diff --git a/authz/policy/common/pom.xml b/authz/policy/common/pom.xml
index 6149e3a13f..31df304798 100644
--- a/authz/policy/common/pom.xml
+++ b/authz/policy/common/pom.xml
@@ -46,6 +46,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
 </project>
\ No newline at end of file
diff --git a/authz/policy/drools/pom.xml b/authz/policy/drools/pom.xml
index 7dc1b4520e..1594329213 100644
--- a/authz/policy/drools/pom.xml
+++ b/authz/policy/drools/pom.xml
@@ -23,6 +23,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-services</artifactId>
diff --git a/dependencies/server-min/pom.xml b/dependencies/server-min/pom.xml
index 6beae8485e..1c17f64123 100755
--- a/dependencies/server-min/pom.xml
+++ b/dependencies/server-min/pom.xml
@@ -59,6 +59,10 @@
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-server-spi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
         </dependency>
          <dependency>
             <groupId>org.keycloak</groupId>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/drools/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/drools/main/module.xml
index 09d947967a..4c5af2f8c2 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/drools/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/drools/main/module.xml
@@ -31,6 +31,7 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="com.thoughtworks.xstream"/>
         <module name="org.antlr" slot="3.5"/>
         <module name="org.kie"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/eclipse/jdt/core/compiler/ecj/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/eclipse/jdt/core/compiler/ecj/main/module.xml
index 8440c1df1b..849fc353f5 100644
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/eclipse/jdt/core/compiler/ecj/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/eclipse/jdt/core/compiler/ecj/main/module.xml
@@ -31,6 +31,7 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
     </dependencies>
 
 </module>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-common/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-common/main/module.xml
index 422c683ea5..a8ab099035 100644
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-common/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-common/main/module.xml
@@ -29,6 +29,7 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.keycloak.keycloak-services"/>
     </dependencies>
 
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-drools/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-drools/main/module.xml
index cf36e0a656..60dc78a87b 100644
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-drools/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-authz-policy-drools/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.keycloak.keycloak-services"/>
         <module name="org.kie"/>
     </dependencies>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-common/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-common/main/module.xml
index 4a3d370c8c..7b024b19e7 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-common/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-common/main/module.xml
@@ -16,10 +16,6 @@
   ~ limitations under the License.
   -->
 <module xmlns="urn:jboss:module:1.3" name="org.keycloak.keycloak-common">
-    <properties>
-        <property name="jboss.api" value="private"/>
-    </properties>
-
     <resources>
         <artifact name="${org.keycloak:keycloak-common}"/>
     </resources>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-core/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-core/main/module.xml
index 1afc30d5b6..659a055f5c 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-core/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-core/main/module.xml
@@ -16,10 +16,6 @@
   ~ limitations under the License.
   -->
 <module xmlns="urn:jboss:module:1.3" name="org.keycloak.keycloak-core">
-    <properties>
-        <property name="jboss.api" value="private"/>
-    </properties>
-
     <resources>
         <artifact name="${org.keycloak:keycloak-core}"/>
     </resources>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-kerberos-federation/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-kerberos-federation/main/module.xml
index d0b9730e2e..ebb263c714 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-kerberos-federation/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-kerberos-federation/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="javax.ws.rs.api"/>
         <module name="org.jboss.resteasy.resteasy-jaxrs"/>
         <module name="org.jboss.logging"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-ldap-federation/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-ldap-federation/main/module.xml
index 43a1d64c09..dcca1bfd2e 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-ldap-federation/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-ldap-federation/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.keycloak.keycloak-kerberos-federation"/>
         <module name="javax.ws.rs.api"/>
         <module name="org.jboss.resteasy.resteasy-jaxrs"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-infinispan/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-infinispan/main/module.xml
index 91f423a4a4..a80a008a32 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-infinispan/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-infinispan/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.infinispan"/>
         <module name="org.jboss.logging"/>
         <module name="javax.api"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-jpa/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-jpa/main/module.xml
index 94c80a2a96..88cae4fee5 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-jpa/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-jpa/main/module.xml
@@ -29,6 +29,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="javax.persistence.api"/>
         <module name="org.jboss.logging"/>
         <module name="org.liquibase"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-mongo/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-mongo/main/module.xml
index 20cff7cf67..3bd99ae466 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-mongo/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-model-mongo/main/module.xml
@@ -29,6 +29,7 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-services"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.mongodb.mongo-java-driver"/>
         <module name="org.jboss.logging"/>
         <module name="javax.api"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi-private/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi-private/main/module.xml
new file mode 100755
index 0000000000..0f136fde63
--- /dev/null
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi-private/main/module.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<module xmlns="urn:jboss:module:1.3" name="org.keycloak.keycloak-server-spi-private">
+    <properties>
+        <property name="jboss.api" value="private"/>
+    </properties>
+
+    <resources>
+        <artifact name="${org.keycloak:keycloak-server-spi-private}"/>
+    </resources>
+
+    <dependencies>
+        <module name="org.jboss.logging"/>
+        <module name="org.keycloak.keycloak-common"/>
+        <module name="org.keycloak.keycloak-core"/>
+        <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.bouncycastle" />
+        <module name="javax.api"/>
+        <module name="javax.ws.rs.api"/>
+        <module name="org.apache.httpcomponents"/>
+        <module name="org.jboss.resteasy.resteasy-jaxrs"/>
+        <module name="javax.transaction.api"/>
+    </dependencies>
+</module>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi/main/module.xml
index 8b5632e30a..daed0af506 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-server-spi/main/module.xml
@@ -16,10 +16,6 @@
   ~ limitations under the License.
   -->
 <module xmlns="urn:jboss:module:1.3" name="org.keycloak.keycloak-server-spi">
-    <properties>
-        <property name="jboss.api" value="private"/>
-    </properties>
-
     <resources>
         <artifact name="${org.keycloak:keycloak-server-spi}"/>
     </resources>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-services/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-services/main/module.xml
index 4f351fd7c0..9db480c9d0 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-services/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-services/main/module.xml
@@ -32,6 +32,7 @@
         <module name="org.keycloak.keycloak-ldap-federation" services="import"/>
         <module name="org.keycloak.keycloak-sssd-federation" services="import"/>
         <module name="org.keycloak.keycloak-server-spi" services="import"/>
+        <module name="org.keycloak.keycloak-server-spi-private" services="import"/>
         <module name="org.keycloak.keycloak-model-jpa" services="import"/>
         <module name="org.keycloak.keycloak-model-mongo" services="import"/>
         <module name="org.keycloak.keycloak-model-infinispan" services="import"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-sssd-federation/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-sssd-federation/main/module.xml
index ad16f3c4dd..58939eb49c 100644
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-sssd-federation/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-sssd-federation/main/module.xml
@@ -28,5 +28,6 @@
         <module name="org.jboss.logging"/>
         <module name="org.keycloak.keycloak-core" />
         <module name="org.keycloak.keycloak-server-spi" />
+        <module name="org.keycloak.keycloak-server-spi-private"/>
     </dependencies>
 </module>
\ No newline at end of file
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-adduser/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-adduser/main/module.xml
index 4ee5c508c0..178470b42c 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-adduser/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-adduser/main/module.xml
@@ -30,6 +30,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.jboss.aesh"/>
         <module name="org.jboss.as.domain-management"/>
         <module name="com.fasterxml.jackson.core.jackson-core"/>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-extensions/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-extensions/main/module.xml
index d785cb7fe3..89aa901572 100755
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-extensions/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/keycloak/keycloak-wildfly-extensions/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.keycloak.keycloak-services"/>
         <module name="org.jboss.modules"/>
     </dependencies>
diff --git a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/kie/main/module.xml b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/kie/main/module.xml
index 242b508ba9..9b41daaf16 100644
--- a/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/kie/main/module.xml
+++ b/distribution/feature-packs/server-feature-pack/src/main/resources/modules/system/layers/keycloak/org/kie/main/module.xml
@@ -32,11 +32,13 @@
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.slf4j"/>
         <module name="org.apache.commons.logging"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="com.sun.xml.bind"/>
         <module name="com.thoughtworks.xstream"/>
         <module name="org.apache.ant"/>
diff --git a/examples/providers/authenticator/pom.xml b/examples/providers/authenticator/pom.xml
index 4e24bf3ad7..0992966067 100755
--- a/examples/providers/authenticator/pom.xml
+++ b/examples/providers/authenticator/pom.xml
@@ -41,6 +41,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
diff --git a/examples/providers/domain-extension/README.md b/examples/providers/domain-extension/README.md
index 9ec5e63e9a..465551b2f5 100644
--- a/examples/providers/domain-extension/README.md
+++ b/examples/providers/domain-extension/README.md
@@ -3,7 +3,7 @@ Example Domain Extension
 
 To run, deploy as a module by running:
 
-    $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.domain-extension-example --resources=target/domain-extension-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-services,org.keycloak.keycloak-model-jpa,org.keycloak.keycloak-server-spi,javax.ws.rs.api,javax.persistence.api,org.hibernate,org.javassist,org.liquibase"
+    $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.domain-extension-example --resources=target/domain-extension-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-services,org.keycloak.keycloak-model-jpa,org.keycloak.keycloak-server-spi,org.keycloak.keycloak-server-spi-private,javax.ws.rs.api,javax.persistence.api,org.hibernate,org.javassist,org.liquibase"
 
 
 Then registering the provider by editing `standalone/configuration/standalone.xml` and adding the module to the providers element:
diff --git a/examples/providers/domain-extension/pom.xml b/examples/providers/domain-extension/pom.xml
index 43e5cf7917..d31ccbfba4 100755
--- a/examples/providers/domain-extension/pom.xml
+++ b/examples/providers/domain-extension/pom.xml
@@ -46,6 +46,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-model-jpa</artifactId>
diff --git a/examples/providers/event-listener-sysout/README.md b/examples/providers/event-listener-sysout/README.md
index 8e1a0850ad..5540d9b25c 100644
--- a/examples/providers/event-listener-sysout/README.md
+++ b/examples/providers/event-listener-sysout/README.md
@@ -3,7 +3,7 @@ Example Event Listener that prints events to System.out
 
 To deploy copy target/event-listener-sysout-example.jar to providers directory. Alternatively you can deploy as a module by running:
 
-    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.event-sysout --resources=target/event-listener-sysout-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi"
+    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.event-sysout --resources=target/event-listener-sysout-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi,org.keycloak.keycloak-server-spi-private"
 
 Then registering the provider by editing `standalone/configuration/standalone.xml` and adding the module to the providers element:
 
diff --git a/examples/providers/event-listener-sysout/pom.xml b/examples/providers/event-listener-sysout/pom.xml
index 83f348b63e..3d61dfd965 100755
--- a/examples/providers/event-listener-sysout/pom.xml
+++ b/examples/providers/event-listener-sysout/pom.xml
@@ -40,6 +40,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/examples/providers/event-store-mem/README.md b/examples/providers/event-store-mem/README.md
index 682ff42b78..2c55109190 100644
--- a/examples/providers/event-store-mem/README.md
+++ b/examples/providers/event-store-mem/README.md
@@ -3,7 +3,7 @@ Example Event Store that stores events in memory
 
 To deploy copy target/event-store-mem-example.jar to providers directory. Alternatively you can deploy as a module by running:
 
-    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.event-inmem --resources=target/event-store-mem-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi"
+    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.event-inmem --resources=target/event-store-mem-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi,org.keycloak.keycloak-server-spi-private"
 
 Then registering the provider by editing `standalone/configuration/standalone.xml` and adding the module to the providers element:
 
diff --git a/examples/providers/event-store-mem/pom.xml b/examples/providers/event-store-mem/pom.xml
index 16db181874..2e48c2dc28 100755
--- a/examples/providers/event-store-mem/pom.xml
+++ b/examples/providers/event-store-mem/pom.xml
@@ -40,6 +40,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/examples/providers/federation-provider/README.md b/examples/providers/federation-provider/README.md
index c90e791547..ae02fc85c4 100755
--- a/examples/providers/federation-provider/README.md
+++ b/examples/providers/federation-provider/README.md
@@ -4,7 +4,7 @@ Example User Federation Provider
 This is an example of user federation backed by a simple properties file.  This properties file only contains username/password
 key pairs.  To deploy, build this directory then take the jar and copy it to providers directory. Alternatively you can deploy as a module by running:
 
-    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.userprops --resources=target/federation-properties-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi"
+    KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.userprops --resources=target/federation-properties-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi,org.keycloak.keycloak-server-spi-private"
 
 Then registering the provider by editing `standalone/configuration/standalone.xml` and adding the module to the providers element:
 
diff --git a/examples/providers/federation-provider/pom.xml b/examples/providers/federation-provider/pom.xml
index bd4e1c8a32..be02cc7057 100755
--- a/examples/providers/federation-provider/pom.xml
+++ b/examples/providers/federation-provider/pom.xml
@@ -41,6 +41,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
diff --git a/examples/providers/rest/README.md b/examples/providers/rest/README.md
index 5ee9327132..d78e9bc958 100644
--- a/examples/providers/rest/README.md
+++ b/examples/providers/rest/README.md
@@ -3,7 +3,7 @@ Example Realm REST Resource provider
 
 To deploy copy target/hello-rest-example.jar to providers directory. Alternatively you can deploy as a module by running:
 
-    $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.hello-rest-example --resources=target/hello-rest-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi,javax.ws.rs.api"
+    $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.examples.hello-rest-example --resources=target/hello-rest-example.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-server-spi,org.keycloak.keycloak-server-spi-private,javax.ws.rs.api"
 
 Then registering the provider by editing `standalone/configuration/standalone.xml` and adding the module to the providers element:
 
diff --git a/examples/providers/rest/pom.xml b/examples/providers/rest/pom.xml
index 416acfcf24..b94cf435ec 100755
--- a/examples/providers/rest/pom.xml
+++ b/examples/providers/rest/pom.xml
@@ -41,6 +41,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.spec.javax.ws.rs</groupId>
             <artifactId>jboss-jaxrs-api_2.0_spec</artifactId>
diff --git a/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProvider.java b/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProvider.java
index 837f2b6555..86b2a30ef3 100644
--- a/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProvider.java
+++ b/examples/providers/user-storage-jpa/src/main/java/org/keycloak/examples/storage/user/EjbExampleUserStorageProvider.java
@@ -30,7 +30,6 @@ import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.cache.CachedUserModel;
 import org.keycloak.models.cache.OnUserCache;
-import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.UserStorageProvider;
 import org.keycloak.storage.user.UserLookupProvider;
@@ -49,6 +48,7 @@ import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.UUID;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -139,7 +139,7 @@ public class EjbExampleUserStorageProvider implements UserStorageProvider,
     @Override
     public UserModel addUser(RealmModel realm, String username) {
         UserEntity entity = new UserEntity();
-        entity.setId(KeycloakModelUtils.generateId());
+        entity.setId(UUID.randomUUID().toString());
         entity.setUsername(username);
         em.persist(entity);
         logger.info("added user: " + username);
diff --git a/federation/kerberos/pom.xml b/federation/kerberos/pom.xml
index 75d3ab4e22..da453d63e5 100755
--- a/federation/kerberos/pom.xml
+++ b/federation/kerberos/pom.xml
@@ -40,6 +40,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
index d656a0dbd6..b5f470935b 100755
--- a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
@@ -33,7 +33,7 @@ import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserFederationProvider;
 import org.keycloak.models.UserFederationProviderModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 
 import java.util.Collections;
 import java.util.HashMap;
diff --git a/federation/ldap/pom.xml b/federation/ldap/pom.xml
index 4187ef6b29..38fa19d3dd 100755
--- a/federation/ldap/pom.xml
+++ b/federation/ldap/pom.xml
@@ -40,6 +40,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-kerberos-federation</artifactId>
diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
index 880f0f70e2..67cfb45fe7 100755
--- a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
@@ -47,7 +47,7 @@ import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.models.UserFederationProvider;
 import org.keycloak.models.UserFederationProviderModel;
 import org.keycloak.models.UserModel;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 
 import javax.naming.AuthenticationException;
 import java.util.ArrayList;
diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/group/GroupLDAPFederationMapper.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/group/GroupLDAPFederationMapper.java
index 460ab62ced..d135dfa017 100644
--- a/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/group/GroupLDAPFederationMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/group/GroupLDAPFederationMapper.java
@@ -38,6 +38,7 @@ import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.models.UserFederationSyncResult;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 import org.keycloak.models.utils.UserModelDelegate;
 
 import java.util.Collection;
@@ -563,7 +564,7 @@ public class GroupLDAPFederationMapper extends AbstractLDAPFederationMapper impl
 
         @Override
         public boolean hasRole(RoleModel role) {
-            return super.hasRole(role) || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+            return super.hasRole(role) || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
         }
 
         @Override
diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/role/RoleLDAPFederationMapper.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/role/RoleLDAPFederationMapper.java
index 9d6e2a1282..b45f348fab 100644
--- a/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/role/RoleLDAPFederationMapper.java
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/mappers/membership/role/RoleLDAPFederationMapper.java
@@ -38,6 +38,7 @@ import org.keycloak.models.UserFederationMapperModel;
 import org.keycloak.models.UserFederationSyncResult;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 import org.keycloak.models.utils.UserModelDelegate;
 
 import java.util.Collection;
@@ -348,8 +349,8 @@ public class RoleLDAPFederationMapper extends AbstractLDAPFederationMapper imple
         @Override
         public boolean hasRole(RoleModel role) {
             Set<RoleModel> roles = getRoleMappings();
-            return KeycloakModelUtils.hasRole(roles, role)
-              || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+            return RoleUtils.hasRole(roles, role)
+              || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
         }
 
         @Override
diff --git a/federation/sssd/pom.xml b/federation/sssd/pom.xml
index 8430e7cb17..29113f7c8e 100644
--- a/federation/sssd/pom.xml
+++ b/federation/sssd/pom.xml
@@ -60,6 +60,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
diff --git a/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java b/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java
index 2820947720..44662deaa9 100755
--- a/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java
+++ b/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java
@@ -34,7 +34,7 @@ import org.keycloak.models.UserFederationProvider;
 import org.keycloak.models.UserFederationProviderModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 
 import java.util.Collections;
 import java.util.HashSet;
diff --git a/model/infinispan/pom.xml b/model/infinispan/pom.xml
index 08aef53142..f10fa60751 100755
--- a/model/infinispan/pom.xml
+++ b/model/infinispan/pom.xml
@@ -38,6 +38,10 @@
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-server-spi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>
diff --git a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
index 6030a66e8e..1a52aa9f94 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/cache/infinispan/UserAdapter.java
@@ -27,6 +27,7 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.cache.CachedUserModel;
 import org.keycloak.models.cache.infinispan.entities.CachedUser;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 
 import java.util.Collections;
 import java.util.HashSet;
@@ -301,7 +302,7 @@ public class UserAdapter implements CachedUserModel {
         for (RoleModel mapping: mappings) {
            if (mapping.hasRole(role)) return true;
         }
-        return KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+        return RoleUtils.hasRoleFromGroup(getGroups(), role, true);
     }
 
     @Override
@@ -368,7 +369,7 @@ public class UserAdapter implements CachedUserModel {
         if (updated != null) return updated.isMemberOf(group);
         if (cached.getGroups().contains(group.getId())) return true;
         Set<GroupModel> roles = getGroups();
-        return KeycloakModelUtils.isMember(roles, group);
+        return RoleUtils.isMember(roles, group);
     }
 
     @Override
diff --git a/model/infinispan/src/test/java/org/keycloak/models/keys/infinispan/InfinispanKeyStorageProviderTest.java b/model/infinispan/src/test/java/org/keycloak/keys/infinispan/InfinispanKeyStorageProviderTest.java
similarity index 97%
rename from model/infinispan/src/test/java/org/keycloak/models/keys/infinispan/InfinispanKeyStorageProviderTest.java
rename to model/infinispan/src/test/java/org/keycloak/keys/infinispan/InfinispanKeyStorageProviderTest.java
index 5a15dc3d0d..e5dd1c1f56 100644
--- a/model/infinispan/src/test/java/org/keycloak/models/keys/infinispan/InfinispanKeyStorageProviderTest.java
+++ b/model/infinispan/src/test/java/org/keycloak/keys/infinispan/InfinispanKeyStorageProviderTest.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-package org.keycloak.models.keys.infinispan;
+package org.keycloak.keys.infinispan;
 
 import java.security.PublicKey;
 import java.util.Collections;
@@ -40,8 +40,6 @@ import org.junit.Test;
 import org.keycloak.common.util.Time;
 import org.keycloak.connections.infinispan.InfinispanConnectionProvider;
 import org.keycloak.keys.PublicKeyLoader;
-import org.keycloak.keys.infinispan.InfinispanPublicKeyStorageProvider;
-import org.keycloak.keys.infinispan.PublicKeysEntry;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
diff --git a/model/jpa/pom.xml b/model/jpa/pom.xml
index 13f3ae0a98..0b2ae4dee7 100755
--- a/model/jpa/pom.xml
+++ b/model/jpa/pom.xml
@@ -48,6 +48,10 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-server-spi</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-services</artifactId>
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
index 6ea87c5587..3dc7bcc57c 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
@@ -27,6 +27,7 @@ import org.keycloak.models.jpa.entities.GroupAttributeEntity;
 import org.keycloak.models.jpa.entities.GroupEntity;
 import org.keycloak.models.jpa.entities.GroupRoleMappingEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 
 import javax.persistence.EntityManager;
 import javax.persistence.TypedQuery;
@@ -228,7 +229,7 @@ public class GroupAdapter implements GroupModel , JpaModel<GroupEntity> {
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role);
+        return RoleUtils.hasRole(roles, role);
     }
 
     protected TypedQuery<GroupRoleMappingEntity> getGroupRoleMappingEntityTypedQuery(RoleModel role) {
diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
index 5ee5490282..a95548bfe1 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
@@ -31,6 +31,7 @@ import org.keycloak.models.jpa.entities.UserGroupMembershipEntity;
 import org.keycloak.models.jpa.entities.UserRequiredActionEntity;
 import org.keycloak.models.jpa.entities.UserRoleMappingEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 
 import javax.persistence.EntityManager;
 import javax.persistence.Query;
@@ -338,7 +339,7 @@ public class UserAdapter implements UserModel, JpaModel<UserEntity> {
     @Override
     public boolean isMemberOf(GroupModel group) {
         Set<GroupModel> roles = getGroups();
-        return KeycloakModelUtils.isMember(roles, group);
+        return RoleUtils.isMember(roles, group);
     }
 
     protected TypedQuery<UserGroupMembershipEntity> getUserGroupMappingQuery(GroupModel group) {
@@ -352,8 +353,8 @@ public class UserAdapter implements UserModel, JpaModel<UserEntity> {
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role)
-          || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+        return RoleUtils.hasRole(roles, role)
+          || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
     }
 
     protected TypedQuery<UserRoleMappingEntity> getUserRoleMappingEntityTypedQuery(RoleModel role) {
diff --git a/model/mongo/pom.xml b/model/mongo/pom.xml
index d31fa69aae..054d320383 100755
--- a/model/mongo/pom.xml
+++ b/model/mongo/pom.xml
@@ -50,6 +50,10 @@
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-server-spi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>
diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/GroupAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/GroupAdapter.java
index 724dd69a06..d4ad3afbc8 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/GroupAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/GroupAdapter.java
@@ -28,6 +28,7 @@ import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.mongo.keycloak.entities.MongoGroupEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -146,7 +147,7 @@ public class GroupAdapter extends AbstractMongoAdapter<MongoGroupEntity> impleme
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role);
+        return RoleUtils.hasRole(roles, role);
     }
 
     @Override
diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
index 972f4409b7..9d5ad7c6f2 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
@@ -27,6 +27,7 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.mongo.keycloak.entities.MongoUserEntity;
 import org.keycloak.models.mongo.utils.MongoModelUtils;
 import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -262,14 +263,14 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
     public boolean isMemberOf(GroupModel group) {
         if (user.getGroupIds().contains(group.getId())) return true;
         Set<GroupModel> groups = getGroups();
-        return KeycloakModelUtils.isMember(groups, group);
+        return RoleUtils.isMember(groups, group);
     }
 
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role)
-          || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+        return RoleUtils.hasRole(roles, role)
+          || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
     }
 
     @Override
diff --git a/pom.xml b/pom.xml
index 8a61e5b0b4..7918c6dade 100755
--- a/pom.xml
+++ b/pom.xml
@@ -120,7 +120,7 @@
         <osgi.bundle.plugin.version>2.3.7</osgi.bundle.plugin.version>
         <wildfly.plugin.version>1.0.1.Final</wildfly.plugin.version>
         <nexus.staging.plugin.version>1.6.5</nexus.staging.plugin.version>
-        
+
         <!-- Surefire Settings -->
         <surefire.memory.settings>-Xms512m -Xmx2048m -XX:MetaspaceSize=96m -XX:MaxMetaspaceSize=256m</surefire.memory.settings>
     </properties>
@@ -175,6 +175,7 @@
         <module>core</module>
         <module>dependencies</module>
         <module>server-spi</module>
+        <module>server-spi-private</module>
         <module>saml-core-api</module>
         <module>saml-core</module>
         <module>proxy</module>
@@ -938,6 +939,11 @@
                 <artifactId>keycloak-server-spi</artifactId>
                 <version>${project.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.keycloak</groupId>
+                <artifactId>keycloak-server-spi-private</artifactId>
+                <version>${project.version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.keycloak</groupId>
                 <artifactId>keycloak-model-jpa</artifactId>
@@ -1483,7 +1489,7 @@
                 </plugins>
             </build>
         </profile>
-        
+
         <profile>
             <id>nexus-staging</id>
             <build>
diff --git a/server-spi-private/pom.xml b/server-spi-private/pom.xml
new file mode 100755
index 0000000000..a1d3df23ff
--- /dev/null
+++ b/server-spi-private/pom.xml
@@ -0,0 +1,98 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>2.4.0.CR1-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-server-spi-private</artifactId>
+    <name>Keycloak Server Private SPI</name>
+    <description/>
+
+    <properties>
+        <maven.compiler.target>1.8</maven.compiler.target>
+        <maven.compiler.source>1.8</maven.compiler.source>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.spec.javax.transaction</groupId>
+            <artifactId>jboss-transaction-api_1.2_spec</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk15on</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/server-spi/src/main/java/org/keycloak/ServerStartupError.java b/server-spi-private/src/main/java/org/keycloak/ServerStartupError.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/ServerStartupError.java
rename to server-spi-private/src/main/java/org/keycloak/ServerStartupError.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AbstractAuthenticationFlowContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlow.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlow.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlow.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlow.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowError.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowError.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowError.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowError.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowException.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticationFlowException.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticationFlowException.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/Authenticator.java b/server-spi-private/src/main/java/org/keycloak/authentication/Authenticator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/Authenticator.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/Authenticator.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticatorFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticatorFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticatorFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticatorFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/AuthenticatorSpi.java b/server-spi-private/src/main/java/org/keycloak/authentication/AuthenticatorSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/AuthenticatorSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/AuthenticatorSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticationFlowContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticationFlowContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticationFlowContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticationFlowContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticator.java b/server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticator.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticator.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticatorFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticatorFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticatorFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticatorFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticatorSpi.java b/server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticatorSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ClientAuthenticatorSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ClientAuthenticatorSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ConfigurableAuthenticatorFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FlowStatus.java b/server-spi-private/src/main/java/org/keycloak/authentication/FlowStatus.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FlowStatus.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FlowStatus.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ForkFlowException.java b/server-spi-private/src/main/java/org/keycloak/authentication/ForkFlowException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ForkFlowException.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ForkFlowException.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormAction.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormAction.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormAction.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormAction.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormActionFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormActionFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormActionFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormActionFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormActionSpi.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormActionSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormActionSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormActionSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormAuthenticator.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormAuthenticator.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticator.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormAuthenticatorFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticatorFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormAuthenticatorFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticatorFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormAuthenticatorSpi.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticatorSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormAuthenticatorSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormAuthenticatorSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/FormContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/FormContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/FormContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/FormContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/RequiredActionContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/RequiredActionContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/RequiredActionFactory.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/RequiredActionProvider.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/RequiredActionSpi.java b/server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/RequiredActionSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authentication/ValidationContext.java b/server-spi-private/src/main/java/org/keycloak/authentication/ValidationContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authentication/ValidationContext.java
rename to server-spi-private/src/main/java/org/keycloak/authentication/ValidationContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/AuthorizationProvider.java b/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/AuthorizationProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/AuthorizationProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/AuthorizationSpi.java b/server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/AuthorizationSpi.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/AuthorizationSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/Decision.java b/server-spi-private/src/main/java/org/keycloak/authorization/Decision.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/Decision.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/Decision.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/attribute/Attributes.java b/server-spi-private/src/main/java/org/keycloak/authorization/attribute/Attributes.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/attribute/Attributes.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/attribute/Attributes.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/attribute/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/attribute/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/attribute/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/attribute/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/identity/Identity.java b/server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/identity/Identity.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/identity/Identity.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/identity/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/identity/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/identity/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/identity/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/model/Policy.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/model/Policy.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/model/Policy.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/model/Resource.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/Resource.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/model/Resource.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/model/Resource.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/model/ResourceServer.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceServer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/model/ResourceServer.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/model/ResourceServer.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/model/Scope.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/Scope.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/model/Scope.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/model/Scope.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/model/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/model/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/model/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/model/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/permission/ResourcePermission.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/Evaluators.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/IterablePermissionEvaluator.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/PermissionEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/PermissionEvaluator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/PermissionEvaluator.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/PermissionEvaluator.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/ScheduledPermissionEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/ScheduledPermissionEvaluator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/permission/evaluator/ScheduledPermissionEvaluator.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/permission/evaluator/ScheduledPermissionEvaluator.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionResultCollector.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionResultCollector.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionResultCollector.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DecisionResultCollector.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultEvaluation.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/DefaultPolicyEvaluator.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Evaluation.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/EvaluationContext.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/EvaluationContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/EvaluationContext.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/EvaluationContext.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/PolicyEvaluator.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/PolicyEvaluator.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/PolicyEvaluator.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/PolicyEvaluator.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/Result.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Result.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/Result.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/Result.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/evaluation/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/evaluation/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderAdminService.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderAdminService.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderAdminService.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderAdminService.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicySpi.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicySpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/provider/PolicySpi.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/PolicySpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/policy/provider/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/policy/provider/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/policy/provider/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/AuthorizationStoreFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/PolicyStore.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/PolicyStore.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/PolicyStore.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/ResourceServerStore.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceServerStore.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/ResourceServerStore.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceServerStore.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/ResourceStore.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceStore.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/ResourceStore.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/ResourceStore.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/ScopeStore.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/ScopeStore.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/ScopeStore.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/ScopeStore.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/StoreFactory.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/StoreFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/StoreFactory.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/StoreFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/StoreFactorySpi.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/StoreFactorySpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/StoreFactorySpi.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/StoreFactorySpi.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/package-info.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/package-info.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/package-info.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/package-info.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/ClientApplicationSynchronizer.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/syncronization/RealmSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RealmSynchronizer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/syncronization/RealmSynchronizer.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/RealmSynchronizer.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/syncronization/Synchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/Synchronizer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/syncronization/Synchronizer.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/Synchronizer.java
diff --git a/server-spi/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java b/server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
rename to server-spi-private/src/main/java/org/keycloak/authorization/store/syncronization/UserSynchronizer.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/AuthenticationRequest.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/AuthenticationRequest.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/AuthenticationRequest.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/AuthenticationRequest.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/ConfigConstants.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/ConfigConstants.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/ConfigConstants.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/ConfigConstants.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/DefaultDataMarshaller.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/DefaultDataMarshaller.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/DefaultDataMarshaller.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/DefaultDataMarshaller.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityBrokerException.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityBrokerException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityBrokerException.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityBrokerException.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderDataMarshaller.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderDataMarshaller.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderDataMarshaller.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderDataMarshaller.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderMapper.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderMapper.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderMapper.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderMapper.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderMapperSpi.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderMapperSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderMapperSpi.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderMapperSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderSpi.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/IdentityProviderSpi.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/IdentityProviderSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java b/server-spi-private/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java
rename to server-spi-private/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/social/SocialIdentityProvider.java b/server-spi-private/src/main/java/org/keycloak/broker/social/SocialIdentityProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/social/SocialIdentityProvider.java
rename to server-spi-private/src/main/java/org/keycloak/broker/social/SocialIdentityProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/social/SocialIdentityProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/broker/social/SocialIdentityProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/social/SocialIdentityProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/broker/social/SocialIdentityProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/broker/social/SocialProviderSpi.java b/server-spi-private/src/main/java/org/keycloak/broker/social/SocialProviderSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/broker/social/SocialProviderSpi.java
rename to server-spi-private/src/main/java/org/keycloak/broker/social/SocialProviderSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ClusterEvent.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterEvent.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ClusterEvent.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ClusterEvent.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ClusterListener.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterListener.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ClusterListener.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ClusterListener.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ClusterProvider.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ClusterProvider.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ClusterProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ClusterProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ClusterProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ClusterProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ClusterSpi.java b/server-spi-private/src/main/java/org/keycloak/cluster/ClusterSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ClusterSpi.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ClusterSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/cluster/ExecutionResult.java b/server-spi-private/src/main/java/org/keycloak/cluster/ExecutionResult.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/cluster/ExecutionResult.java
rename to server-spi-private/src/main/java/org/keycloak/cluster/ExecutionResult.java
diff --git a/server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientFactory.java b/server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientFactory.java
rename to server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientProvider.java b/server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientProvider.java
rename to server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientSpi.java b/server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/connections/httpclient/HttpClientSpi.java
rename to server-spi-private/src/main/java/org/keycloak/connections/httpclient/HttpClientSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailException.java b/server-spi-private/src/main/java/org/keycloak/email/EmailException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailException.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailException.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailSenderProvider.java b/server-spi-private/src/main/java/org/keycloak/email/EmailSenderProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailSenderProvider.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailSenderProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailSenderProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/email/EmailSenderProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailSenderProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailSenderProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailSenderSpi.java b/server-spi-private/src/main/java/org/keycloak/email/EmailSenderSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailSenderSpi.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailSenderSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailTemplateProvider.java b/server-spi-private/src/main/java/org/keycloak/email/EmailTemplateProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailTemplateProvider.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailTemplateProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailTemplateProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/email/EmailTemplateProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailTemplateProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailTemplateProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/email/EmailTemplateSpi.java b/server-spi-private/src/main/java/org/keycloak/email/EmailTemplateSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/email/EmailTemplateSpi.java
rename to server-spi-private/src/main/java/org/keycloak/email/EmailTemplateSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/events/Details.java b/server-spi-private/src/main/java/org/keycloak/events/Details.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/Details.java
rename to server-spi-private/src/main/java/org/keycloak/events/Details.java
diff --git a/server-spi/src/main/java/org/keycloak/events/Errors.java b/server-spi-private/src/main/java/org/keycloak/events/Errors.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/Errors.java
rename to server-spi-private/src/main/java/org/keycloak/events/Errors.java
diff --git a/server-spi/src/main/java/org/keycloak/events/Event.java b/server-spi-private/src/main/java/org/keycloak/events/Event.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/Event.java
rename to server-spi-private/src/main/java/org/keycloak/events/Event.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventBuilder.java b/server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventBuilder.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventBuilder.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventListenerProvider.java b/server-spi-private/src/main/java/org/keycloak/events/EventListenerProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventListenerProvider.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventListenerProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventListenerProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/events/EventListenerProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventListenerProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventListenerProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventListenerSpi.java b/server-spi-private/src/main/java/org/keycloak/events/EventListenerSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventListenerSpi.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventListenerSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventQuery.java b/server-spi-private/src/main/java/org/keycloak/events/EventQuery.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventQuery.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventQuery.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventStoreProvider.java b/server-spi-private/src/main/java/org/keycloak/events/EventStoreProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventStoreProvider.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventStoreProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventStoreProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/events/EventStoreProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventStoreProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventStoreProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventStoreSpi.java b/server-spi-private/src/main/java/org/keycloak/events/EventStoreSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventStoreSpi.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventStoreSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/events/EventType.java b/server-spi-private/src/main/java/org/keycloak/events/EventType.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/EventType.java
rename to server-spi-private/src/main/java/org/keycloak/events/EventType.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/AdminEvent.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEvent.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/AdminEvent.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/AdminEvent.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/AdminEventQuery.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/AdminEventQuery.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/AuthDetails.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AuthDetails.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/AuthDetails.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/AuthDetails.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/AuthQuery.java b/server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/AuthQuery.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/AuthQuery.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/OperationType.java b/server-spi-private/src/main/java/org/keycloak/events/admin/OperationType.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/OperationType.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/OperationType.java
diff --git a/server-spi/src/main/java/org/keycloak/events/admin/ResourceType.java b/server-spi-private/src/main/java/org/keycloak/events/admin/ResourceType.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/events/admin/ResourceType.java
rename to server-spi-private/src/main/java/org/keycloak/events/admin/ResourceType.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ExportProvider.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ExportProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ExportProvider.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ExportProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ExportProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ExportProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ExportProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ExportProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ExportSpi.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ExportSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ExportSpi.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ExportSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ImportProvider.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ImportProvider.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ImportProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ImportProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/ImportSpi.java b/server-spi-private/src/main/java/org/keycloak/exportimport/ImportSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/ImportSpi.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/ImportSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/Strategy.java b/server-spi-private/src/main/java/org/keycloak/exportimport/Strategy.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/Strategy.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/Strategy.java
diff --git a/server-spi/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java b/server-spi-private/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java
rename to server-spi-private/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/account/AccountPages.java b/server-spi-private/src/main/java/org/keycloak/forms/account/AccountPages.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/account/AccountPages.java
rename to server-spi-private/src/main/java/org/keycloak/forms/account/AccountPages.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/account/AccountProvider.java b/server-spi-private/src/main/java/org/keycloak/forms/account/AccountProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/account/AccountProvider.java
rename to server-spi-private/src/main/java/org/keycloak/forms/account/AccountProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/account/AccountProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/forms/account/AccountProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/account/AccountProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/forms/account/AccountProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/account/AccountSpi.java b/server-spi-private/src/main/java/org/keycloak/forms/account/AccountSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/account/AccountSpi.java
rename to server-spi-private/src/main/java/org/keycloak/forms/account/AccountSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/login/LoginFormsPages.java b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsPages.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/login/LoginFormsPages.java
rename to server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsPages.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
rename to server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/login/LoginFormsProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/login/LoginFormsProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/forms/login/LoginFormsSpi.java b/server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/forms/login/LoginFormsSpi.java
rename to server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/KeyProvider.java b/server-spi-private/src/main/java/org/keycloak/keys/KeyProvider.java
similarity index 97%
rename from server-spi/src/main/java/org/keycloak/keys/KeyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/keys/KeyProvider.java
index 31ca54194f..5eebe818eb 100644
--- a/server-spi/src/main/java/org/keycloak/keys/KeyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/keys/KeyProvider.java
@@ -21,7 +21,6 @@ import org.keycloak.provider.Provider;
 
 import java.security.PrivateKey;
 import java.security.PublicKey;
-import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.List;
 
diff --git a/server-spi/src/main/java/org/keycloak/keys/KeyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/keys/KeyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/KeyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/keys/KeyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/KeySpi.java b/server-spi-private/src/main/java/org/keycloak/keys/KeySpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/KeySpi.java
rename to server-spi-private/src/main/java/org/keycloak/keys/KeySpi.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/PublicKeyLoader.java b/server-spi-private/src/main/java/org/keycloak/keys/PublicKeyLoader.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/PublicKeyLoader.java
rename to server-spi-private/src/main/java/org/keycloak/keys/PublicKeyLoader.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageProvider.java b/server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageProvider.java
rename to server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageSpi.java b/server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/keys/PublicKeyStorageSpi.java
rename to server-spi-private/src/main/java/org/keycloak/keys/PublicKeyStorageSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/mappers/FederationConfigValidationException.java b/server-spi-private/src/main/java/org/keycloak/mappers/FederationConfigValidationException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/mappers/FederationConfigValidationException.java
rename to server-spi-private/src/main/java/org/keycloak/mappers/FederationConfigValidationException.java
diff --git a/server-spi/src/main/java/org/keycloak/mappers/UserFederationMapper.java b/server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapper.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/mappers/UserFederationMapper.java
rename to server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapper.java
diff --git a/server-spi/src/main/java/org/keycloak/mappers/UserFederationMapperFactory.java b/server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapperFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/mappers/UserFederationMapperFactory.java
rename to server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapperFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/mappers/UserFederationMapperSpi.java b/server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapperSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/mappers/UserFederationMapperSpi.java
rename to server-spi-private/src/main/java/org/keycloak/mappers/UserFederationMapperSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/MigrationModelManager.java b/server-spi-private/src/main/java/org/keycloak/migration/MigrationModelManager.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/MigrationModelManager.java
rename to server-spi-private/src/main/java/org/keycloak/migration/MigrationModelManager.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/MigrationProvider.java b/server-spi-private/src/main/java/org/keycloak/migration/MigrationProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/MigrationProvider.java
rename to server-spi-private/src/main/java/org/keycloak/migration/MigrationProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/MigrationProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/migration/MigrationProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/MigrationProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/migration/MigrationProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/MigrationSpi.java b/server-spi-private/src/main/java/org/keycloak/migration/MigrationSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/MigrationSpi.java
rename to server-spi-private/src/main/java/org/keycloak/migration/MigrationSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/ModelVersion.java b/server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/ModelVersion.java
rename to server-spi-private/src/main/java/org/keycloak/migration/ModelVersion.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_2_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_2_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_2_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_2_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_3_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_3_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_3_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_3_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_4_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_4_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_4_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_4_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_5_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_5_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_5_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_5_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_6_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_6_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_6_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_6_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_7_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_7_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_7_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_7_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_8_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_8_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_8_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_8_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_2.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_2.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_2.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo1_9_2.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_0_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_0_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_0_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_0_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_1_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_1_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_1_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_1_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_2_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_2_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_2_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_2_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_3_0.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_3_0.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrateTo2_3_0.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrateTo2_3_0.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/Migration.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/Migration.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/Migration.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/Migration.java
diff --git a/server-spi/src/main/java/org/keycloak/migration/migrators/MigrationUtils.java b/server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrationUtils.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/migration/migrators/MigrationUtils.java
rename to server-spi-private/src/main/java/org/keycloak/migration/migrators/MigrationUtils.java
diff --git a/server-spi/src/main/java/org/keycloak/models/AccountRoles.java b/server-spi-private/src/main/java/org/keycloak/models/AccountRoles.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/AccountRoles.java
rename to server-spi-private/src/main/java/org/keycloak/models/AccountRoles.java
diff --git a/server-spi/src/main/java/org/keycloak/models/AdminRoles.java b/server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/AdminRoles.java
rename to server-spi-private/src/main/java/org/keycloak/models/AdminRoles.java
diff --git a/server-spi/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java b/server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
rename to server-spi-private/src/main/java/org/keycloak/models/BrowserSecurityHeaders.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ClaimMask.java b/server-spi-private/src/main/java/org/keycloak/models/ClaimMask.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ClaimMask.java
rename to server-spi-private/src/main/java/org/keycloak/models/ClaimMask.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ClientConfigResolver.java b/server-spi-private/src/main/java/org/keycloak/models/ClientConfigResolver.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ClientConfigResolver.java
rename to server-spi-private/src/main/java/org/keycloak/models/ClientConfigResolver.java
diff --git a/server-spi/src/main/java/org/keycloak/models/Constants.java b/server-spi-private/src/main/java/org/keycloak/models/Constants.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/Constants.java
rename to server-spi-private/src/main/java/org/keycloak/models/Constants.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ImpersonationConstants.java b/server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ImpersonationConstants.java
rename to server-spi-private/src/main/java/org/keycloak/models/ImpersonationConstants.java
diff --git a/server-spi/src/main/java/org/keycloak/models/LDAPConstants.java b/server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/LDAPConstants.java
rename to server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java b/server-spi-private/src/main/java/org/keycloak/models/ModelDuplicateException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ModelDuplicateException.java
rename to server-spi-private/src/main/java/org/keycloak/models/ModelDuplicateException.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ModelException.java b/server-spi-private/src/main/java/org/keycloak/models/ModelException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ModelException.java
rename to server-spi-private/src/main/java/org/keycloak/models/ModelException.java
diff --git a/server-spi/src/main/java/org/keycloak/models/ModelReadOnlyException.java b/server-spi-private/src/main/java/org/keycloak/models/ModelReadOnlyException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/ModelReadOnlyException.java
rename to server-spi-private/src/main/java/org/keycloak/models/ModelReadOnlyException.java
diff --git a/server-spi/src/main/java/org/keycloak/models/RealmProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/RealmProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/RealmProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/RealmProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/RealmSpi.java b/server-spi-private/src/main/java/org/keycloak/models/RealmSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/RealmSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/RealmSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserFederationEventAwareProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/UserFederationEventAwareProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserFederationEventAwareProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserFederationEventAwareProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserFederationProviderCreationEventImpl.java b/server-spi-private/src/main/java/org/keycloak/models/UserFederationProviderCreationEventImpl.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserFederationProviderCreationEventImpl.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserFederationProviderCreationEventImpl.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserFederationSpi.java b/server-spi-private/src/main/java/org/keycloak/models/UserFederationSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserFederationSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserFederationSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserFederationValidatingProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/UserFederationValidatingProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserFederationValidatingProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserFederationValidatingProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/UserProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserSessionProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/UserSessionProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserSessionProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserSessionProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserSessionSpi.java b/server-spi-private/src/main/java/org/keycloak/models/UserSessionSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserSessionSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserSessionSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/UserSpi.java b/server-spi-private/src/main/java/org/keycloak/models/UserSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/UserSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/UserSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProvider.java b/server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProvider.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProviderSpi.java b/server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProviderSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/CacheRealmProviderSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/CacheRealmProviderSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java b/server-spi-private/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/CachedRealmModel.java b/server-spi-private/src/main/java/org/keycloak/models/cache/CachedRealmModel.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/CachedRealmModel.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/CachedRealmModel.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/UserCacheProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/cache/UserCacheProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/UserCacheProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/UserCacheProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactoryProvider.java b/server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactoryProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactoryProvider.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactoryProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactorySpi.java b/server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactorySpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactorySpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreFactorySpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/cache/authorization/CachedStoreProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/cache/authorization/CachedStoreProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/dblock/DBLockManager.java b/server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockManager.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/dblock/DBLockManager.java
rename to server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockManager.java
diff --git a/server-spi/src/main/java/org/keycloak/models/dblock/DBLockProvider.java b/server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/dblock/DBLockProvider.java
rename to server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/models/dblock/DBLockProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/dblock/DBLockProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/dblock/DBLockSpi.java b/server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/dblock/DBLockSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/dblock/DBLockSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/DisabledUserSessionPersisterProvider.java b/server-spi-private/src/main/java/org/keycloak/models/session/DisabledUserSessionPersisterProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/DisabledUserSessionPersisterProvider.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/DisabledUserSessionPersisterProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/PersistentClientSessionAdapter.java b/server-spi-private/src/main/java/org/keycloak/models/session/PersistentClientSessionAdapter.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/PersistentClientSessionAdapter.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/PersistentClientSessionAdapter.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/PersistentClientSessionModel.java b/server-spi-private/src/main/java/org/keycloak/models/session/PersistentClientSessionModel.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/PersistentClientSessionModel.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/PersistentClientSessionModel.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java b/server-spi-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/PersistentUserSessionModel.java b/server-spi-private/src/main/java/org/keycloak/models/session/PersistentUserSessionModel.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/PersistentUserSessionModel.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/PersistentUserSessionModel.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/UserSessionPersisterProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/models/session/UserSessionPersisterProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/UserSessionPersisterProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/UserSessionPersisterProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/models/session/UserSessionPersisterSpi.java b/server-spi-private/src/main/java/org/keycloak/models/session/UserSessionPersisterSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/session/UserSessionPersisterSpi.java
rename to server-spi-private/src/main/java/org/keycloak/models/session/UserSessionPersisterSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/ComponentUtil.java b/server-spi-private/src/main/java/org/keycloak/models/utils/ComponentUtil.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/ComponentUtil.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/ComponentUtil.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/CredentialValidation.java b/server-spi-private/src/main/java/org/keycloak/models/utils/CredentialValidation.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/CredentialValidation.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/CredentialValidation.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/DefaultAuthenticationFlows.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/DefaultKeyProviders.java b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultKeyProviders.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/DefaultKeyProviders.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/DefaultKeyProviders.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java b/server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/DefaultRequiredActions.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/FormMessage.java b/server-spi-private/src/main/java/org/keycloak/models/utils/FormMessage.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/FormMessage.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/FormMessage.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java b/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
similarity index 89%
rename from server-spi/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
index 7edfea5a14..4f355a504d 100755
--- a/server-spi/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
+++ b/server-spi-private/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
@@ -256,75 +256,6 @@ public final class KeycloakModelUtils {
         return realmName + "-realm";
     }
 
-    /**
-     * @param roles
-     * @param targetRole
-     * @return true if targetRole is in roles (directly or indirectly via composite role)
-     */
-    public static boolean hasRole(Set<RoleModel> roles, RoleModel targetRole) {
-        if (roles.contains(targetRole)) return true;
-
-        for (RoleModel mapping : roles) {
-            if (mapping.hasRole(targetRole)) return true;
-        }
-        return false;
-    }
-
-    /**
-     * Checks whether the {@code targetRole} is contained in the given group or its parents
-     * (if requested)
-     * @param group Group to check role for
-     * @param targetRole
-     * @param checkParentGroup When {@code true}, also parent group is recursively checked for role
-     * @return true if targetRole is in roles (directly or indirectly via composite role)
-     */
-    public static boolean hasRoleFromGroup(GroupModel group, RoleModel targetRole, boolean checkParentGroup) {
-        if (group.hasRole(targetRole))
-            return true;
-
-        if (checkParentGroup) {
-            GroupModel parent = group.getParent();
-            return parent != null && hasRoleFromGroup(parent, targetRole, true);
-        }
-
-        return false;
-    }
-
-    /**
-     * Checks whether the {@code targetRole} is contained in any of the {@code groups} or their parents
-     * (if requested)
-     * @param groups
-     * @param targetRole
-     * @param checkParentGroup When {@code true}, also parent group is recursively checked for role
-     * @return true if targetRole is in roles (directly or indirectly via composite role)
-     */
-    public static boolean hasRoleFromGroup(Iterable<GroupModel> groups, RoleModel targetRole, boolean checkParentGroup) {
-        if (groups == null) {
-            return false;
-        }
-
-        return StreamSupport.stream(groups.spliterator(), false)
-          .anyMatch(group -> hasRoleFromGroup(group, targetRole, checkParentGroup));
-    }
-
-    /**
-     *
-     * @param groups
-     * @param targetGroup
-     * @return true if targetGroup is in groups (directly or indirectly via parent child relationship)
-     */
-    public static boolean isMember(Set<GroupModel> groups, GroupModel targetGroup) {
-        if (groups.contains(targetGroup)) return true;
-
-        for (GroupModel mapping : groups) {
-            GroupModel child = mapping;
-            while(child.getParent() != null) {
-                if (child.getParent().equals(targetGroup)) return true;
-                child = child.getParent();
-            }
-        }
-        return false;
-    }
     // USER FEDERATION RELATED STUFF
 
     /**
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java b/server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/PostMigrationEvent.java b/server-spi-private/src/main/java/org/keycloak/models/utils/PostMigrationEvent.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/PostMigrationEvent.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/PostMigrationEvent.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/RealmImporter.java b/server-spi-private/src/main/java/org/keycloak/models/utils/RealmImporter.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/RealmImporter.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/RealmImporter.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/RealmInfoUtil.java b/server-spi-private/src/main/java/org/keycloak/models/utils/RealmInfoUtil.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/RealmInfoUtil.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/RealmInfoUtil.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/RepresentationToModel.java b/server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/SHAPasswordEncoder.java b/server-spi-private/src/main/java/org/keycloak/models/utils/SHAPasswordEncoder.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/SHAPasswordEncoder.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/SHAPasswordEncoder.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java b/server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/StripSecretsUtils.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/TimeBasedOTP.java b/server-spi-private/src/main/java/org/keycloak/models/utils/TimeBasedOTP.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/TimeBasedOTP.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/TimeBasedOTP.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/UserModelDelegate.java b/server-spi-private/src/main/java/org/keycloak/models/utils/UserModelDelegate.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/UserModelDelegate.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/UserModelDelegate.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/AnnotatedPropertyCriteria.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/AnnotatedPropertyCriteria.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/AnnotatedPropertyCriteria.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/AnnotatedPropertyCriteria.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/MethodProperty.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/MethodProperty.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/MethodProperty.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/MethodProperty.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/MethodPropertyImpl.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/MethodPropertyImpl.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/MethodPropertyImpl.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/MethodPropertyImpl.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/NamedPropertyCriteria.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/NamedPropertyCriteria.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/NamedPropertyCriteria.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/NamedPropertyCriteria.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/Properties.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/Properties.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/Properties.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/Properties.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/Property.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/Property.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/Property.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/Property.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyQueries.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyQueries.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyQueries.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyQueries.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyQuery.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyQuery.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/PropertyQuery.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/PropertyQuery.java
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/reflection/TypedPropertyCriteria.java b/server-spi-private/src/main/java/org/keycloak/models/utils/reflection/TypedPropertyCriteria.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/models/utils/reflection/TypedPropertyCriteria.java
rename to server-spi-private/src/main/java/org/keycloak/models/utils/reflection/TypedPropertyCriteria.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/DefaultPasswordPolicyManagerProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/DigitsPasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java
similarity index 96%
rename from server-spi/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java
index 114447834d..b9f6f4ce41 100644
--- a/server-spi/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/ForceExpiredPasswordPolicyProviderFactory.java
@@ -20,6 +20,7 @@ package org.keycloak.policy;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 
@@ -28,7 +29,6 @@ import org.keycloak.models.UserModel;
  */
 public class ForceExpiredPasswordPolicyProviderFactory implements PasswordPolicyProviderFactory, PasswordPolicyProvider {
 
-    public static final String ID = "forceExpiredPasswordChange";
     public static final int DEFAULT_VALUE = 365;
 
     @Override
@@ -50,7 +50,7 @@ public class ForceExpiredPasswordPolicyProviderFactory implements PasswordPolicy
 
     @Override
     public String getId() {
-        return ID;
+        return PasswordPolicy.FORCE_EXPIRED_ID;
     }
 
     @Override
diff --git a/server-spi/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java
similarity index 90%
rename from server-spi/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java
index e7daaabba0..303ba7993f 100644
--- a/server-spi/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/HashAlgorithmPasswordPolicyProviderFactory.java
@@ -20,6 +20,7 @@ package org.keycloak.policy;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 
@@ -28,10 +29,6 @@ import org.keycloak.models.UserModel;
  */
 public class HashAlgorithmPasswordPolicyProviderFactory implements PasswordPolicyProviderFactory, PasswordPolicyProvider {
 
-    public static final String DEFAULT_VALUE = "pbkdf2";
-
-    public static final String ID = "hashAlgorithm";
-
     @Override
     public PasswordPolicyProvider create(KeycloakSession session) {
         return this;
@@ -51,7 +48,7 @@ public class HashAlgorithmPasswordPolicyProviderFactory implements PasswordPolic
 
     @Override
     public String getId() {
-        return ID;
+        return PasswordPolicy.HASH_ALGORITHM_ID;
     }
 
     @Override
@@ -76,7 +73,7 @@ public class HashAlgorithmPasswordPolicyProviderFactory implements PasswordPolic
 
     @Override
     public String getDefaultConfigValue() {
-        return DEFAULT_VALUE;
+        return PasswordPolicy.HASH_ALGORITHM_DEFAULT;
     }
 
     @Override
@@ -86,7 +83,7 @@ public class HashAlgorithmPasswordPolicyProviderFactory implements PasswordPolic
 
     @Override
     public Object parseConfig(String value) {
-        return value != null ? value : DEFAULT_VALUE;
+        return value != null ? value : PasswordPolicy.HASH_ALGORITHM_DEFAULT;
     }
 
 }
diff --git a/server-spi/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java
similarity index 89%
rename from server-spi/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java
index ae9d497e23..695ab282ea 100644
--- a/server-spi/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/HashIterationsPasswordPolicyProviderFactory.java
@@ -20,6 +20,7 @@ package org.keycloak.policy;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 
@@ -28,9 +29,6 @@ import org.keycloak.models.UserModel;
  */
 public class HashIterationsPasswordPolicyProviderFactory implements PasswordPolicyProvider, PasswordPolicyProviderFactory {
 
-    public static final int DEFAULT_VALUE = 20000;
-
-    public static final String ID = "hashIterations";
 
     @Override
     public PasswordPolicyProvider create(KeycloakSession session) {
@@ -47,7 +45,7 @@ public class HashIterationsPasswordPolicyProviderFactory implements PasswordPoli
 
     @Override
     public String getId() {
-        return ID;
+        return PasswordPolicy.HASH_ITERATIONS_ID;
     }
 
     @Override
@@ -62,7 +60,7 @@ public class HashIterationsPasswordPolicyProviderFactory implements PasswordPoli
 
     @Override
     public Object parseConfig(String value) {
-        return value != null ? Integer.parseInt(value) : DEFAULT_VALUE;
+        return value != null ? Integer.parseInt(value) : PasswordPolicy.HASH_ITERATIONS_DEFAULT;
     }
 
     @Override
@@ -77,7 +75,7 @@ public class HashIterationsPasswordPolicyProviderFactory implements PasswordPoli
 
     @Override
     public String getDefaultConfigValue() {
-        return String.valueOf(DEFAULT_VALUE);
+        return String.valueOf(PasswordPolicy.HASH_ITERATIONS_DEFAULT);
     }
 
     @Override
diff --git a/server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java
similarity index 98%
rename from server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java
index 154ea56b39..004d54028e 100644
--- a/server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProvider.java
@@ -49,7 +49,7 @@ public class HistoryPasswordPolicyProvider implements PasswordPolicyProvider {
     @Override
     public PolicyError validate(RealmModel realm, UserModel user, String password) {
         PasswordPolicy policy = session.getContext().getRealm().getPasswordPolicy();
-        int passwordHistoryPolicyValue = policy.getPolicyConfig(HistoryPasswordPolicyProviderFactory.ID);
+        int passwordHistoryPolicyValue = policy.getPolicyConfig(PasswordPolicy.PASSWORD_HISTORY_ID);
         if (passwordHistoryPolicyValue != -1) {
             List<CredentialModel> storedPasswords = session.userCredentialManager().getStoredCredentialsByType(realm, user, CredentialModel.PASSWORD);
             for (CredentialModel cred : storedPasswords) {
diff --git a/server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java
similarity index 95%
rename from server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java
index c2c180a020..5f8a9d1888 100644
--- a/server-spi/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java
+++ b/server-spi-private/src/main/java/org/keycloak/policy/HistoryPasswordPolicyProviderFactory.java
@@ -20,18 +20,18 @@ package org.keycloak.policy;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.PasswordPolicy;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public class HistoryPasswordPolicyProviderFactory implements PasswordPolicyProviderFactory {
 
-    public static final String ID = "passwordHistory";
     public static final Integer DEFAULT_VALUE = 3;
 
     @Override
     public String getId() {
-        return ID;
+        return PasswordPolicy.PASSWORD_HISTORY_ID;
     }
 
     @Override
diff --git a/server-spi/src/main/java/org/keycloak/policy/LengthPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/LengthPasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/LengthPasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/LengthPasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/LengthPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/LengthPasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/LengthPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/LengthPasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/LowerCasePasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/NotUsernamePasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerSpi.java b/server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/PasswordPolicyManagerSpi.java
rename to server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyManagerSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/PasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/PasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/PasswordPolicySpi.java b/server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicySpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/PasswordPolicySpi.java
rename to server-spi-private/src/main/java/org/keycloak/policy/PasswordPolicySpi.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/RegexPatternsPasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/SpecialCharsPasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProvider.java b/server-spi-private/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProvider.java
rename to server-spi-private/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/policy/UpperCasePasswordPolicyProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/AbstractLoginProtocolFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/ClientInstallationProvider.java b/server-spi-private/src/main/java/org/keycloak/protocol/ClientInstallationProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/ClientInstallationProvider.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/ClientInstallationProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/ClientInstallationSpi.java b/server-spi-private/src/main/java/org/keycloak/protocol/ClientInstallationSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/ClientInstallationSpi.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/ClientInstallationSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/LoginProtocol.java b/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocol.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/LoginProtocol.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocol.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/LoginProtocolSpi.java b/server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/LoginProtocolSpi.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/LoginProtocolSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/ProtocolMapper.java b/server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapper.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/ProtocolMapper.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapper.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/ProtocolMapperConfigException.java b/server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapperConfigException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/ProtocolMapperConfigException.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapperConfigException.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/ProtocolMapperSpi.java b/server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapperSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/ProtocolMapperSpi.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/ProtocolMapperSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProvider.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProvider.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionSpi.java b/server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionSpi.java
rename to server-spi-private/src/main/java/org/keycloak/protocol/oidc/TokenIntrospectionSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/provider/ConfigurationValidationHelper.java b/server-spi-private/src/main/java/org/keycloak/provider/ConfigurationValidationHelper.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/provider/ConfigurationValidationHelper.java
rename to server-spi-private/src/main/java/org/keycloak/provider/ConfigurationValidationHelper.java
diff --git a/server-spi/src/main/java/org/keycloak/provider/EnvironmentDependentProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/provider/EnvironmentDependentProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/provider/EnvironmentDependentProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/provider/EnvironmentDependentProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/provider/ProviderLoader.java b/server-spi-private/src/main/java/org/keycloak/provider/ProviderLoader.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/provider/ProviderLoader.java
rename to server-spi-private/src/main/java/org/keycloak/provider/ProviderLoader.java
diff --git a/server-spi/src/main/java/org/keycloak/provider/ProviderLoaderFactory.java b/server-spi-private/src/main/java/org/keycloak/provider/ProviderLoaderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/provider/ProviderLoaderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/provider/ProviderLoaderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/provider/ServerInfoAwareProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/provider/ServerInfoAwareProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/provider/ServerInfoAwareProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/provider/ServerInfoAwareProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/InvocableScriptAdapter.java b/server-spi-private/src/main/java/org/keycloak/scripting/InvocableScriptAdapter.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/InvocableScriptAdapter.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/InvocableScriptAdapter.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/Script.java b/server-spi-private/src/main/java/org/keycloak/scripting/Script.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/Script.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/Script.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/ScriptBindingsConfigurer.java b/server-spi-private/src/main/java/org/keycloak/scripting/ScriptBindingsConfigurer.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/ScriptBindingsConfigurer.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/ScriptBindingsConfigurer.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/ScriptExecutionException.java b/server-spi-private/src/main/java/org/keycloak/scripting/ScriptExecutionException.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/ScriptExecutionException.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/ScriptExecutionException.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/ScriptingProvider.java b/server-spi-private/src/main/java/org/keycloak/scripting/ScriptingProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/ScriptingProvider.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/ScriptingProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/ScriptingProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/scripting/ScriptingProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/ScriptingProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/ScriptingProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/scripting/ScriptingSpi.java b/server-spi-private/src/main/java/org/keycloak/scripting/ScriptingSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/scripting/ScriptingSpi.java
rename to server-spi-private/src/main/java/org/keycloak/scripting/ScriptingSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtector.java b/server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtector.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtector.java
rename to server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtector.java
diff --git a/server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorFactory.java b/server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtectorFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorFactory.java
rename to server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtectorFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorSpi.java b/server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtectorSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/managers/BruteForceProtectorSpi.java
rename to server-spi-private/src/main/java/org/keycloak/services/managers/BruteForceProtectorSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/services/managers/ClientSessionCode.java b/server-spi-private/src/main/java/org/keycloak/services/managers/ClientSessionCode.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/managers/ClientSessionCode.java
rename to server-spi-private/src/main/java/org/keycloak/services/managers/ClientSessionCode.java
diff --git a/server-spi/src/main/java/org/keycloak/services/resource/RealmResourceProvider.java b/server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/resource/RealmResourceProvider.java
rename to server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/services/resource/RealmResourceProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/resource/RealmResourceProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/services/resource/RealmResourceSPI.java b/server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceSPI.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/services/resource/RealmResourceSPI.java
rename to server-spi-private/src/main/java/org/keycloak/services/resource/RealmResourceSPI.java
diff --git a/server-spi/src/main/java/org/keycloak/theme/Theme.java b/server-spi-private/src/main/java/org/keycloak/theme/Theme.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/theme/Theme.java
rename to server-spi-private/src/main/java/org/keycloak/theme/Theme.java
diff --git a/server-spi/src/main/java/org/keycloak/theme/ThemeProvider.java b/server-spi-private/src/main/java/org/keycloak/theme/ThemeProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/theme/ThemeProvider.java
rename to server-spi-private/src/main/java/org/keycloak/theme/ThemeProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/theme/ThemeProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/theme/ThemeProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/theme/ThemeProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/theme/ThemeProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/theme/ThemeSpi.java b/server-spi-private/src/main/java/org/keycloak/theme/ThemeSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/theme/ThemeSpi.java
rename to server-spi-private/src/main/java/org/keycloak/theme/ThemeSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/timer/ScheduledTask.java b/server-spi-private/src/main/java/org/keycloak/timer/ScheduledTask.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/timer/ScheduledTask.java
rename to server-spi-private/src/main/java/org/keycloak/timer/ScheduledTask.java
diff --git a/server-spi/src/main/java/org/keycloak/timer/TimerProvider.java b/server-spi-private/src/main/java/org/keycloak/timer/TimerProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/timer/TimerProvider.java
rename to server-spi-private/src/main/java/org/keycloak/timer/TimerProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/timer/TimerProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/timer/TimerProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/timer/TimerProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/timer/TimerProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/timer/TimerSpi.java b/server-spi-private/src/main/java/org/keycloak/timer/TimerSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/timer/TimerSpi.java
rename to server-spi-private/src/main/java/org/keycloak/timer/TimerSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/transaction/JtaTransactionManagerLookup.java b/server-spi-private/src/main/java/org/keycloak/transaction/JtaTransactionManagerLookup.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/transaction/JtaTransactionManagerLookup.java
rename to server-spi-private/src/main/java/org/keycloak/transaction/JtaTransactionManagerLookup.java
diff --git a/server-spi/src/main/java/org/keycloak/transaction/TransactionManagerLookupSpi.java b/server-spi-private/src/main/java/org/keycloak/transaction/TransactionManagerLookupSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/transaction/TransactionManagerLookupSpi.java
rename to server-spi-private/src/main/java/org/keycloak/transaction/TransactionManagerLookupSpi.java
diff --git a/server-spi/src/main/java/org/keycloak/truststore/HostnameVerificationPolicy.java b/server-spi-private/src/main/java/org/keycloak/truststore/HostnameVerificationPolicy.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/truststore/HostnameVerificationPolicy.java
rename to server-spi-private/src/main/java/org/keycloak/truststore/HostnameVerificationPolicy.java
diff --git a/server-spi/src/main/java/org/keycloak/truststore/TruststoreProvider.java b/server-spi-private/src/main/java/org/keycloak/truststore/TruststoreProvider.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/truststore/TruststoreProvider.java
rename to server-spi-private/src/main/java/org/keycloak/truststore/TruststoreProvider.java
diff --git a/server-spi/src/main/java/org/keycloak/truststore/TruststoreProviderFactory.java b/server-spi-private/src/main/java/org/keycloak/truststore/TruststoreProviderFactory.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/truststore/TruststoreProviderFactory.java
rename to server-spi-private/src/main/java/org/keycloak/truststore/TruststoreProviderFactory.java
diff --git a/server-spi/src/main/java/org/keycloak/truststore/TruststoreSpi.java b/server-spi-private/src/main/java/org/keycloak/truststore/TruststoreSpi.java
similarity index 100%
rename from server-spi/src/main/java/org/keycloak/truststore/TruststoreSpi.java
rename to server-spi-private/src/main/java/org/keycloak/truststore/TruststoreSpi.java
diff --git a/server-spi/src/main/resources/META-INF/services/org.keycloak.models.session.UserSessionPersisterProviderFactory b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.models.session.UserSessionPersisterProviderFactory
similarity index 100%
rename from server-spi/src/main/resources/META-INF/services/org.keycloak.models.session.UserSessionPersisterProviderFactory
rename to server-spi-private/src/main/resources/META-INF/services/org.keycloak.models.session.UserSessionPersisterProviderFactory
diff --git a/server-spi/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyManagerProviderFactory b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyManagerProviderFactory
similarity index 100%
rename from server-spi/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyManagerProviderFactory
rename to server-spi-private/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyManagerProviderFactory
diff --git a/server-spi/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyProviderFactory b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyProviderFactory
similarity index 100%
rename from server-spi/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyProviderFactory
rename to server-spi-private/src/main/resources/META-INF/services/org.keycloak.policy.PasswordPolicyProviderFactory
diff --git a/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
new file mode 100755
index 0000000000..bbd588ea50
--- /dev/null
+++ b/server-spi-private/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -0,0 +1,68 @@
+#
+# Copyright 2016 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.models.UserFederationSpi
+org.keycloak.storage.UserStorageProviderSpi
+org.keycloak.storage.federated.UserFederatedStorageProviderSpi
+org.keycloak.mappers.UserFederationMapperSpi
+org.keycloak.models.RealmSpi
+org.keycloak.models.UserSessionSpi
+org.keycloak.models.UserSpi
+org.keycloak.models.session.UserSessionPersisterSpi
+org.keycloak.models.dblock.DBLockSpi
+org.keycloak.migration.MigrationSpi
+org.keycloak.events.EventListenerSpi
+org.keycloak.events.EventStoreSpi
+org.keycloak.exportimport.ExportSpi
+org.keycloak.exportimport.ImportSpi
+org.keycloak.timer.TimerSpi
+org.keycloak.scripting.ScriptingSpi
+org.keycloak.services.managers.BruteForceProtectorSpi
+org.keycloak.services.resource.RealmResourceSPI
+org.keycloak.protocol.ClientInstallationSpi
+org.keycloak.protocol.LoginProtocolSpi
+org.keycloak.protocol.ProtocolMapperSpi
+org.keycloak.broker.provider.IdentityProviderSpi
+org.keycloak.broker.provider.IdentityProviderMapperSpi
+org.keycloak.broker.social.SocialProviderSpi
+org.keycloak.forms.account.AccountSpi
+org.keycloak.forms.login.LoginFormsSpi
+org.keycloak.email.EmailSenderSpi
+org.keycloak.email.EmailTemplateSpi
+org.keycloak.theme.ThemeSpi
+org.keycloak.truststore.TruststoreSpi
+org.keycloak.connections.httpclient.HttpClientSpi
+org.keycloak.models.cache.CacheRealmProviderSpi
+org.keycloak.models.cache.CacheUserProviderSpi
+org.keycloak.authentication.AuthenticatorSpi
+org.keycloak.authentication.ClientAuthenticatorSpi
+org.keycloak.authentication.RequiredActionSpi
+org.keycloak.authentication.FormAuthenticatorSpi
+org.keycloak.authentication.FormActionSpi
+org.keycloak.cluster.ClusterSpi
+org.keycloak.authorization.policy.provider.PolicySpi
+org.keycloak.authorization.store.StoreFactorySpi
+org.keycloak.authorization.AuthorizationSpi
+org.keycloak.models.cache.authorization.CachedStoreFactorySpi
+org.keycloak.protocol.oidc.TokenIntrospectionSpi
+org.keycloak.policy.PasswordPolicySpi
+org.keycloak.policy.PasswordPolicyManagerSpi
+org.keycloak.transaction.TransactionManagerLookupSpi
+org.keycloak.credential.hash.PasswordHashSpi
+org.keycloak.credential.CredentialSpi
+org.keycloak.keys.PublicKeyStorageSpi
+org.keycloak.keys.KeySpi
\ No newline at end of file
diff --git a/server-spi/src/test/java/org/keycloak/models/HmacTest.java b/server-spi-private/src/test/java/org/keycloak/models/HmacTest.java
similarity index 100%
rename from server-spi/src/test/java/org/keycloak/models/HmacTest.java
rename to server-spi-private/src/test/java/org/keycloak/models/HmacTest.java
diff --git a/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java b/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
index e644a8095c..be5f55189f 100755
--- a/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
+++ b/server-spi/src/main/java/org/keycloak/models/KeycloakContext.java
@@ -18,7 +18,6 @@
 package org.keycloak.models;
 
 import org.keycloak.common.ClientConnection;
-import org.keycloak.models.utils.RealmImporter;
 
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.UriInfo;
@@ -52,8 +51,6 @@ public interface KeycloakContext {
 
     void setConnection(ClientConnection connection);
 
-    RealmImporter getRealmManager();
-
     Locale resolveLocale(UserModel user);
 
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/KeycloakSession.java b/server-spi/src/main/java/org/keycloak/models/KeycloakSession.java
index cb1089192d..f3242eb73b 100755
--- a/server-spi/src/main/java/org/keycloak/models/KeycloakSession.java
+++ b/server-spi/src/main/java/org/keycloak/models/KeycloakSession.java
@@ -20,7 +20,6 @@ package org.keycloak.models;
 import org.keycloak.component.ComponentModel;
 import org.keycloak.models.cache.UserCache;
 import org.keycloak.provider.Provider;
-import org.keycloak.scripting.ScriptingProvider;
 import org.keycloak.storage.federated.UserFederatedStorageProvider;
 
 import java.util.Set;
@@ -157,8 +156,4 @@ public interface KeycloakSession {
      */
     KeyManager keys();
 
-    /**
-     * Keycloak scripting support.
-     */
-    ScriptingProvider scripting();
 }
diff --git a/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java b/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
index 95dfc5301e..8833c8a33c 100755
--- a/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
+++ b/server-spi/src/main/java/org/keycloak/models/PasswordPolicy.java
@@ -17,10 +17,6 @@
 
 package org.keycloak.models;
 
-import org.keycloak.policy.ForceExpiredPasswordPolicyProviderFactory;
-import org.keycloak.policy.HashAlgorithmPasswordPolicyProviderFactory;
-import org.keycloak.policy.HashIterationsPasswordPolicyProviderFactory;
-import org.keycloak.policy.HistoryPasswordPolicyProviderFactory;
 import org.keycloak.policy.PasswordPolicyProvider;
 
 import java.io.Serializable;
@@ -33,6 +29,18 @@ import java.util.Set;
  */
 public class PasswordPolicy implements Serializable {
 
+    public static final String HASH_ALGORITHM_ID = "hashAlgorithm";
+
+    public static final String HASH_ALGORITHM_DEFAULT = "pbkdf2";
+
+    public static final String HASH_ITERATIONS_ID = "hashIterations";
+
+    public static final int HASH_ITERATIONS_DEFAULT = 20000;
+
+    public static final String PASSWORD_HISTORY_ID = "passwordHistory";
+
+    public static final String FORCE_EXPIRED_ID = "forceExpiredPasswordChange";
+
     private String policyString;
     private Map<String, Object> policyConfig;
 
@@ -84,32 +92,32 @@ public class PasswordPolicy implements Serializable {
     }
 
     public String getHashAlgorithm() {
-        if (policyConfig.containsKey(HashAlgorithmPasswordPolicyProviderFactory.ID)) {
-            return getPolicyConfig(HashAlgorithmPasswordPolicyProviderFactory.ID);
+        if (policyConfig.containsKey(HASH_ALGORITHM_ID)) {
+            return getPolicyConfig(HASH_ALGORITHM_ID);
         } else {
-            return HashAlgorithmPasswordPolicyProviderFactory.DEFAULT_VALUE;
+            return HASH_ALGORITHM_DEFAULT;
         }
     }
 
     public int getHashIterations() {
-        if (policyConfig.containsKey(HashIterationsPasswordPolicyProviderFactory.ID)) {
-            return getPolicyConfig(HashIterationsPasswordPolicyProviderFactory.ID);
+        if (policyConfig.containsKey(HASH_ITERATIONS_ID)) {
+            return getPolicyConfig(HASH_ITERATIONS_ID);
         } else {
-            return HashIterationsPasswordPolicyProviderFactory.DEFAULT_VALUE;
+            return HASH_ITERATIONS_DEFAULT;
         }
     }
 
     public int getExpiredPasswords() {
-        if (policyConfig.containsKey(HistoryPasswordPolicyProviderFactory.ID)) {
-            return getPolicyConfig(HistoryPasswordPolicyProviderFactory.ID);
+        if (policyConfig.containsKey(PASSWORD_HISTORY_ID)) {
+            return getPolicyConfig(PASSWORD_HISTORY_ID);
         } else {
             return -1;
         }
     }
 
     public int getDaysToExpirePassword() {
-        if (policyConfig.containsKey(ForceExpiredPasswordPolicyProviderFactory.ID)) {
-            return getPolicyConfig(ForceExpiredPasswordPolicyProviderFactory.ID);
+        if (policyConfig.containsKey(FORCE_EXPIRED_ID)) {
+            return getPolicyConfig(FORCE_EXPIRED_ID);
         } else {
             return -1;
         }
diff --git a/server-spi/src/main/java/org/keycloak/models/UserFederationManager.java b/server-spi/src/main/java/org/keycloak/models/UserFederationManager.java
index 1765bad209..707b96ae3d 100755
--- a/server-spi/src/main/java/org/keycloak/models/UserFederationManager.java
+++ b/server-spi/src/main/java/org/keycloak/models/UserFederationManager.java
@@ -19,8 +19,6 @@ package org.keycloak.models;
 
 import org.jboss.logging.Logger;
 import org.keycloak.component.ComponentModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.services.managers.UserManager;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -74,7 +72,8 @@ public class UserFederationManager implements UserProvider {
     }
 
     public UserFederationProvider getFederationProvider(UserFederationProviderModel model) {
-        return KeycloakModelUtils.getFederationProviderInstance(session, model);
+        UserFederationProviderFactory factory = (UserFederationProviderFactory)session.getKeycloakSessionFactory().getProviderFactory(UserFederationProvider.class, model.getProviderName());
+        return factory.getInstance(session, model);
     }
 
     public UserFederationProvider getFederationLink(RealmModel realm, UserModel user) {
@@ -122,7 +121,7 @@ public class UserFederationManager implements UserProvider {
     }
 
     protected void deleteInvalidUser(final RealmModel realm, final UserModel user) {
-        KeycloakModelUtils.runJobInTransaction(session.getKeycloakSessionFactory(), new KeycloakSessionTask() {
+        runJobInTransaction(session.getKeycloakSessionFactory(), new KeycloakSessionTask() {
 
             @Override
             public void run(KeycloakSession session) {
@@ -136,6 +135,29 @@ public class UserFederationManager implements UserProvider {
         });
     }
 
+    private  static void runJobInTransaction(KeycloakSessionFactory factory, KeycloakSessionTask task) {
+        KeycloakSession session = factory.create();
+        KeycloakTransaction tx = session.getTransactionManager();
+        try {
+            tx.begin();
+            task.run(session);
+
+            if (tx.isActive()) {
+                if (tx.getRollbackOnly()) {
+                    tx.rollback();
+                } else {
+                    tx.commit();
+                }
+            }
+        } catch (RuntimeException re) {
+            if (tx.isActive()) {
+                tx.rollback();
+            }
+            throw re;
+        } finally {
+            session.close();
+        }
+    }
 
     protected UserModel validateAndProxyUser(RealmModel realm, UserModel user) {
         UserModel managed = managedUsers.get(user.getId());
diff --git a/server-spi/src/main/java/org/keycloak/services/managers/UserManager.java b/server-spi/src/main/java/org/keycloak/models/UserManager.java
similarity index 87%
rename from server-spi/src/main/java/org/keycloak/services/managers/UserManager.java
rename to server-spi/src/main/java/org/keycloak/models/UserManager.java
index d0e894782f..81b2b51a98 100755
--- a/server-spi/src/main/java/org/keycloak/services/managers/UserManager.java
+++ b/server-spi/src/main/java/org/keycloak/models/UserManager.java
@@ -15,13 +15,8 @@
  * limitations under the License.
  */
 
-package org.keycloak.services.managers;
+package org.keycloak.models;
 
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserProvider;
-import org.keycloak.models.UserSessionProvider;
 import org.keycloak.models.session.UserSessionPersisterProvider;
 
 /**
diff --git a/server-spi/src/main/java/org/keycloak/models/utils/RoleUtils.java b/server-spi/src/main/java/org/keycloak/models/utils/RoleUtils.java
new file mode 100644
index 0000000000..a03a55d9f0
--- /dev/null
+++ b/server-spi/src/main/java/org/keycloak/models/utils/RoleUtils.java
@@ -0,0 +1,101 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.models.utils;
+
+import org.keycloak.models.GroupModel;
+import org.keycloak.models.RoleModel;
+
+import java.util.Set;
+import java.util.stream.StreamSupport;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class RoleUtils {
+
+    /**
+     *
+     * @param groups
+     * @param targetGroup
+     * @return true if targetGroup is in groups (directly or indirectly via parent child relationship)
+     */
+    public static boolean isMember(Set<GroupModel> groups, GroupModel targetGroup) {
+        if (groups.contains(targetGroup)) return true;
+
+        for (GroupModel mapping : groups) {
+            GroupModel child = mapping;
+            while(child.getParent() != null) {
+                if (child.getParent().equals(targetGroup)) return true;
+                child = child.getParent();
+            }
+        }
+        return false;
+    }
+
+    /**
+     * @param roles
+     * @param targetRole
+     * @return true if targetRole is in roles (directly or indirectly via composite role)
+     */
+    public static boolean hasRole(Set<RoleModel> roles, RoleModel targetRole) {
+        if (roles.contains(targetRole)) return true;
+
+        for (RoleModel mapping : roles) {
+            if (mapping.hasRole(targetRole)) return true;
+        }
+        return false;
+    }
+
+    /**
+     * Checks whether the {@code targetRole} is contained in the given group or its parents
+     * (if requested)
+     * @param group Group to check role for
+     * @param targetRole
+     * @param checkParentGroup When {@code true}, also parent group is recursively checked for role
+     * @return true if targetRole is in roles (directly or indirectly via composite role)
+     */
+    public static boolean hasRoleFromGroup(GroupModel group, RoleModel targetRole, boolean checkParentGroup) {
+        if (group.hasRole(targetRole))
+            return true;
+
+        if (checkParentGroup) {
+            GroupModel parent = group.getParent();
+            return parent != null && hasRoleFromGroup(parent, targetRole, true);
+        }
+
+        return false;
+    }
+
+    /**
+     * Checks whether the {@code targetRole} is contained in any of the {@code groups} or their parents
+     * (if requested)
+     * @param groups
+     * @param targetRole
+     * @param checkParentGroup When {@code true}, also parent group is recursively checked for role
+     * @return true if targetRole is in roles (directly or indirectly via composite role)
+     */
+    public static boolean hasRoleFromGroup(Iterable<GroupModel> groups, RoleModel targetRole, boolean checkParentGroup) {
+        if (groups == null) {
+            return false;
+        }
+
+        return StreamSupport.stream(groups.spliterator(), false)
+                .anyMatch(group -> hasRoleFromGroup(group, targetRole, checkParentGroup));
+    }
+
+}
diff --git a/server-spi/src/main/java/org/keycloak/provider/Spi.java b/server-spi/src/main/java/org/keycloak/provider/Spi.java
index b9c47f8e5c..8043bcf2e0 100644
--- a/server-spi/src/main/java/org/keycloak/provider/Spi.java
+++ b/server-spi/src/main/java/org/keycloak/provider/Spi.java
@@ -17,9 +17,6 @@
 
 package org.keycloak.provider;
 
-import java.util.Collections;
-import java.util.List;
-
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
diff --git a/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapter.java b/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapter.java
index df6c37ab2a..c15902090e 100644
--- a/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapter.java
+++ b/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapter.java
@@ -26,7 +26,7 @@ import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.DefaultRoles;
-import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 import org.keycloak.storage.StorageId;
 
 import java.util.Collections;
@@ -135,7 +135,7 @@ public abstract class AbstractUserAdapter implements UserModel {
     @Override
     public boolean isMemberOf(GroupModel group) {
         Set<GroupModel> roles = getGroups();
-        return KeycloakModelUtils.isMember(roles, group);
+        return RoleUtils.isMember(roles, group);
     }
 
     @Override
@@ -172,8 +172,8 @@ public abstract class AbstractUserAdapter implements UserModel {
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role)
-          || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+        return RoleUtils.hasRole(roles, role)
+          || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
     }
 
     @Override
diff --git a/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapterFederatedStorage.java b/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapterFederatedStorage.java
index 865f454e2c..c93dac49b2 100644
--- a/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapterFederatedStorage.java
+++ b/server-spi/src/main/java/org/keycloak/storage/adapter/AbstractUserAdapterFederatedStorage.java
@@ -25,7 +25,7 @@ import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.DefaultRoles;
-import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RoleUtils;
 import org.keycloak.storage.StorageId;
 import org.keycloak.storage.federated.UserFederatedStorageProvider;
 
@@ -140,7 +140,7 @@ public abstract class AbstractUserAdapterFederatedStorage implements UserModel {
     @Override
     public boolean isMemberOf(GroupModel group) {
         Set<GroupModel> roles = getGroups();
-        return KeycloakModelUtils.isMember(roles, group);
+        return RoleUtils.isMember(roles, group);
     }
 
     @Override
@@ -177,8 +177,8 @@ public abstract class AbstractUserAdapterFederatedStorage implements UserModel {
     @Override
     public boolean hasRole(RoleModel role) {
         Set<RoleModel> roles = getRoleMappings();
-        return KeycloakModelUtils.hasRole(roles, role)
-          || KeycloakModelUtils.hasRoleFromGroup(getGroups(), role, true);
+        return RoleUtils.hasRole(roles, role)
+          || RoleUtils.hasRoleFromGroup(getGroups(), role, true);
     }
 
     @Override
diff --git a/server-spi/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/server-spi/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index bbd588ea50..c7ee4865c7 100755
--- a/server-spi/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/server-spi/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -15,54 +15,21 @@
 # limitations under the License.
 #
 
-org.keycloak.models.UserFederationSpi
-org.keycloak.storage.UserStorageProviderSpi
-org.keycloak.storage.federated.UserFederatedStorageProviderSpi
-org.keycloak.mappers.UserFederationMapperSpi
-org.keycloak.models.RealmSpi
-org.keycloak.models.UserSessionSpi
-org.keycloak.models.UserSpi
-org.keycloak.models.session.UserSessionPersisterSpi
-org.keycloak.models.dblock.DBLockSpi
-org.keycloak.migration.MigrationSpi
-org.keycloak.events.EventListenerSpi
-org.keycloak.events.EventStoreSpi
-org.keycloak.exportimport.ExportSpi
-org.keycloak.exportimport.ImportSpi
-org.keycloak.timer.TimerSpi
-org.keycloak.scripting.ScriptingSpi
-org.keycloak.services.managers.BruteForceProtectorSpi
-org.keycloak.services.resource.RealmResourceSPI
-org.keycloak.protocol.ClientInstallationSpi
-org.keycloak.protocol.LoginProtocolSpi
-org.keycloak.protocol.ProtocolMapperSpi
-org.keycloak.broker.provider.IdentityProviderSpi
-org.keycloak.broker.provider.IdentityProviderMapperSpi
-org.keycloak.broker.social.SocialProviderSpi
-org.keycloak.forms.account.AccountSpi
-org.keycloak.forms.login.LoginFormsSpi
-org.keycloak.email.EmailSenderSpi
-org.keycloak.email.EmailTemplateSpi
-org.keycloak.theme.ThemeSpi
-org.keycloak.truststore.TruststoreSpi
-org.keycloak.connections.httpclient.HttpClientSpi
-org.keycloak.models.cache.CacheRealmProviderSpi
-org.keycloak.models.cache.CacheUserProviderSpi
-org.keycloak.authentication.AuthenticatorSpi
-org.keycloak.authentication.ClientAuthenticatorSpi
-org.keycloak.authentication.RequiredActionSpi
-org.keycloak.authentication.FormAuthenticatorSpi
-org.keycloak.authentication.FormActionSpi
-org.keycloak.cluster.ClusterSpi
-org.keycloak.authorization.policy.provider.PolicySpi
-org.keycloak.authorization.store.StoreFactorySpi
-org.keycloak.authorization.AuthorizationSpi
-org.keycloak.models.cache.authorization.CachedStoreFactorySpi
-org.keycloak.protocol.oidc.TokenIntrospectionSpi
-org.keycloak.policy.PasswordPolicySpi
-org.keycloak.policy.PasswordPolicyManagerSpi
-org.keycloak.transaction.TransactionManagerLookupSpi
-org.keycloak.credential.hash.PasswordHashSpi
-org.keycloak.credential.CredentialSpi
-org.keycloak.keys.PublicKeyStorageSpi
-org.keycloak.keys.KeySpi
\ No newline at end of file
+#
+# Copyright 2016 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.storage.UserStorageProviderSpi
\ No newline at end of file
diff --git a/services/pom.xml b/services/pom.xml
index dc33a3db69..0fb68f7735 100755
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -63,6 +63,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.jboss.spec.javax.servlet</groupId>
             <artifactId>jboss-servlet-api_3.0_spec</artifactId>
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
index fdaa48187a..ef17476e33 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ConditionalOtpFormAuthenticator.java
@@ -20,6 +20,7 @@ package org.keycloak.authentication.authenticators.browser;
 import org.keycloak.authentication.AuthenticationFlowContext;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.RoleUtils;
 
 import javax.ws.rs.core.MultivaluedMap;
 import java.util.List;
@@ -30,7 +31,6 @@ import static org.keycloak.authentication.authenticators.browser.ConditionalOtpF
 import static org.keycloak.authentication.authenticators.browser.ConditionalOtpFormAuthenticator.OtpDecision.SHOW_OTP;
 import static org.keycloak.authentication.authenticators.browser.ConditionalOtpFormAuthenticator.OtpDecision.SKIP_OTP;
 import static org.keycloak.models.utils.KeycloakModelUtils.getRoleFromString;
-import static org.keycloak.models.utils.KeycloakModelUtils.hasRole;
 
 /**
  * An {@link OTPFormAuthenticator} that can conditionally require OTP authentication.
@@ -264,6 +264,6 @@ public class ConditionalOtpFormAuthenticator extends OTPFormAuthenticator {
         RoleModel role = getRoleFromString(context.getRealm(), roleName);
         UserModel user = context.getUser();
 
-        return hasRole(user.getRoleMappings(), role);
+        return RoleUtils.hasRole(user.getRoleMappings(), role);
     }
 }
diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ScriptBasedAuthenticator.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ScriptBasedAuthenticator.java
index 85a217ff1e..9bff3f9998 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/ScriptBasedAuthenticator.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/ScriptBasedAuthenticator.java
@@ -142,7 +142,7 @@ public class ScriptBasedAuthenticator implements Authenticator {
 
         RealmModel realm = context.getRealm();
 
-        ScriptingProvider scripting = context.getSession().scripting();
+        ScriptingProvider scripting = context.getSession().getProvider(ScriptingProvider.class);
 
         //TODO lookup script by scriptId instead of creating it every time
         ScriptModel script = scripting.createScript(realm.getId(), ScriptModel.TEXT_JAVASCRIPT, scriptName, scriptCode, scriptDescription);
diff --git a/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java b/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
index d0558abd8b..97a92ea9a3 100644
--- a/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
+++ b/services/src/main/java/org/keycloak/credential/PasswordCredentialProvider.java
@@ -140,7 +140,7 @@ public class PasswordCredentialProvider implements CredentialProvider, Credentia
         PasswordHashProvider hash = session.getProvider(PasswordHashProvider.class, policy.getHashAlgorithm());
         if (hash == null) {
             logger.warnv("Realm PasswordPolicy PasswordHashProvider {0} not found", policy.getHashAlgorithm());
-            return session.getProvider(PasswordHashProvider.class, HashAlgorithmPasswordPolicyProviderFactory.DEFAULT_VALUE);
+            return session.getProvider(PasswordHashProvider.class, PasswordPolicy.HASH_ALGORITHM_DEFAULT);
         }
         return hash;
     }
diff --git a/services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java b/services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
index 1ea409288e..2357a65df9 100755
--- a/services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
+++ b/services/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
@@ -108,7 +108,8 @@ public class ImportUtils {
             }
         }
 
-        RealmImporter realmManager = session.getContext().getRealmManager();
+        RealmManager realmManager = new RealmManager(session);
+        realmManager.setContextPath(session.getContext().getContextPath());
         realmManager.importRealm(rep);
 
         if (System.getProperty(ExportImportConfig.ACTION) != null) {
diff --git a/services/src/main/java/org/keycloak/keys/AbstractRsaKeyProvider.java b/services/src/main/java/org/keycloak/keys/AbstractRsaKeyProvider.java
index c5f09f16b2..f6bbaeb183 100644
--- a/services/src/main/java/org/keycloak/keys/AbstractRsaKeyProvider.java
+++ b/services/src/main/java/org/keycloak/keys/AbstractRsaKeyProvider.java
@@ -23,7 +23,6 @@ import org.keycloak.models.RealmModel;
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.security.PublicKey;
-import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.List;
diff --git a/services/src/main/java/org/keycloak/partialimport/UsersPartialImport.java b/services/src/main/java/org/keycloak/partialimport/UsersPartialImport.java
index 0128e4e668..cce0fec4da 100755
--- a/services/src/main/java/org/keycloak/partialimport/UsersPartialImport.java
+++ b/services/src/main/java/org/keycloak/partialimport/UsersPartialImport.java
@@ -24,7 +24,7 @@ import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.RepresentationToModel;
 import org.keycloak.representations.idm.PartialImportRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 
 import java.util.HashMap;
 import java.util.List;
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
index 99f2559ef4..07313d87ba 100755
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakContext.java
@@ -110,13 +110,6 @@ public class DefaultKeycloakContext implements KeycloakContext {
         this.connection = connection;
     }
 
-    @Override
-    public RealmImporter getRealmManager() {
-        RealmManager manager = new RealmManager(session);
-        manager.setContextPath(getContextPath());
-        return manager;
-    }
-
     @Override
     public Locale resolveLocale(UserModel user) {
         return LocaleHelper.getLocale(session, realm, user);
diff --git a/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java b/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
index 7fbd7a3d12..4cc77a269e 100644
--- a/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
+++ b/services/src/main/java/org/keycloak/services/DefaultKeycloakSession.java
@@ -59,7 +59,6 @@ public class DefaultKeycloakSession implements KeycloakSession {
     private UserProvider userModel;
     private UserStorageManager userStorageManager;
     private UserCredentialStoreManager userCredentialStorageManager;
-    private ScriptingProvider scriptingProvider;
     private UserSessionProvider sessionProvider;
     private UserFederationManager federationManager;
     private UserFederatedStorageProvider userFederatedStorageProvider;
@@ -275,14 +274,4 @@ public class DefaultKeycloakSession implements KeycloakSession {
             }
         }
     }
-
-    @Override
-    public ScriptingProvider scripting() {
-
-        if (scriptingProvider == null) {
-            scriptingProvider = getProvider(ScriptingProvider.class);
-        }
-
-        return scriptingProvider;
-    }
 }
diff --git a/services/src/main/java/org/keycloak/services/managers/ClientManager.java b/services/src/main/java/org/keycloak/services/managers/ClientManager.java
index b648bbd6b8..eb6fba623c 100644
--- a/services/src/main/java/org/keycloak/services/managers/ClientManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/ClientManager.java
@@ -27,6 +27,7 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ProtocolMapperModel;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserManager;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionProvider;
 import org.keycloak.models.session.UserSessionPersisterProvider;
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java b/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
index f9ae190767..7a8964f6da 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java
@@ -66,7 +66,7 @@ import org.keycloak.services.Urls;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.BruteForceProtector;
 import org.keycloak.services.managers.ClientSessionCode;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.services.resources.AccountService;
 import org.keycloak.services.validation.Validation;
diff --git a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/org/keycloak/testsuite/integration-arquillian-testsuite-providers/main/module.xml b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/org/keycloak/testsuite/integration-arquillian-testsuite-providers/main/module.xml
index 28e478911c..6f208386fd 100644
--- a/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/org/keycloak/testsuite/integration-arquillian-testsuite-providers/main/module.xml
+++ b/testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers/src/main/resources/org/keycloak/testsuite/integration-arquillian-testsuite-providers/main/module.xml
@@ -28,6 +28,7 @@
         <module name="org.keycloak.keycloak-common"/>
         <module name="org.keycloak.keycloak-core"/>
         <module name="org.keycloak.keycloak-server-spi"/>
+        <module name="org.keycloak.keycloak-server-spi-private"/>
         <module name="org.keycloak.keycloak-services"/>
         <module name="org.keycloak.keycloak-model-infinispan"/>
         <module name="org.keycloak.keycloak-model-jpa"/>
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/JavaKeystoreKeyProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/JavaKeystoreKeyProviderTest.java
index 5c54213aab..642a872176 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/JavaKeystoreKeyProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/JavaKeystoreKeyProviderTest.java
@@ -22,15 +22,10 @@ import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
-import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.common.util.PemUtils;
-import org.keycloak.keys.Attributes;
-import org.keycloak.keys.GeneratedRsaKeyProviderFactory;
 import org.keycloak.keys.JavaKeystoreKeyProviderFactory;
 import org.keycloak.keys.KeyMetadata;
 import org.keycloak.keys.KeyProvider;
-import org.keycloak.keys.RsaKeyProviderFactory;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.ErrorRepresentation;
 import org.keycloak.representations.idm.KeysMetadataRepresentation;
@@ -45,9 +40,6 @@ import javax.ws.rs.core.Response;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.InputStream;
-import java.security.KeyPair;
-import java.security.cert.Certificate;
-import java.security.interfaces.RSAPublicKey;
 import java.util.List;
 
 import static org.junit.Assert.*;
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/RsaKeyProviderTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/RsaKeyProviderTest.java
index 2dc3506bfc..5bfaef2b2a 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/RsaKeyProviderTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/keys/RsaKeyProviderTest.java
@@ -20,17 +20,13 @@ package org.keycloak.testsuite.keys;
 import org.jboss.arquillian.graphene.page.Page;
 import org.junit.Rule;
 import org.junit.Test;
-import org.keycloak.RSATokenVerifier;
-import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.CertificateUtils;
 import org.keycloak.common.util.KeyUtils;
 import org.keycloak.common.util.MultivaluedHashMap;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.keys.Attributes;
-import org.keycloak.keys.GeneratedRsaKeyProviderFactory;
 import org.keycloak.keys.KeyMetadata;
 import org.keycloak.keys.KeyProvider;
-import org.keycloak.keys.RsaKeyProvider;
 import org.keycloak.keys.RsaKeyProviderFactory;
 import org.keycloak.representations.idm.ComponentRepresentation;
 import org.keycloak.representations.idm.ErrorRepresentation;
@@ -40,16 +36,11 @@ import org.keycloak.testsuite.AbstractKeycloakTest;
 import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.pages.AppPage;
-import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
-import org.keycloak.testsuite.util.OAuthClient;
 
-import javax.ws.rs.WebApplicationException;
 import javax.ws.rs.core.Response;
 import java.security.KeyPair;
-import java.security.PublicKey;
 import java.security.cert.Certificate;
-import java.security.cert.X509Certificate;
 import java.util.List;
 
 import static org.junit.Assert.*;
diff --git a/testsuite/integration/pom.xml b/testsuite/integration/pom.xml
index d1311b59ea..873d99ddfe 100755
--- a/testsuite/integration/pom.xml
+++ b/testsuite/integration/pom.xml
@@ -120,7 +120,7 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-server-spi</artifactId>
+            <artifactId>keycloak-server-spi-private</artifactId>
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
index cafe113c75..6eccb21d23 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/federation/storage/FederatedStorageExportImportTest.java
@@ -79,7 +79,7 @@ public class FederatedStorageExportImportTest {
     protected PasswordHashProvider getHashProvider(KeycloakSession session, PasswordPolicy policy) {
         PasswordHashProvider hash = session.getProvider(PasswordHashProvider.class, policy.getHashAlgorithm());
         if (hash == null) {
-            return session.getProvider(PasswordHashProvider.class, HashAlgorithmPasswordPolicyProviderFactory.DEFAULT_VALUE);
+            return session.getProvider(PasswordHashProvider.class, PasswordPolicy.HASH_ALGORITHM_DEFAULT);
         }
         return hash;
     }
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionInitializerTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionInitializerTest.java
index 431bff6ff4..2db24addca 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionInitializerTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionInitializerTest.java
@@ -34,7 +34,7 @@ import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.UserSessionProvider;
 import org.keycloak.models.UserSessionProviderFactory;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.testsuite.rule.KeycloakRule;
 
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionPersisterProviderTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionPersisterProviderTest.java
index 074438f2bf..80f663f846 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionPersisterProviderTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionPersisterProviderTest.java
@@ -33,7 +33,7 @@ import org.keycloak.models.session.UserSessionPersisterProvider;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.services.managers.ClientManager;
 import org.keycloak.services.managers.RealmManager;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 import org.keycloak.testsuite.rule.KeycloakRule;
 
 import java.util.ArrayList;
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderOfflineTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderOfflineTest.java
index 013f16c57f..b9f4f2aeda 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderOfflineTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderOfflineTest.java
@@ -34,7 +34,7 @@ import org.keycloak.models.session.UserSessionPersisterProvider;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
 import org.keycloak.services.managers.ClientManager;
 import org.keycloak.services.managers.RealmManager;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 import org.keycloak.services.managers.UserSessionManager;
 import org.keycloak.testsuite.rule.KeycloakRule;
 import org.keycloak.testsuite.rule.LoggingRule;
diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java
index d75e467c0f..f2fc3aab0d 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java
@@ -31,7 +31,7 @@ import org.keycloak.models.UserLoginFailureModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
-import org.keycloak.services.managers.UserManager;
+import org.keycloak.models.UserManager;
 import org.keycloak.testsuite.rule.KeycloakRule;
 
 import java.util.Arrays;
diff --git a/wildfly/adduser/pom.xml b/wildfly/adduser/pom.xml
index b33eb5fdb7..6a827f48f0 100755
--- a/wildfly/adduser/pom.xml
+++ b/wildfly/adduser/pom.xml
@@ -34,6 +34,10 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-server-spi</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-common</artifactId>
diff --git a/wildfly/extensions/pom.xml b/wildfly/extensions/pom.xml
index 0cafd9c5fe..9b677db509 100755
--- a/wildfly/extensions/pom.xml
+++ b/wildfly/extensions/pom.xml
@@ -45,6 +45,11 @@
             <artifactId>keycloak-server-spi</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-services</artifactId>
diff --git a/wildfly/server-subsystem/pom.xml b/wildfly/server-subsystem/pom.xml
index 7710f9fc7b..03ac1a7e01 100755
--- a/wildfly/server-subsystem/pom.xml
+++ b/wildfly/server-subsystem/pom.xml
@@ -108,7 +108,7 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-server-spi</artifactId>
+            <artifactId>keycloak-server-spi-private</artifactId>
             <scope>provided</scope>
         </dependency>