app cert support, bug fixes

model/api/src/main/java/org/keycloak/models/ClientModel.java

@@ -8,6 +8,13 @@ import java.util.Set;
  * @version $Revision: 1 $
  */
 public interface ClientModel {
+
+    // COMMON ATTRIBUTES
+
+    String PRIVATE_KEY = "privateKey";
+    String PUBLIC_KEY = "publicKey";
+    String X509CERTIFICATE = "X509Certificate";
+
     /**
      * Internal database key
      *

model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java

@@ -131,6 +131,29 @@ public final class KeycloakModelUtils {
         realm.setCertificate(certificate);
     }
 
+    public static void generateClientKeyPairCertificate(ClientModel client) {
+        KeyPair keyPair = null;
+        try {
+            keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException(e);
+        }
+        X509Certificate certificate = null;
+        try {
+            certificate = CertificateUtils.generateV1SelfSignedCertificate(keyPair, client.getClientId());
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        String privateKeyPem = KeycloakModelUtils.getPemFromKey(keyPair.getPrivate());
+        String publicKeyPem = KeycloakModelUtils.getPemFromKey(keyPair.getPublic());
+        String certPem = KeycloakModelUtils.getPemFromCertificate(certificate);
+
+        client.setAttribute(ClientModel.PRIVATE_KEY, privateKeyPem);
+        client.setAttribute(ClientModel.PUBLIC_KEY, publicKeyPem);
+        client.setAttribute(ClientModel.X509CERTIFICATE, certPem);
+
+    }
+
     public static UserCredentialModel generateSecret(ClientModel app) {
         UserCredentialModel secret = UserCredentialModel.generateSecret();
         app.setSecret(secret.getValue());

model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java

@@ -86,6 +86,11 @@ public class ModelToRepresentation {
         rep.setSslRequired(realm.getSslRequired().name().toLowerCase());
         rep.setPublicKey(realm.getPublicKeyPem());
         rep.setPrivateKey(realm.getPrivateKeyPem());
+        String privateKeyPem = realm.getPrivateKeyPem();
+        if (realm.getCertificatePem() == null && privateKeyPem != null) {
+            KeycloakModelUtils.generateRealmCertificate(realm);
+        }
+        rep.setCertificate(realm.getCertificatePem());
         rep.setPasswordCredentialGrantAllowed(realm.isPasswordCredentialGrantAllowed());
         rep.setRegistrationAllowed(realm.isRegistrationAllowed());
         rep.setRememberMe(realm.isRememberMe());
@@ -114,8 +119,6 @@ public class ModelToRepresentation {
             rep.setPasswordPolicy(realm.getPasswordPolicy().toString());
         }
 
-        ApplicationModel accountManagementApplication = realm.getApplicationNameMap().get(Constants.ACCOUNT_MANAGEMENT_APP);
-
         List<String> defaultRoles = realm.getDefaultRoles();
         if (!defaultRoles.isEmpty()) {
             List<String> roleStrings = new ArrayList<String>();

model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java

@@ -84,6 +84,11 @@ public class RepresentationToModel {
             newRealm.setPrivateKeyPem(rep.getPrivateKey());
             newRealm.setPublicKeyPem(rep.getPublicKey());
         }
+        if (rep.getCertificate() == null) {
+            KeycloakModelUtils.generateRealmCertificate(newRealm);
+        } else {
+            newRealm.setCertificatePem(rep.getCertificate());
+        }
         if (rep.getLoginTheme() != null) newRealm.setLoginTheme(rep.getLoginTheme());
         if (rep.getAccountTheme() != null) newRealm.setAccountTheme(rep.getAccountTheme());
         if (rep.getAdminTheme() != null) newRealm.setAdminTheme(rep.getAdminTheme());