }
-
-    public boolean isFrontchannelLogout() {
-        return frontchannelLogout;
-    }
-
-    public void setFrontchannelLogout(boolean frontchannelLogout) {
-        this.frontchannelLogout = frontchannelLogout;
-    }
-
-    public boolean isPublicClient() {
-        return publicClient;
-    }
-
-    public void setPublicClient(boolean publicClient) {
-        this.publicClient = publicClient;
-    }
-
-    public boolean isBearerOnly() {
-        return bearerOnly;
-    }
-
-    public void setBearerOnly(boolean bearerOnly) {
-        this.bearerOnly = bearerOnly;
-    }
-
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null) return false;
-        if (!(o instanceof ClientTemplateEntity)) return false;
+        if (!(o instanceof ClientScopeEntity)) return false;
 
-        ClientTemplateEntity that = (ClientTemplateEntity) o;
+        ClientScopeEntity that = (ClientScopeEntity) o;
 
         if (!id.equals(that.getId())) return false;
 

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientScopeRoleMappingEntity.java

@@ -33,33 +33,32 @@ import java.io.Serializable;
  * @version $Revision: 1 $
  */
 @NamedQueries({
-        @NamedQuery(name="templateHasScope", query="select m from TemplateScopeMappingEntity m where m.template = :template and m.role = :role"),
-        @NamedQuery(name="clientTemplateScopeMappings", query="select m from TemplateScopeMappingEntity m where m.template = :template"),
-        @NamedQuery(name="clientTemplateScopeMappingIds", query="select m.role.id from TemplateScopeMappingEntity m where m.template = :template"),
-        @NamedQuery(name="deleteTemplateScopeMappingByRole", query="delete from TemplateScopeMappingEntity where role = :role"),
-        @NamedQuery(name="deleteTemplateScopeMappingByClient", query="delete from TemplateScopeMappingEntity where template = :template")
+        @NamedQuery(name="clientScopeHasRole", query="select m from ClientScopeRoleMappingEntity m where m.clientScope = :clientScope and m.role = :role"),
+        @NamedQuery(name="clientScopeRoleMappingIds", query="select m.role.id from ClientScopeRoleMappingEntity m where m.clientScope = :clientScope"),
+        @NamedQuery(name="deleteClientScopeRoleMappingByRole", query="delete from ClientScopeRoleMappingEntity where role = :role"),
+        @NamedQuery(name="deleteClientScopeRoleMappingByClientScope", query="delete from ClientScopeRoleMappingEntity where clientScope = :clientScope")
 })
-@Table(name="TEMPLATE_SCOPE_MAPPING")
+@Table(name="CLIENT_SCOPE_ROLE_MAPPING")
 @Entity
-@IdClass(TemplateScopeMappingEntity.Key.class)
-public class TemplateScopeMappingEntity {
+@IdClass(ClientScopeRoleMappingEntity.Key.class)
+public class ClientScopeRoleMappingEntity {
 
     @Id
     @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name = "TEMPLATE_ID")
-    protected ClientTemplateEntity template;
+    @JoinColumn(name = "SCOPE_ID")
+    protected ClientScopeEntity clientScope;
 
     @Id
     @ManyToOne(fetch= FetchType.LAZY)
     @JoinColumn(name="ROLE_ID")
     protected RoleEntity role;
 
-    public ClientTemplateEntity getTemplate() {
-        return template;
+    public ClientScopeEntity getClientScope() {
+        return clientScope;
     }
 
-    public void setTemplate(ClientTemplateEntity template) {
-        this.template = template;
+    public void setClientScope(ClientScopeEntity clientScope) {
+        this.clientScope = clientScope;
     }
 
     public RoleEntity getRole() {
@@ -72,20 +71,20 @@ public class TemplateScopeMappingEntity {
 
     public static class Key implements Serializable {
 
-        protected ClientTemplateEntity template;
+        protected ClientScopeEntity clientScope;
 
         protected RoleEntity role;
 
         public Key() {
         }
 
-        public Key(ClientTemplateEntity template, RoleEntity role) {
-            this.template = template;
+        public Key(ClientScopeEntity clientScope, RoleEntity role) {
+            this.clientScope = clientScope;
             this.role = role;
         }
 
-        public ClientTemplateEntity getTemplate() {
-            return template;
+        public ClientScopeEntity getClientScope() {
+            return clientScope;
         }
 
         public RoleEntity getRole() {
@@ -99,7 +98,7 @@ public class TemplateScopeMappingEntity {
 
             Key key = (Key) o;
 
-            if (template != null ? !template.getId().equals(key.template != null ? key.template.getId() : null) : key.template != null) return false;
+            if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
             if (role != null ? !role.getId().equals(key.role != null ? key.role.getId() : null) : key.role != null) return false;
 
             return true;
@@ -107,7 +106,7 @@ public class TemplateScopeMappingEntity {
 
         @Override
         public int hashCode() {
-            int result = template != null ? template.getId().hashCode() : 0;
+            int result = clientScope != null ? clientScope.getId().hashCode() : 0;
             result = 31 * result + (role != null ? role.getId().hashCode() : 0);
             return result;
         }
@@ -117,11 +116,11 @@ public class TemplateScopeMappingEntity {
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || getClass() != o.getClass()) return false;
-        if (!(o instanceof TemplateScopeMappingEntity)) return false;
+        if (!(o instanceof ClientScopeRoleMappingEntity)) return false;
 
-        TemplateScopeMappingEntity key = (TemplateScopeMappingEntity) o;
+        ClientScopeRoleMappingEntity key = (ClientScopeRoleMappingEntity) o;
 
-        if (template != null ? !template.getId().equals(key.template != null ? key.template.getId() : null) : key.template != null) return false;
+        if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
         if (role != null ? !role.getId().equals(key.role != null ? key.role.getId() : null) : key.role != null) return false;
 
         return true;
@@ -129,7 +128,7 @@ public class TemplateScopeMappingEntity {
 
     @Override
     public int hashCode() {
-        int result = template != null ? template.getId().hashCode() : 0;
+        int result = clientScope != null ? clientScope.getId().hashCode() : 0;
         result = 31 * result + (role != null ? role.getId().hashCode() : 0);
         return result;
     }

model/jpa/src/main/java/org/keycloak/models/jpa/entities/DefaultClientScopeRealmMappingEntity.java

@@ -0,0 +1,148 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.jpa.entities;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+/**
+ * Binding between realm and default clientScope
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@NamedQueries({
+        @NamedQuery(name="defaultClientScopeRealmMappingIdsByRealm", query="select m.clientScope.id from DefaultClientScopeRealmMappingEntity m where m.realm = :realm and m.defaultScope = :defaultScope"),
+        @NamedQuery(name="deleteDefaultClientScopeRealmMapping", query="delete from DefaultClientScopeRealmMappingEntity where realm = :realm and clientScope = :clientScope"),
+        @NamedQuery(name="deleteDefaultClientScopeRealmMappingByRealm", query="delete from DefaultClientScopeRealmMappingEntity where realm = :realm")
+})
+@Entity
+@Table(name="DEFAULT_CLIENT_SCOPE")
+@IdClass(DefaultClientScopeRealmMappingEntity.Key.class)
+public class DefaultClientScopeRealmMappingEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "SCOPE_ID")
+    protected ClientScopeEntity clientScope;
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name="REALM_ID")
+    protected RealmEntity realm;
+
+    @Column(name="DEFAULT_SCOPE")
+    protected boolean defaultScope;
+
+    public ClientScopeEntity getClientScope() {
+        return clientScope;
+    }
+
+    public void setClientScope(ClientScopeEntity clientScope) {
+        this.clientScope = clientScope;
+    }
+
+    public RealmEntity getRealm() {
+        return realm;
+    }
+
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
+    }
+
+    public boolean isDefaultScope() {
+        return defaultScope;
+    }
+
+    public void setDefaultScope(boolean defaultScope) {
+        this.defaultScope = defaultScope;
+    }
+
+    public static class Key implements Serializable {
+
+        protected ClientScopeEntity clientScope;
+
+        protected RealmEntity realm;
+
+        public Key() {
+        }
+
+        public Key(ClientScopeEntity clientScope, RealmEntity realm) {
+            this.clientScope = clientScope;
+            this.realm = realm;
+        }
+
+        public ClientScopeEntity getClientScope() {
+            return clientScope;
+        }
+
+        public RealmEntity getRealm() {
+            return realm;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            DefaultClientScopeRealmMappingEntity.Key key = (DefaultClientScopeRealmMappingEntity.Key) o;
+
+            if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
+            if (realm != null ? !realm.getId().equals(key.realm != null ? key.realm.getId() : null) : key.realm != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = clientScope != null ? clientScope.getId().hashCode() : 0;
+            result = 31 * result + (realm != null ? realm.getId().hashCode() : 0);
+            return result;
+        }
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+        if (!(o instanceof DefaultClientScopeRealmMappingEntity)) return false;
+
+        DefaultClientScopeRealmMappingEntity key = (DefaultClientScopeRealmMappingEntity) o;
+
+        if (clientScope != null ? !clientScope.getId().equals(key.clientScope != null ? key.clientScope.getId() : null) : key.clientScope != null) return false;
+        if (realm != null ? !realm.getId().equals(key.realm != null ? key.realm.getId() : null) : key.realm != null) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = clientScope != null ? clientScope.getId().hashCode() : 0;
+        result = 31 * result + (realm != null ? realm.getId().hashCode() : 0);
+        return result;
+    }
+}

model/jpa/src/main/java/org/keycloak/models/jpa/entities/ProtocolMapperEntity.java

@@ -51,10 +51,6 @@ public class ProtocolMapperEntity {
     protected String protocol;
     @Column(name = "PROTOCOL_MAPPER_NAME")
     protected String protocolMapper;
-    @Column(name="CONSENT_REQUIRED")
-    protected boolean consentRequired;
-    @Column(name="CONSENT_TEXT")
-    protected String consentText;
 
     @ElementCollection
     @MapKeyColumn(name="NAME")
@@ -67,8 +63,8 @@ public class ProtocolMapperEntity {
     private ClientEntity client;
 
     @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "CLIENT_TEMPLATE_ID")
-    private ClientTemplateEntity clientTemplate;
+    @JoinColumn(name = "CLIENT_SCOPE_ID")
+    private ClientScopeEntity clientScope;
 
     public String getId() {
         return id;
@@ -118,29 +114,14 @@ public class ProtocolMapperEntity {
         this.client = client;
     }
 
-    public ClientTemplateEntity getClientTemplate() {
-        return clientTemplate;
+    public ClientScopeEntity getClientScope() {
+        return clientScope;
     }
 
-    public void setClientTemplate(ClientTemplateEntity clientTemplate) {
-        this.clientTemplate = clientTemplate;
+    public void setClientScope(ClientScopeEntity clientScope) {
+        this.clientScope = clientScope;
     }
 
-    public boolean isConsentRequired() {
-        return consentRequired;
-    }
-
-    public void setConsentRequired(boolean consentRequired) {
-        this.consentRequired = consentRequired;
-    }
-
-    public String getConsentText() {
-        return consentText;
-    }
-
-    public void setConsentText(String consentText) {
-        this.consentText = consentText;
-    }
 
     @Override
     public boolean equals(Object o) {

model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java

@@ -145,7 +145,7 @@ public class RealmEntity {
     Collection<UserFederationMapperEntity> userFederationMappers = new ArrayList<UserFederationMapperEntity>();
 
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
-    Collection<ClientTemplateEntity> clientTemplates = new ArrayList<>();
+    Collection<ClientScopeEntity> clientScopes = new ArrayList<>();
 
     @ElementCollection
     @MapKeyColumn(name="NAME")
@@ -757,12 +757,12 @@ public class RealmEntity {
         return this;
     }
 
-    public Collection<ClientTemplateEntity> getClientTemplates() {
-        return clientTemplates;
+    public Collection<ClientScopeEntity> getClientScopes() {
+        return clientScopes;
     }
 
-    public void setClientTemplates(Collection<ClientTemplateEntity> clientTemplates) {
-        this.clientTemplates = clientTemplates;
+    public void setClientScopes(Collection<ClientScopeEntity> clientScopes) {
+        this.clientScopes = clientScopes;
     }
 
     public void setAllowUserManagedAccess(boolean allowUserManagedAccess) {

model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java

@@ -69,8 +69,6 @@ public class RoleEntity {
     @Nationalized
     @Column(name = "DESCRIPTION")
     private String description;
-    @Column(name = "SCOPE_PARAM_REQUIRED")
-    private boolean scopeParamRequired;
 
     // hax! couldn't get constraint to work properly
     @Column(name = "REALM_ID")
@@ -129,14 +127,6 @@ public class RoleEntity {
         this.description = description;
     }
 
-    public boolean isScopeParamRequired() {
-        return scopeParamRequired;
-    }
-
-    public void setScopeParamRequired(boolean scopeParamRequired) {
-        this.scopeParamRequired = scopeParamRequired;
-    }
-
     public Set<RoleEntity> getCompositeRoles() {
         return compositeRoles;
     }

model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserConsentClientScopeEntity.java

@@ -0,0 +1,135 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.jpa.entities;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@NamedQueries({
+        @NamedQuery(name="deleteUserConsentClientScopesByRealm", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select user from UserEntity user where user.realmId = :realmId))"),
+        @NamedQuery(name="deleteUserConsentClientScopesByRealmAndLink", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select u from UserEntity u where u.realmId=:realmId and u.federationLink=:link))"),
+        @NamedQuery(name="deleteUserConsentClientScopesByUser", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.user = :user)"),
+        @NamedQuery(name="deleteUserConsentClientScopesByClientScope", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.scopeId = :scopeId)"),
+        @NamedQuery(name="deleteUserConsentClientScopesByClient", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.clientId = :clientId)"),
+        @NamedQuery(name="deleteUserConsentClientScopesByExternalClient", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
+        @NamedQuery(name="deleteUserConsentClientScopesByClientStorageProvider", query="delete from UserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
+})
+@Entity
+@Table(name="USER_CONSENT_CLIENT_SCOPE")
+@IdClass(UserConsentClientScopeEntity.Key.class)
+public class UserConsentClientScopeEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "USER_CONSENT_ID")
+    protected UserConsentEntity userConsent;
+
+    @Id
+    @Column(name="SCOPE_ID")
+    protected String scopeId;
+
+    public UserConsentEntity getUserConsent() {
+        return userConsent;
+    }
+
+    public void setUserConsent(UserConsentEntity userConsent) {
+        this.userConsent = userConsent;
+    }
+
+    public String getScopeId() {
+        return scopeId;
+    }
+
+    public void setScopeId(String scopeId) {
+        this.scopeId = scopeId;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        if (!(o instanceof UserConsentClientScopeEntity)) return false;
+
+        UserConsentClientScopeEntity that = (UserConsentClientScopeEntity)o;
+        UserConsentClientScopeEntity.Key myKey = new UserConsentClientScopeEntity.Key(this.userConsent, this.scopeId);
+        UserConsentClientScopeEntity.Key hisKey = new UserConsentClientScopeEntity.Key(that.userConsent, that.scopeId);
+        return myKey.equals(hisKey);
+    }
+
+    @Override
+    public int hashCode() {
+        UserConsentClientScopeEntity.Key myKey = new UserConsentClientScopeEntity.Key(this.userConsent, this.scopeId);
+        return myKey.hashCode();
+    }
+
+    public static class Key implements Serializable {
+
+        protected UserConsentEntity userConsent;
+
+        protected String scopeId;
+
+        public Key() {
+        }
+
+        public Key(UserConsentEntity userConsent, String scopeId) {
+            this.userConsent = userConsent;
+            this.scopeId = scopeId;
+        }
+
+        public UserConsentEntity getUserConsent() {
+            return userConsent;
+        }
+
+        public String getScopeId() {
+            return scopeId;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            UserConsentClientScopeEntity.Key key = (UserConsentClientScopeEntity.Key) o;
+
+            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
+            if (scopeId != null ? !scopeId.equals(key.scopeId) : key.scopeId != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
+            result = 31 * result + (scopeId != null ? scopeId.hashCode() : 0);
+            return result;
+        }
+    }
+}

model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserConsentEntity.java

@@ -73,10 +73,7 @@ public class UserConsentEntity {
     protected String externalClientId;
 
     @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "userConsent")
-    Collection<UserConsentRoleEntity> grantedRoles = new ArrayList<UserConsentRoleEntity>();
-
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "userConsent")
-    Collection<UserConsentProtocolMapperEntity> grantedProtocolMappers = new ArrayList<UserConsentProtocolMapperEntity>();
+    Collection<UserConsentClientScopeEntity> grantedClientScopes = new ArrayList<>();
 
     @Column(name = "CREATED_DATE")
     private Long createdDate;
@@ -100,20 +97,12 @@ public class UserConsentEntity {
         this.user = user;
     }
 
-    public Collection<UserConsentRoleEntity> getGrantedRoles() {
-        return grantedRoles;
+    public Collection<UserConsentClientScopeEntity> getGrantedClientScopes() {
+        return grantedClientScopes;
     }
 
-    public void setGrantedRoles(Collection<UserConsentRoleEntity> grantedRoles) {
-        this.grantedRoles = grantedRoles;
-    }
-
-    public Collection<UserConsentProtocolMapperEntity> getGrantedProtocolMappers() {
-        return grantedProtocolMappers;
-    }
-
-    public void setGrantedProtocolMappers(Collection<UserConsentProtocolMapperEntity> grantedProtocolMappers) {
-        this.grantedProtocolMappers = grantedProtocolMappers;
+    public void setGrantedClientScopes(Collection<UserConsentClientScopeEntity> grantedClientScopes) {
+        this.grantedClientScopes = grantedClientScopes;
     }
 
     public Long getCreatedDate() {

model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserConsentProtocolMapperEntity.java

@@ -1,137 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.jpa.entities;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.FetchType;
-import javax.persistence.Id;
-import javax.persistence.IdClass;
-import javax.persistence.JoinColumn;
-import javax.persistence.ManyToOne;
-import javax.persistence.NamedQueries;
-import javax.persistence.NamedQuery;
-import javax.persistence.Table;
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@NamedQueries({
-        @NamedQuery(name="deleteUserConsentProtMappersByRealm", query=
-                "delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select user from UserEntity user where user.realmId = :realmId))"),
-        @NamedQuery(name="deleteUserConsentProtMappersByUser", query="delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.user = :user)"),
-        @NamedQuery(name="deleteUserConsentProtMappersByRealmAndLink", query="delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select u from UserEntity u where u.realmId=:realmId and u.federationLink=:link))"),
-        @NamedQuery(name="deleteUserConsentProtMappersByProtocolMapper", query="delete from UserConsentProtocolMapperEntity csm where csm.protocolMapperId = :protocolMapperId)"),
-        @NamedQuery(name="deleteUserConsentProtMappersByClient", query="delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.clientId = :clientId)"),
-        @NamedQuery(name="deleteUserConsentProtMappersByExternalClient", query="delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
-        @NamedQuery(name="deleteUserConsentProtMappersByClientStorageProvider", query="delete from UserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
-})
-@Entity
-@Table(name="USER_CONSENT_PROT_MAPPER")
-@IdClass(UserConsentProtocolMapperEntity.Key.class)
-public class UserConsentProtocolMapperEntity {
-
-    @Id
-    @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name = "USER_CONSENT_ID")
-    protected UserConsentEntity userConsent;
-
-    @Id
-    @Column(name="PROTOCOL_MAPPER_ID")
-    protected String protocolMapperId;
-
-    public UserConsentEntity getUserConsent() {
-        return userConsent;
-    }
-
-    public void setUserConsent(UserConsentEntity userConsent) {
-        this.userConsent = userConsent;
-    }
-
-    public String getProtocolMapperId() {
-        return protocolMapperId;
-    }
-
-    public void setProtocolMapperId(String protocolMapperId) {
-        this.protocolMapperId = protocolMapperId;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null) return false;
-        if (!(o instanceof UserConsentProtocolMapperEntity)) return false;
-
-        UserConsentProtocolMapperEntity that = (UserConsentProtocolMapperEntity)o;
-        Key myKey = new Key(this.userConsent, this.protocolMapperId);
-        Key hisKey = new Key(that.userConsent, that.protocolMapperId);
-        return myKey.equals(hisKey);
-    }
-
-    @Override
-    public int hashCode() {
-        Key myKey = new Key(this.userConsent, this.protocolMapperId);
-        return myKey.hashCode();
-    }
-
-    public static class Key implements Serializable {
-
-        protected UserConsentEntity userConsent;
-
-        protected String protocolMapperId;
-
-        public Key() {
-        }
-
-        public Key(UserConsentEntity userConsent, String protocolMapperId) {
-            this.userConsent = userConsent;
-            this.protocolMapperId = protocolMapperId;
-        }
-
-        public UserConsentEntity getUserConsent() {
-            return userConsent;
-        }
-
-        public String getProtocolMapperId() {
-            return protocolMapperId;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) return true;
-            if (o == null || getClass() != o.getClass()) return false;
-
-            Key key = (Key) o;
-
-            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
-            if (protocolMapperId != null ? !protocolMapperId.equals(key.protocolMapperId) : key.protocolMapperId != null) return false;
-
-            return true;
-        }
-
-        @Override
-        public int hashCode() {
-            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
-            result = 31 * result + (protocolMapperId != null ? protocolMapperId.hashCode() : 0);
-            return result;
-        }
-    }
-
-
-}

model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserConsentRoleEntity.java

@@ -1,135 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.models.jpa.entities;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.FetchType;
-import javax.persistence.Id;
-import javax.persistence.IdClass;
-import javax.persistence.JoinColumn;
-import javax.persistence.ManyToOne;
-import javax.persistence.NamedQueries;
-import javax.persistence.NamedQuery;
-import javax.persistence.Table;
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@NamedQueries({
-        @NamedQuery(name="deleteUserConsentRolesByRealm", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select user from UserEntity user where user.realmId = :realmId))"),
-        @NamedQuery(name="deleteUserConsentRolesByRealmAndLink", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.user IN (select u from UserEntity u where u.realmId=:realmId and u.federationLink=:link))"),
-        @NamedQuery(name="deleteUserConsentRolesByUser", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.user = :user)"),
-        @NamedQuery(name="deleteUserConsentRolesByRole", query="delete from UserConsentRoleEntity grantedRole where grantedRole.roleId = :roleId)"),
-        @NamedQuery(name="deleteUserConsentRolesByClient", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.clientId = :clientId)"),
-        @NamedQuery(name="deleteUserConsentRolesByExternalClient", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
-        @NamedQuery(name="deleteUserConsentRolesByClientStorageProvider", query="delete from UserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from UserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
-})
-@Entity
-@Table(name="USER_CONSENT_ROLE")
-@IdClass(UserConsentRoleEntity.Key.class)
-public class UserConsentRoleEntity {
-
-    @Id
-    @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name = "USER_CONSENT_ID")
-    protected UserConsentEntity userConsent;
-
-    @Id
-    @Column(name="ROLE_ID")
-    protected String roleId;
-
-    public UserConsentEntity getUserConsent() {
-        return userConsent;
-    }
-
-    public void setUserConsent(UserConsentEntity userConsent) {
-        this.userConsent = userConsent;
-    }
-
-    public String getRoleId() {
-        return roleId;
-    }
-
-    public void setRoleId(String roleId) {
-        this.roleId = roleId;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null) return false;
-        if (!(o instanceof UserConsentRoleEntity)) return false;
-
-        UserConsentRoleEntity that = (UserConsentRoleEntity)o;
-        Key myKey = new Key(this.userConsent, this.roleId);
-        Key hisKey = new Key(that.userConsent, that.roleId);
-        return myKey.equals(hisKey);
-    }
-
-    @Override
-    public int hashCode() {
-        Key myKey = new Key(this.userConsent, this.roleId);
-        return myKey.hashCode();
-    }
-
-    public static class Key implements Serializable {
-
-        protected UserConsentEntity userConsent;
-
-        protected String roleId;
-
-        public Key() {
-        }
-
-        public Key(UserConsentEntity userConsent, String roleId) {
-            this.userConsent = userConsent;
-            this.roleId = roleId;
-        }
-
-        public UserConsentEntity getUserConsent() {
-            return userConsent;
-        }
-
-        public String getRoleId() {
-            return roleId;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) return true;
-            if (o == null || getClass() != o.getClass()) return false;
-
-            Key key = (Key) o;
-
-            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
-            if (roleId != null ? !roleId.equals(key.roleId) : key.roleId != null) return false;
-
-            return true;
-        }
-
-        @Override
-        public int hashCode() {
-            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
-            result = 31 * result + (roleId != null ? roleId.hashCode() : 0);
-            return result;
-        }
-    }
-
-}

model/jpa/src/main/java/org/keycloak/storage/jpa/JpaUserFederatedStorageProvider.java

@@ -22,6 +22,7 @@ import org.keycloak.component.ComponentModel;
 import org.keycloak.credential.CredentialModel;
 import org.keycloak.credential.UserCredentialStore;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.ClientScopeModel;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.GroupModel;
 import org.keycloak.models.KeycloakSession;
@@ -32,7 +33,6 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserConsentModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.models.jpa.entities.UserConsentEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.UserStorageProvider;
@@ -41,9 +41,8 @@ import org.keycloak.storage.federated.UserFederatedStorageProvider;
 import org.keycloak.storage.jpa.entity.BrokerLinkEntity;
 import org.keycloak.storage.jpa.entity.FederatedUser;
 import org.keycloak.storage.jpa.entity.FederatedUserAttributeEntity;
+import org.keycloak.storage.jpa.entity.FederatedUserConsentClientScopeEntity;
 import org.keycloak.storage.jpa.entity.FederatedUserConsentEntity;
-import org.keycloak.storage.jpa.entity.FederatedUserConsentProtocolMapperEntity;
-import org.keycloak.storage.jpa.entity.FederatedUserConsentRoleEntity;
 import org.keycloak.storage.jpa.entity.FederatedUserCredentialAttributeEntity;
 import org.keycloak.storage.jpa.entity.FederatedUserCredentialEntity;
 import org.keycloak.storage.jpa.entity.FederatedUserGroupMembershipEntity;
@@ -361,71 +360,41 @@ public class JpaUserFederatedStorageProvider implements
         model.setCreatedDate(entity.getCreatedDate());
         model.setLastUpdatedDate(entity.getLastUpdatedDate());
 
-        Collection<FederatedUserConsentRoleEntity> grantedRoleEntities = entity.getGrantedRoles();
-        if (grantedRoleEntities != null) {
-            for (FederatedUserConsentRoleEntity grantedRole : grantedRoleEntities) {
-                RoleModel grantedRoleModel = realm.getRoleById(grantedRole.getRoleId());
-                if (grantedRoleModel != null) {
-                    model.addGrantedRole(grantedRoleModel);
+        Collection<FederatedUserConsentClientScopeEntity> grantedClientScopeEntities = entity.getGrantedClientScopes();
+        if (grantedClientScopeEntities != null) {
+            for (FederatedUserConsentClientScopeEntity grantedClientScope : grantedClientScopeEntities) {
+                ClientScopeModel grantedClientScopeModel = realm.getClientScopeById(grantedClientScope.getScopeId());
+                if (grantedClientScopeModel != null) {
+                    model.addGrantedClientScope(grantedClientScopeModel);
                 }
             }
         }
 
-        Collection<FederatedUserConsentProtocolMapperEntity> grantedProtocolMapperEntities = entity.getGrantedProtocolMappers();
-        if (grantedProtocolMapperEntities != null) {
-            for (FederatedUserConsentProtocolMapperEntity grantedProtMapper : grantedProtocolMapperEntities) {
-                ProtocolMapperModel protocolMapper = client.getProtocolMapperById(grantedProtMapper.getProtocolMapperId());
-                model.addGrantedProtocolMapper(protocolMapper);
-            }
-        }
-
         return model;
     }
 
     // Update roles and protocolMappers to given consentEntity from the consentModel
     private void updateGrantedConsentEntity(FederatedUserConsentEntity consentEntity, UserConsentModel consentModel) {
-        Collection<FederatedUserConsentProtocolMapperEntity> grantedProtocolMapperEntities = consentEntity.getGrantedProtocolMappers();
-        Collection<FederatedUserConsentProtocolMapperEntity> mappersToRemove = new HashSet<>(grantedProtocolMapperEntities);
+        Collection<FederatedUserConsentClientScopeEntity> grantedClientScopeEntities = consentEntity.getGrantedClientScopes();
+        Collection<FederatedUserConsentClientScopeEntity> scopesToRemove = new HashSet<>(grantedClientScopeEntities);
 
-        for (ProtocolMapperModel protocolMapper : consentModel.getGrantedProtocolMappers()) {
-            FederatedUserConsentProtocolMapperEntity grantedProtocolMapperEntity = new FederatedUserConsentProtocolMapperEntity();
-            grantedProtocolMapperEntity.setUserConsent(consentEntity);
-            grantedProtocolMapperEntity.setProtocolMapperId(protocolMapper.getId());
+        for (ClientScopeModel clientScope : consentModel.getGrantedClientScopes()) {
+            FederatedUserConsentClientScopeEntity grantedClientScopeEntity = new FederatedUserConsentClientScopeEntity();
+            grantedClientScopeEntity.setUserConsent(consentEntity);
+            grantedClientScopeEntity.setScopeId(clientScope.getId());
 
             // Check if it's already there
-            if (!grantedProtocolMapperEntities.contains(grantedProtocolMapperEntity)) {
-                em.persist(grantedProtocolMapperEntity);
+            if (!grantedClientScopeEntities.contains(grantedClientScopeEntity)) {
+                em.persist(grantedClientScopeEntity);
                 em.flush();
-                grantedProtocolMapperEntities.add(grantedProtocolMapperEntity);
+                grantedClientScopeEntities.add(grantedClientScopeEntity);
             } else {
-                mappersToRemove.remove(grantedProtocolMapperEntity);
+                scopesToRemove.remove(grantedClientScopeEntity);
             }
         }
         // Those mappers were no longer on consentModel and will be removed
-        for (FederatedUserConsentProtocolMapperEntity toRemove : mappersToRemove) {
-            grantedProtocolMapperEntities.remove(toRemove);
-            em.remove(toRemove);
-        }
-
-        Collection<FederatedUserConsentRoleEntity> grantedRoleEntities = consentEntity.getGrantedRoles();
-        Set<FederatedUserConsentRoleEntity> rolesToRemove = new HashSet<>(grantedRoleEntities);
-        for (RoleModel role : consentModel.getGrantedRoles()) {
-            FederatedUserConsentRoleEntity consentRoleEntity = new FederatedUserConsentRoleEntity();
-            consentRoleEntity.setUserConsent(consentEntity);
-            consentRoleEntity.setRoleId(role.getId());
-
-            // Check if it's already there
-            if (!grantedRoleEntities.contains(consentRoleEntity)) {
-                em.persist(consentRoleEntity);
-                em.flush();
-                grantedRoleEntities.add(consentRoleEntity);
-            } else {
-                rolesToRemove.remove(consentRoleEntity);
-            }
-        }
-        // Those roles were no longer on consentModel and will be removed
-        for (FederatedUserConsentRoleEntity toRemove : rolesToRemove) {
-            grantedRoleEntities.remove(toRemove);
+        for (FederatedUserConsentClientScopeEntity toRemove : scopesToRemove) {
+            grantedClientScopeEntities.remove(toRemove);
             em.remove(toRemove);
         }
 
@@ -804,9 +773,7 @@ public class JpaUserFederatedStorageProvider implements
 
     @Override
     public void preRemove(RealmModel realm) {
-        int num = em.createNamedQuery("deleteFederatedUserConsentRolesByRealm")
-                .setParameter("realmId", realm.getId()).executeUpdate();
-        num = em.createNamedQuery("deleteFederatedUserConsentProtMappersByRealm")
+        int num = em.createNamedQuery("deleteFederatedUserConsentClientScopesByRealm")
                 .setParameter("realmId", realm.getId()).executeUpdate();
         num = em.createNamedQuery("deleteFederatedUserConsentsByRealm")
                 .setParameter("realmId", realm.getId()).executeUpdate();
@@ -831,7 +798,6 @@ public class JpaUserFederatedStorageProvider implements
     @Override
     public void preRemove(RealmModel realm, RoleModel role) {
         em.createNamedQuery("deleteFederatedUserRoleMappingsByRole").setParameter("roleId", role.getId()).executeUpdate();
-        em.createNamedQuery("deleteFederatedUserRoleMappingsByRole").setParameter("roleId", role.getId()).executeUpdate();
     }
 
     @Override
@@ -843,15 +809,10 @@ public class JpaUserFederatedStorageProvider implements
     public void preRemove(RealmModel realm, ClientModel client) {
         StorageId clientStorageId = new StorageId(client.getId());
         if (clientStorageId.isLocal()) {
-            em.createNamedQuery("deleteFederatedUserConsentProtMappersByClient").setParameter("clientId", client.getId()).executeUpdate();
-            em.createNamedQuery("deleteFederatedUserConsentRolesByClient").setParameter("clientId", client.getId()).executeUpdate();
+            em.createNamedQuery("deleteFederatedUserConsentClientScopesByClient").setParameter("clientId", client.getId()).executeUpdate();
             em.createNamedQuery("deleteFederatedUserConsentsByClient").setParameter("clientId", client.getId()).executeUpdate();
         } else {
-            em.createNamedQuery("deleteFederatedUserConsentProtMappersByExternalClient")
-                    .setParameter("clientStorageProvider", clientStorageId.getProviderId())
-                    .setParameter("externalClientId",clientStorageId.getExternalId())
-                    .executeUpdate();
-            em.createNamedQuery("deleteFederatedUserConsentRolesByExternalClient")
+            em.createNamedQuery("deleteFederatedUserConsentClientScopesByExternalClient")
                     .setParameter("clientStorageProvider", clientStorageId.getProviderId())
                     .setParameter("externalClientId",clientStorageId.getExternalId())
                     .executeUpdate();
@@ -865,8 +826,13 @@ public class JpaUserFederatedStorageProvider implements
 
     @Override
     public void preRemove(ProtocolMapperModel protocolMapper) {
-        em.createNamedQuery("deleteFederatedUserConsentProtMappersByProtocolMapper")
-                .setParameter("protocolMapperId", protocolMapper.getId())
+        // No op
+    }
+
+    @Override
+    public void preRemove(ClientScopeModel clientScope) {
+        em.createNamedQuery("deleteFederatedUserConsentClientScopesByClientScope")
+                .setParameter("scopeId", clientScope.getId())
                 .executeUpdate();
     }
 
@@ -880,11 +846,7 @@ public class JpaUserFederatedStorageProvider implements
                 .setParameter("userId", user.getId())
                 .setParameter("realmId", realm.getId())
                 .executeUpdate();
-        em.createNamedQuery("deleteFederatedUserConsentProtMappersByUser")
-                .setParameter("userId", user.getId())
-                .setParameter("realmId", realm.getId())
-                .executeUpdate();
-        em.createNamedQuery("deleteFederatedUserConsentRolesByUser")
+        em.createNamedQuery("deleteFederatedUserConsentClientScopesByUser")
                 .setParameter("userId", user.getId())
                 .setParameter("realmId", realm.getId())
                 .executeUpdate();
@@ -929,10 +891,7 @@ public class JpaUserFederatedStorageProvider implements
             em.createNamedQuery("deleteFederatedAttributesByStorageProvider")
                     .setParameter("storageProviderId", model.getId())
                     .executeUpdate();
-            em.createNamedQuery("deleteFederatedUserConsentProtMappersByStorageProvider")
-                    .setParameter("storageProviderId", model.getId())
-                    .executeUpdate();
-            em.createNamedQuery("deleteFederatedUserRoleMappingsByStorageProvider")
+            em.createNamedQuery("deleteFederatedUserConsentClientScopesByStorageProvider")
                     .setParameter("storageProviderId", model.getId())
                     .executeUpdate();
             em.createNamedQuery("deleteFederatedUserConsentsByStorageProvider")
@@ -957,10 +916,7 @@ public class JpaUserFederatedStorageProvider implements
                     .setParameter("storageProviderId", model.getId())
                     .executeUpdate();
         } else if (model.getProviderType().equals(ClientStorageProvider.class.getName())) {
-            em.createNamedQuery("deleteFederatedUserConsentProtMappersByClientStorageProvider")
-                    .setParameter("clientStorageProvider", model.getId())
-                    .executeUpdate();
-            em.createNamedQuery("deleteFederatedUserConsentRolesByClientStorageProvider")
+            em.createNamedQuery("deleteFederatedUserConsentClientScopesByClientStorageProvider")
                     .setParameter("clientStorageProvider",  model.getId())
                     .executeUpdate();
             em.createNamedQuery("deleteFederatedUserConsentsByClientStorageProvider")

model/jpa/src/main/java/org/keycloak/storage/jpa/entity/FederatedUserConsentClientScopeEntity.java

@@ -0,0 +1,135 @@
+/*
+ * Copyright 2017 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.storage.jpa.entity;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@NamedQueries({
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByRealm", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.realmId = :realmId)"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByUser", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.userId = :userId and consent.realmId = :realmId)"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByStorageProvider", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.storageProviderId = :storageProviderId)"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByClientScope", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.scopeId = :scopeId"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByClient", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientId = :clientId)"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByExternalClient", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
+        @NamedQuery(name="deleteFederatedUserConsentClientScopesByClientStorageProvider", query="delete from FederatedUserConsentClientScopeEntity grantedScope where grantedScope.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
+})
+@Entity
+@Table(name="FED_USER_CONSENT_CL_SCOPE")
+@IdClass(FederatedUserConsentClientScopeEntity.Key.class)
+public class FederatedUserConsentClientScopeEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "USER_CONSENT_ID")
+    protected FederatedUserConsentEntity userConsent;
+
+    @Id
+    @Column(name="SCOPE_ID")
+    protected String scopeId;
+
+    public FederatedUserConsentEntity getUserConsent() {
+        return userConsent;
+    }
+
+    public void setUserConsent(FederatedUserConsentEntity userConsent) {
+        this.userConsent = userConsent;
+    }
+
+    public String getScopeId() {
+        return scopeId;
+    }
+
+    public void setScopeId(String scopeId) {
+        this.scopeId = scopeId;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        if (!(o instanceof  FederatedUserConsentClientScopeEntity)) return false;
+
+        FederatedUserConsentClientScopeEntity that = ( FederatedUserConsentClientScopeEntity)o;
+        FederatedUserConsentClientScopeEntity.Key myKey = new  FederatedUserConsentClientScopeEntity.Key(this.userConsent, this.scopeId);
+        FederatedUserConsentClientScopeEntity.Key hisKey = new  FederatedUserConsentClientScopeEntity.Key(that.userConsent, that.scopeId);
+        return myKey.equals(hisKey);
+    }
+
+    @Override
+    public int hashCode() {
+        FederatedUserConsentClientScopeEntity.Key myKey = new FederatedUserConsentClientScopeEntity.Key(this.userConsent, this.scopeId);
+        return myKey.hashCode();
+    }
+
+    public static class Key implements Serializable {
+
+        protected FederatedUserConsentEntity userConsent;
+
+        protected String scopeId;
+
+        public Key() {
+        }
+
+        public Key(FederatedUserConsentEntity userConsent, String scopeId) {
+            this.userConsent = userConsent;
+            this.scopeId = scopeId;
+        }
+
+        public FederatedUserConsentEntity getUserConsent() {
+            return userConsent;
+        }
+
+        public String getScopeId() {
+            return scopeId;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            FederatedUserConsentClientScopeEntity.Key key = (FederatedUserConsentClientScopeEntity.Key) o;
+
+            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
+            if (scopeId != null ? !scopeId.equals(key.scopeId) : key.scopeId != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
+            result = 31 * result + (scopeId != null ? scopeId.hashCode() : 0);
+            return result;
+        }
+    }
+}

model/jpa/src/main/java/org/keycloak/storage/jpa/entity/FederatedUserConsentEntity.java

@@ -83,10 +83,7 @@ public class FederatedUserConsentEntity {
 
 
     @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "userConsent")
-    Collection<FederatedUserConsentRoleEntity> grantedRoles = new ArrayList<FederatedUserConsentRoleEntity>();
-
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "userConsent")
-    Collection<FederatedUserConsentProtocolMapperEntity> grantedProtocolMappers = new ArrayList<FederatedUserConsentProtocolMapperEntity>();
+    Collection<FederatedUserConsentClientScopeEntity> grantedClientScopes = new ArrayList<>();
 
     public String getId() {
         return id;
@@ -144,20 +141,12 @@ public class FederatedUserConsentEntity {
         this.externalClientId = externalClientId;
     }
 
-    public Collection<FederatedUserConsentRoleEntity> getGrantedRoles() {
-        return grantedRoles;
+    public Collection<FederatedUserConsentClientScopeEntity> getGrantedClientScopes() {
+        return grantedClientScopes;
     }
 
-    public void setGrantedRoles(Collection<FederatedUserConsentRoleEntity> grantedRoles) {
-        this.grantedRoles = grantedRoles;
-    }
-
-    public Collection<FederatedUserConsentProtocolMapperEntity> getGrantedProtocolMappers() {
-        return grantedProtocolMappers;
-    }
-
-    public void setGrantedProtocolMappers(Collection<FederatedUserConsentProtocolMapperEntity> grantedProtocolMappers) {
-        this.grantedProtocolMappers = grantedProtocolMappers;
+    public void setGrantedClientScopes(Collection<FederatedUserConsentClientScopeEntity> grantedClientScopes) {
+        this.grantedClientScopes = grantedClientScopes;
     }
 
     public Long getCreatedDate() {

model/jpa/src/main/java/org/keycloak/storage/jpa/entity/FederatedUserConsentProtocolMapperEntity.java

@@ -1,137 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.storage.jpa.entity;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.FetchType;
-import javax.persistence.Id;
-import javax.persistence.IdClass;
-import javax.persistence.JoinColumn;
-import javax.persistence.ManyToOne;
-import javax.persistence.NamedQueries;
-import javax.persistence.NamedQuery;
-import javax.persistence.Table;
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@NamedQueries({
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByRealm", query=
-                "delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.realmId = :realmId)"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByUser", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.userId = :userId and consent.realmId = :realmId)"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByStorageProvider", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.storageProviderId = :storageProviderId)"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByProtocolMapper", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.protocolMapperId = :protocolMapperId"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByClient", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientId = :clientId)"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByExternalClient", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
-        @NamedQuery(name="deleteFederatedUserConsentProtMappersByClientStorageProvider", query="delete from FederatedUserConsentProtocolMapperEntity csm where csm.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
-})
-@Entity
-@Table(name="FED_USER_CONSENT_PROT_MAPPER")
-@IdClass(FederatedUserConsentProtocolMapperEntity.Key.class)
-public class FederatedUserConsentProtocolMapperEntity {
-
-    @Id
-    @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name = "USER_CONSENT_ID")
-    protected FederatedUserConsentEntity userConsent;
-
-    @Id
-    @Column(name="PROTOCOL_MAPPER_ID")
-    protected String protocolMapperId;
-
-    public FederatedUserConsentEntity getUserConsent() {
-        return userConsent;
-    }
-
-    public void setUserConsent(FederatedUserConsentEntity userConsent) {
-        this.userConsent = userConsent;
-    }
-
-    public String getProtocolMapperId() {
-        return protocolMapperId;
-    }
-
-    public void setProtocolMapperId(String protocolMapperId) {
-        this.protocolMapperId = protocolMapperId;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null) return false;
-        if (!(o instanceof FederatedUserConsentProtocolMapperEntity)) return false;
-
-        FederatedUserConsentProtocolMapperEntity that = (FederatedUserConsentProtocolMapperEntity)o;
-        Key myKey = new Key(this.userConsent, this.protocolMapperId);
-        Key hisKey = new Key(that.userConsent, that.protocolMapperId);
-        return myKey.equals(hisKey);
-    }
-
-    @Override
-    public int hashCode() {
-        Key myKey = new Key(this.userConsent, this.protocolMapperId);
-        return myKey.hashCode();
-    }
-
-    public static class Key implements Serializable {
-
-        protected FederatedUserConsentEntity userConsent;
-
-        protected String protocolMapperId;
-
-        public Key() {
-        }
-
-        public Key(FederatedUserConsentEntity userConsent, String protocolMapperId) {
-            this.userConsent = userConsent;
-            this.protocolMapperId = protocolMapperId;
-        }
-
-        public FederatedUserConsentEntity getUserConsent() {
-            return userConsent;
-        }
-
-        public String getProtocolMapperId() {
-            return protocolMapperId;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) return true;
-            if (o == null || getClass() != o.getClass()) return false;
-
-            Key key = (Key) o;
-
-            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
-            if (protocolMapperId != null ? !protocolMapperId.equals(key.protocolMapperId) : key.protocolMapperId != null) return false;
-
-            return true;
-        }
-
-        @Override
-        public int hashCode() {
-            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
-            result = 31 * result + (protocolMapperId != null ? protocolMapperId.hashCode() : 0);
-            return result;
-        }
-    }
-
-
-}

model/jpa/src/main/java/org/keycloak/storage/jpa/entity/FederatedUserConsentRoleEntity.java

@@ -1,135 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.storage.jpa.entity;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.FetchType;
-import javax.persistence.Id;
-import javax.persistence.IdClass;
-import javax.persistence.JoinColumn;
-import javax.persistence.ManyToOne;
-import javax.persistence.NamedQueries;
-import javax.persistence.NamedQuery;
-import javax.persistence.Table;
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-@NamedQueries({
-        @NamedQuery(name="deleteFederatedUserConsentRolesByRealm", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.realmId = :realmId)"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByUser", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.userId = :userId and consent.realmId = :realmId)"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByStorageProvider", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.storageProviderId = :storageProviderId)"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByRole", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.roleId = :roleId"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByClient", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientId = :clientId)"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByExternalClient", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider and consent.externalClientId = :externalClientId)"),
-        @NamedQuery(name="deleteFederatedUserConsentRolesByClientStorageProvider", query="delete from FederatedUserConsentRoleEntity grantedRole where grantedRole.userConsent IN (select consent from FederatedUserConsentEntity consent where consent.clientStorageProvider = :clientStorageProvider)"),
-})
-@Entity
-@Table(name="FED_USER_CONSENT_ROLE")
-@IdClass(FederatedUserConsentRoleEntity.Key.class)
-public class FederatedUserConsentRoleEntity {
-
-    @Id
-    @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name = "USER_CONSENT_ID")
-    protected FederatedUserConsentEntity userConsent;
-
-    @Id
-    @Column(name="ROLE_ID")
-    protected String roleId;
-
-    public FederatedUserConsentEntity getUserConsent() {
-        return userConsent;
-    }
-
-    public void setUserConsent(FederatedUserConsentEntity userConsent) {
-        this.userConsent = userConsent;
-    }
-
-    public String getRoleId() {
-        return roleId;
-    }
-
-    public void setRoleId(String roleId) {
-        this.roleId = roleId;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null) return false;
-        if (!(o instanceof FederatedUserConsentRoleEntity)) return false;
-
-        FederatedUserConsentRoleEntity that = (FederatedUserConsentRoleEntity)o;
-        Key myKey = new Key(this.userConsent, this.roleId);
-        Key hisKey = new Key(that.userConsent, that.roleId);
-        return myKey.equals(hisKey);
-    }
-
-    @Override
-    public int hashCode() {
-        Key myKey = new Key(this.userConsent, this.roleId);
-        return myKey.hashCode();
-    }
-
-    public static class Key implements Serializable {
-
-        protected FederatedUserConsentEntity userConsent;
-
-        protected String roleId;
-
-        public Key() {
-        }
-
-        public Key(FederatedUserConsentEntity userConsent, String roleId) {
-            this.userConsent = userConsent;
-            this.roleId = roleId;
-        }
-
-        public FederatedUserConsentEntity getUserConsent() {
-            return userConsent;
-        }
-
-        public String getRoleId() {
-            return roleId;
-        }
-
-        @Override
-        public boolean equals(Object o) {
-            if (this == o) return true;
-            if (o == null || getClass() != o.getClass()) return false;
-
-            Key key = (Key) o;
-
-            if (userConsent != null ? !userConsent.getId().equals(key.userConsent != null ? key.userConsent.getId() : null) : key.userConsent != null) return false;
-            if (roleId != null ? !roleId.equals(key.roleId) : key.roleId != null) return false;
-
-            return true;
-        }
-
-        @Override
-        public int hashCode() {
-            int result = userConsent != null ? userConsent.getId().hashCode() : 0;
-            result = 31 * result + (roleId != null ? roleId.hashCode() : 0);
-            return result;
-        }
-    }
-
-}

model/jpa/src/main/resources/META-INF/jpa-changelog-4.0.0.xml

@@ -84,4 +84,184 @@
         <addPrimaryKey columnNames="USER_SESSION_ID,CLIENT_ID, CLIENT_STORAGE_PROVIDER, EXTERNAL_CLIENT_ID, OFFLINE_FLAG" constraintName="CONSTRAINT_OFFL_CL_SES_PK3" tableName="OFFLINE_CLIENT_SESSION"/>
 
      </changeSet>
+
+    <changeSet author="mposolda@redhat.com" id="4.0.0-KEYCLOAK-5579">
+
+        <!-- 1 - Rename clientTemplate to clientScope and drop some unused things from clientTemplate -->
+        <dropForeignKeyConstraint baseTableName="CLIENT_TEMPLATE_ATTRIBUTES" constraintName="FK_CL_TEMPL_ATTR_TEMPL" />
+        <renameTable oldTableName="CLIENT_TEMPLATE_ATTRIBUTES" newTableName="CLIENT_SCOPE_ATTRIBUTES" />
+        <renameColumn tableName="CLIENT_SCOPE_ATTRIBUTES" newColumnName="SCOPE_ID" oldColumnName="TEMPLATE_ID" columnDataType="VARCHAR(36)" />
+
+        <dropForeignKeyConstraint baseTableName="TEMPLATE_SCOPE_MAPPING" constraintName="FK_TEMPL_SCOPE_TEMPL" />
+        <dropForeignKeyConstraint baseTableName="TEMPLATE_SCOPE_MAPPING" constraintName="FK_TEMPL_SCOPE_ROLE" />
+        <renameTable oldTableName="TEMPLATE_SCOPE_MAPPING" newTableName="CLIENT_SCOPE_ROLE_MAPPING" />
+        <renameColumn tableName="CLIENT_SCOPE_ROLE_MAPPING" newColumnName="SCOPE_ID" oldColumnName="TEMPLATE_ID" columnDataType="VARCHAR(36)" />
+
+        <dropForeignKeyConstraint baseTableName="CLIENT" constraintName="FK_CLI_TMPLT_CLIENT" />
+
+        <dropForeignKeyConstraint baseTableName="PROTOCOL_MAPPER" constraintName="FK_CLI_TMPLT_MAPPER" />
+        <renameColumn tableName="PROTOCOL_MAPPER" newColumnName="CLIENT_SCOPE_ID" oldColumnName="CLIENT_TEMPLATE_ID" columnDataType="VARCHAR(36)" />
+
+        <dropForeignKeyConstraint baseTableName="CLIENT_TEMPLATE" constraintName="FK_REALM_CLI_TMPLT" />
+        <dropUniqueConstraint constraintName="UK_CLI_TEMPLATE" tableName="CLIENT_TEMPLATE"/>
+
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="FULL_SCOPE_ALLOWED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="CONSENT_REQUIRED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="STANDARD_FLOW_ENABLED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="IMPLICIT_FLOW_ENABLED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="DIRECT_ACCESS_GRANTS_ENABLED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="SERVICE_ACCOUNTS_ENABLED" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="FRONTCHANNEL_LOGOUT" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="BEARER_ONLY" />
+        <dropDefaultValue tableName="CLIENT_TEMPLATE" columnName="PUBLIC_CLIENT" />
+        
+        <dropIndex tableName="CLIENT_SCOPE_ROLE_MAPPING" indexName="IDX_TEMPL_SCOPE_MAPP_ROLE" />
+        <dropIndex tableName="PROTOCOL_MAPPER" indexName="IDX_PROTO_MAPP_CLIENT_TEMPL" />
+        <dropIndex tableName="CLIENT" indexName="IDX_CLIENT_CLIENT_TEMPL_ID" />
+
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="FULL_SCOPE_ALLOWED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="CONSENT_REQUIRED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="STANDARD_FLOW_ENABLED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="IMPLICIT_FLOW_ENABLED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="DIRECT_ACCESS_GRANTS_ENABLED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="SERVICE_ACCOUNTS_ENABLED" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="FRONTCHANNEL_LOGOUT" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="BEARER_ONLY" />
+        <dropColumn tableName="CLIENT_TEMPLATE" columnName="PUBLIC_CLIENT" />
+
+        <renameTable oldTableName="CLIENT_TEMPLATE" newTableName="CLIENT_SCOPE" />
+
+        <addUniqueConstraint columnNames="REALM_ID,NAME" constraintName="UK_CLI_SCOPE" tableName="CLIENT_SCOPE"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="CLIENT_SCOPE"
+                                 constraintName="FK_REALM_CLI_SCOPE" referencedColumnNames="ID" referencedTableName="REALM"/>
+
+        <addForeignKeyConstraint baseColumnNames="CLIENT_SCOPE_ID" baseTableName="PROTOCOL_MAPPER"
+                                 constraintName="FK_CLI_SCOPE_MAPPER" referencedColumnNames="ID" referencedTableName="CLIENT_SCOPE"/>
+
+        <addForeignKeyConstraint baseColumnNames="SCOPE_ID" baseTableName="CLIENT_SCOPE_ROLE_MAPPING"
+                                 constraintName="FK_CL_SCOPE_RM_SCOPE" referencedColumnNames="ID" referencedTableName="CLIENT_SCOPE"/>
+        <addForeignKeyConstraint baseColumnNames="ROLE_ID" baseTableName="CLIENT_SCOPE_ROLE_MAPPING"
+                                 constraintName="FK_CL_SCOPE_RM_ROLE" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+
+        <addForeignKeyConstraint baseTableName="CLIENT_SCOPE_ATTRIBUTES" baseColumnNames="SCOPE_ID"
+                                 constraintName="FK_CL_SCOPE_ATTR_SCOPE" referencedTableName="CLIENT_SCOPE" referencedColumnNames="ID" />
+
+        <!-- 2 - Client binding to more clientScopes -->
+        <!-- Foreign key dropped above TODO:mposolda migration existing clientTemplate to default clientScope -->
+        <dropColumn tableName="CLIENT" columnName="CLIENT_TEMPLATE_ID" />
+        <dropDefaultValue tableName="CLIENT" columnName="USE_TEMPLATE_CONFIG"/>
+        <dropDefaultValue tableName="CLIENT" columnName="USE_TEMPLATE_SCOPE" />
+        <dropDefaultValue tableName="CLIENT" columnName="USE_TEMPLATE_MAPPERS" />
+        <dropColumn tableName="CLIENT" columnName="USE_TEMPLATE_CONFIG" />
+        <dropColumn tableName="CLIENT" columnName="USE_TEMPLATE_SCOPE" />
+        <dropColumn tableName="CLIENT" columnName="USE_TEMPLATE_MAPPERS" />
+
+        <createTable tableName="CLIENT_SCOPE_CLIENT">
+            <column name="CLIENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SCOPE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="DEFAULT_SCOPE" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addPrimaryKey columnNames="CLIENT_ID, SCOPE_ID" constraintName="C_CLI_SCOPE_BIND" tableName="CLIENT_SCOPE_CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_ID" baseTableName="CLIENT_SCOPE_CLIENT" constraintName="FK_C_CLI_SCOPE_CLIENT" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="SCOPE_ID" baseTableName="CLIENT_SCOPE_CLIENT" constraintName="FK_C_CLI_SCOPE_SCOPE" referencedColumnNames="ID" referencedTableName="CLIENT_SCOPE"/>
+
+        <!-- Default client scopes (global scopes configured at realm level) -->
+        <createTable tableName="DEFAULT_CLIENT_SCOPE">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SCOPE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="DEFAULT_SCOPE" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addPrimaryKey columnNames="REALM_ID, SCOPE_ID" constraintName="R_DEF_CLI_SCOPE_BIND" tableName="DEFAULT_CLIENT_SCOPE"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="DEFAULT_CLIENT_SCOPE" constraintName="FK_R_DEF_CLI_SCOPE_REALM" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="SCOPE_ID" baseTableName="DEFAULT_CLIENT_SCOPE" constraintName="FK_R_DEF_CLI_SCOPE_SCOPE" referencedColumnNames="ID" referencedTableName="CLIENT_SCOPE"/>
+
+        <!-- Remove scopeParamRequired -->
+        <dropDefaultValue tableName="KEYCLOAK_ROLE" columnName="SCOPE_PARAM_REQUIRED" />
+        <dropColumn tableName="KEYCLOAK_ROLE" columnName="SCOPE_PARAM_REQUIRED" />
+
+        <!-- Drop consent stuff from protocolMappers table -->
+        <dropDefaultValue tableName="PROTOCOL_MAPPER" columnName="CONSENT_REQUIRED" />
+        <dropColumn tableName="PROTOCOL_MAPPER" columnName="CONSENT_REQUIRED" />
+        <dropColumn tableName="PROTOCOL_MAPPER" columnName="CONSENT_TEXT" />
+
+        <!-- Consents related changes -->
+        <dropForeignKeyConstraint baseTableName="USER_CONSENT_ROLE" constraintName="FK_GRNTCSNT_ROLE_GR" />
+        <dropTable tableName="USER_CONSENT_ROLE" />
+        <dropForeignKeyConstraint baseTableName="USER_CONSENT_PROT_MAPPER" constraintName="FK_GRNTCSNT_PRM_GR" />
+        <dropTable tableName="USER_CONSENT_PROT_MAPPER" />
+
+        <createTable tableName="USER_CONSENT_CLIENT_SCOPE">
+            <column name="USER_CONSENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SCOPE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addPrimaryKey columnNames="USER_CONSENT_ID, SCOPE_ID" constraintName="CONSTRAINT_GRNTCSNT_CLSC_PM" tableName="USER_CONSENT_CLIENT_SCOPE"/>
+        <addForeignKeyConstraint baseColumnNames="USER_CONSENT_ID" baseTableName="USER_CONSENT_CLIENT_SCOPE" constraintName="FK_GRNTCSNT_CLSC_USC" referencedColumnNames="ID" referencedTableName="USER_CONSENT"/>
+
+        <!-- Federated consents related changes -->
+        <dropTable tableName="FED_USER_CONSENT_ROLE" />
+        <dropTable tableName="FED_USER_CONSENT_PROT_MAPPER" />
+
+        <createTable tableName="FED_USER_CONSENT_CL_SCOPE">
+            <column name="USER_CONSENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SCOPE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addPrimaryKey columnNames="USER_CONSENT_ID, SCOPE_ID" constraintName="CONSTRAINT_FGRNTCSNT_CLSC_PM" tableName="FED_USER_CONSENT_CL_SCOPE"/>
+
+        <!-- Indexes for foreign keys -->
+        <createIndex indexName="IDX_REALM_CLSCOPE" tableName="CLIENT_SCOPE">
+            <column name="REALM_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_CLSCOPE_PROTMAP" tableName="PROTOCOL_MAPPER">
+            <column name="CLIENT_SCOPE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_CLSCOPE_ROLE" tableName="CLIENT_SCOPE_ROLE_MAPPING">
+            <column name="SCOPE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_ROLE_CLSCOPE" tableName="CLIENT_SCOPE_ROLE_MAPPING">
+            <column name="ROLE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_CLSCOPE_ATTRS" tableName="CLIENT_SCOPE_ATTRIBUTES">
+            <column name="SCOPE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+
+        <createIndex indexName="IDX_CLSCOPE_CL" tableName="CLIENT_SCOPE_CLIENT">
+            <column name="CLIENT_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_CL_CLSCOPE" tableName="CLIENT_SCOPE_CLIENT">
+            <column name="SCOPE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+
+        <createIndex indexName="IDX_DEFCLS_REALM" tableName="DEFAULT_CLIENT_SCOPE">
+            <column name="REALM_ID" type="VARCHAR(36)"/>
+        </createIndex>
+        <createIndex indexName="IDX_DEFCLS_SCOPE" tableName="DEFAULT_CLIENT_SCOPE">
+            <column name="SCOPE_ID" type="VARCHAR(36)"/>
+        </createIndex>
+
+        <createIndex indexName="IDX_USCONSENT_CLSCOPE" tableName="USER_CONSENT_CLIENT_SCOPE">
+            <column name="USER_CONSENT_ID" type="VARCHAR(36)"/>
+        </createIndex>
+
+    </changeSet>
+
 </databaseChangeLog>

model/jpa/src/main/resources/META-INF/persistence.xml

@@ -41,8 +41,7 @@
         <class>org.keycloak.models.jpa.entities.IdentityProviderMapperEntity</class>
         <class>org.keycloak.models.jpa.entities.ProtocolMapperEntity</class>
         <class>org.keycloak.models.jpa.entities.UserConsentEntity</class>
-        <class>org.keycloak.models.jpa.entities.UserConsentRoleEntity</class>
-        <class>org.keycloak.models.jpa.entities.UserConsentProtocolMapperEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserConsentClientScopeEntity</class>
         <class>org.keycloak.models.jpa.entities.AuthenticationFlowEntity</class>
         <class>org.keycloak.models.jpa.entities.AuthenticationExecutionEntity</class>
         <class>org.keycloak.models.jpa.entities.AuthenticatorConfigEntity</class>
@@ -53,8 +52,10 @@
         <class>org.keycloak.models.jpa.entities.GroupAttributeEntity</class>
         <class>org.keycloak.models.jpa.entities.GroupRoleMappingEntity</class>
         <class>org.keycloak.models.jpa.entities.UserGroupMembershipEntity</class>
-        <class>org.keycloak.models.jpa.entities.ClientTemplateEntity</class>
-        <class>org.keycloak.models.jpa.entities.TemplateScopeMappingEntity</class>
+        <class>org.keycloak.models.jpa.entities.ClientScopeEntity</class>
+        <class>org.keycloak.models.jpa.entities.ClientScopeRoleMappingEntity</class>
+        <class>org.keycloak.models.jpa.entities.ClientScopeClientMappingEntity</class>
+        <class>org.keycloak.models.jpa.entities.DefaultClientScopeRealmMappingEntity</class>
         <class>org.keycloak.models.jpa.entities.ClientInitialAccessEntity</class>
 
         <!-- JpaAuditProviders -->
@@ -74,8 +75,7 @@
         <class>org.keycloak.storage.jpa.entity.FederatedUser</class>
         <class>org.keycloak.storage.jpa.entity.FederatedUserAttributeEntity</class>
         <class>org.keycloak.storage.jpa.entity.FederatedUserConsentEntity</class>
-        <class>org.keycloak.storage.jpa.entity.FederatedUserConsentRoleEntity</class>
-        <class>org.keycloak.storage.jpa.entity.FederatedUserConsentProtocolMapperEntity</class>
+        <class>org.keycloak.storage.jpa.entity.FederatedUserConsentClientScopeEntity</class>
         <class>org.keycloak.storage.jpa.entity.FederatedUserCredentialEntity</class>
         <class>org.keycloak.storage.jpa.entity.FederatedUserCredentialAttributeEntity</class>
         <class>org.keycloak.storage.jpa.entity.FederatedUserGroupMembershipEntity</class>