Merge remote-tracking branch 'upstream/master'

model/invalidation-cache/infinispan/src/main/java/org/keycloak/models/cache/infinispan/InfinispanCacheRealmProviderFactory.java

@@ -17,9 +17,8 @@ import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.cache.CacheRealmProvider;
 import org.keycloak.models.cache.CacheRealmProviderFactory;
-import org.keycloak.models.cache.RealmCache;
+import org.keycloak.models.cache.entities.CachedClient;
 import org.keycloak.models.cache.entities.CachedRealm;
-import org.keycloak.models.cache.entities.CachedUser;
 
 import java.util.concurrent.ConcurrentHashMap;
 
@@ -143,11 +142,23 @@ public class InfinispanCacheRealmProviderFactory implements CacheRealmProviderFa
 
                 realmLookup.remove(realm.getName());
 
+                for (String r : realm.getRealmRoles().values()) {
+                    realmCache.evictCachedRoleById(r);
+                }
+
                 for (String c : realm.getClients().values()) {
                     realmCache.evictCachedApplicationById(c);
                 }
 
                 log.tracev("Realm removed realm={0}", realm.getName());
+            } else if (object instanceof CachedClient) {
+                CachedClient client = (CachedClient) object;
+
+                for (String r : client.getRoles().values()) {
+                    realmCache.evictCachedRoleById(r);
+                }
+
+                log.tracev("Client removed client={0}", client.getId());
             }
         }
     }

model/invalidation-cache/infinispan/src/main/java/org/keycloak/models/cache/infinispan/InfinispanRealmCache.java

@@ -160,6 +160,12 @@ public class InfinispanRealmCache implements RealmCache {
         cache.remove(id);
     }
 
+    @Override
+    public void evictCachedRoleById(String id) {
+        logger.tracev("Evicting role {0}", id);
+        cache.evict(id);
+    }
+
     @Override
     public void addCachedRole(CachedRole role) {
         if (!enabled) return;

model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RealmCache.java

@@ -37,6 +37,8 @@ public interface RealmCache {
 
     void invalidateRole(CachedRole role);
 
+    void evictCachedRoleById(String id);
+
     void addCachedRole(CachedRole role);
 
     void invalidateCachedRoleById(String id);