Merge remote-tracking branch 'upstream/master'

testsuite/integration/src/test/java/org/keycloak/testsuite/account/ProfileTest.java

@@ -21,6 +21,7 @@ import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.testsuite.Constants;
 import org.keycloak.testsuite.OAuthClient;
+import org.keycloak.testsuite.pages.AccountAccessPage;
 import org.keycloak.testsuite.pages.AccountUpdateProfilePage;
 import org.keycloak.testsuite.pages.LoginPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
@@ -87,6 +88,9 @@ public class ProfileTest {
     @WebResource
     protected AccountUpdateProfilePage profilePage;
 
+    @WebResource
+    protected AccountAccessPage accountAccessPage;
+
     @WebResource
     protected LoginPage loginPage;
 
@@ -186,6 +190,9 @@ public class ProfileTest {
         JSONObject profile = new JSONObject(IOUtils.toString(response.getEntity().getContent()));
 
         assertEquals("test-user@localhost", profile.getString("username"));
+
+        accountAccessPage.open();
+        accountAccessPage.revokeGrant("third-party");
     }
 
     @Test

testsuite/integration/src/test/java/org/keycloak/testsuite/broker/AbstractIdentityProviderTest.java

@@ -89,7 +89,7 @@ public abstract class AbstractIdentityProviderTest {
     public WebRule webRule = new WebRule(this);
 
     @WebResource
-    private WebDriver driver;
+    protected WebDriver driver;
 
     @WebResource
     private LoginPage loginPage;
@@ -122,6 +122,7 @@ public abstract class AbstractIdentityProviderTest {
 
     @After
     public void onAfter() {
+        revokeGrant();
         brokerServerRule.stopSession(this.session, true);
     }
 
@@ -387,6 +388,9 @@ public abstract class AbstractIdentityProviderTest {
         assertTrue(accountFederatedIdentityPage.isCurrent());
         assertTrue(driver.getPageSource().contains("id=\"remove-" + identityProviderModel.getAlias() + "\""));
 
+        // Revoke grant in account mgmt
+        revokeGrant();
+
         // Logout from account management
         accountFederatedIdentityPage.logout();
         assertTrue(driver.getTitle().equals("Log in to realm-with-broker"));
@@ -401,6 +405,9 @@ public abstract class AbstractIdentityProviderTest {
         accountFederatedIdentityPage.clickRemoveProvider(identityProviderModel.getAlias());
         assertTrue(driver.getPageSource().contains("id=\"add-" + identityProviderModel.getAlias() + "\""));
 
+        // Revoke grant in account mgmt
+        revokeGrant();
+
         // Logout from account management
         accountFederatedIdentityPage.logout();
         assertTrue(driver.getTitle().equals("Log in to realm-with-broker"));
@@ -637,6 +644,10 @@ public abstract class AbstractIdentityProviderTest {
 
     }
 
+    protected void revokeGrant() {
+
+    }
+
     protected abstract String getProviderId();
 
     protected IdentityProviderModel getIdentityProviderModel() {

testsuite/integration/src/test/java/org/keycloak/testsuite/broker/OIDCKeyCloakServerBrokerBasicTest.java

@@ -1,19 +1,26 @@
 package org.keycloak.testsuite.broker;
 
+import org.junit.After;
 import org.junit.ClassRule;
 import org.junit.Test;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.services.Urls;
 import org.keycloak.services.managers.RealmManager;
+import org.keycloak.testsuite.Constants;
+import org.keycloak.testsuite.pages.AccountAccessPage;
 import org.keycloak.testsuite.pages.OAuthGrantPage;
 import org.keycloak.testsuite.rule.AbstractKeycloakRule;
 import org.keycloak.testsuite.rule.WebResource;
 import org.keycloak.testutils.KeycloakServer;
 import org.keycloak.util.JsonSerialization;
+import org.openqa.selenium.NoSuchElementException;
 
 import java.io.IOException;
 
+import javax.ws.rs.core.UriBuilder;
+
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.fail;
 
@@ -22,12 +29,14 @@ import static org.junit.Assert.fail;
  */
 public class OIDCKeyCloakServerBrokerBasicTest extends AbstractIdentityProviderTest {
 
+    private static final int PORT = 8082;
+
     @ClassRule
     public static AbstractKeycloakRule samlServerRule = new AbstractKeycloakRule() {
 
         @Override
         protected void configureServer(KeycloakServer server) {
-            server.getConfig().setPort(8082);
+            server.getConfig().setPort(PORT);
         }
 
         @Override
@@ -44,6 +53,25 @@ public class OIDCKeyCloakServerBrokerBasicTest extends AbstractIdentityProviderT
     @WebResource
     private OAuthGrantPage grantPage;
 
+    @WebResource
+    protected AccountAccessPage accountAccessPage;
+
+    @Override
+    protected void revokeGrant() {
+        String currentUrl = driver.getCurrentUrl();
+
+        String accountAccessPath = Urls.accountAccessPage(UriBuilder.fromUri(Constants.AUTH_SERVER_ROOT).port(PORT).build(), "realm-with-oidc-identity-provider").toString();
+        accountAccessPage.setPath(accountAccessPath);
+        accountAccessPage.open();
+        try {
+            accountAccessPage.revokeGrant("broker-app");
+        } catch (NoSuchElementException e) {
+            System.err.println("Couldn't revoke broker-app application, maybe because it wasn't granted or user not logged");
+        }
+
+        driver.navigate().to(currentUrl);
+    }
+
     @Override
     protected void doAfterProviderAuthentication() {
         // grant access to broker-app

testsuite/integration/src/test/java/org/keycloak/testsuite/forms/LoginTest.java

@@ -28,7 +28,9 @@ import org.junit.Test;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.events.Details;
 import org.keycloak.events.Event;
+import org.keycloak.events.EventType;
 import org.keycloak.models.BrowserSecurityHeaders;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
@@ -39,6 +41,7 @@ import org.keycloak.testsuite.OAuthClient;
 import org.keycloak.testsuite.pages.AppPage;
 import org.keycloak.testsuite.pages.AppPage.RequestType;
 import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
 import org.keycloak.testsuite.rule.KeycloakRule;
 import org.keycloak.testsuite.rule.WebResource;
 import org.keycloak.testsuite.rule.WebRule;
@@ -48,8 +51,10 @@ import org.openqa.selenium.WebDriver;
 import javax.ws.rs.client.Client;
 import javax.ws.rs.client.ClientBuilder;
 import javax.ws.rs.core.Response;
+
 import java.util.Map;
 
+import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
@@ -93,6 +98,9 @@ public class LoginTest {
 
     @WebResource
     protected LoginPage loginPage;
+    
+    @WebResource
+    protected LoginPasswordUpdatePage updatePasswordPage;
 
     private static String userId;
 
@@ -219,7 +227,86 @@ public class LoginTest {
 
         events.expectLogin().user(userId).removeDetail(Details.USERNAME).detail(Details.AUTH_METHOD, "sso").assertEvent();
     }
+    
+    @Test
+    public void loginWithForcePasswordChangePolicy() {
+        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+            @Override
+            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
+                appRealm.setPasswordPolicy(new PasswordPolicy("forceExpiredPasswordChange(1)"));
+            }
+        });
+        
+        try {
+            // Setting offset to more than one day to force password update
+            // elapsedTime > timeToExpire
+            Time.setOffset(86405);
+            
+            loginPage.open();
 
+            loginPage.login("login-test", "password");
+            
+            updatePasswordPage.assertCurrent();
+            
+            updatePasswordPage.changePassword("updatedPassword", "updatedPassword");
+
+            events.expectRequiredAction(EventType.UPDATE_PASSWORD).user(userId).detail(Details.USERNAME, "login-test").assertEvent();
+            
+            assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+
+            events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
+            
+        } finally {
+            keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+                @Override
+                public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
+                    appRealm.setPasswordPolicy(new PasswordPolicy(null));
+                    
+                    UserModel user = manager.getSession().users().getUserByUsername("login-test", appRealm);
+                    UserCredentialModel cred = new UserCredentialModel();
+                    cred.setType(CredentialRepresentation.PASSWORD);
+                    cred.setValue("password");
+                    user.updateCredential(cred);
+                }
+            });
+            Time.setOffset(0);
+        }
+    }
+    
+    @Test
+    public void loginWithoutForcePasswordChangePolicy() {
+        keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+            @Override
+            public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
+                appRealm.setPasswordPolicy(new PasswordPolicy("forceExpiredPasswordChange(1)"));
+            }
+        });
+        
+        try {
+            // Setting offset to less than one day to avoid forced password update
+            // elapsedTime < timeToExpire
+            Time.setOffset(86205);
+            
+            loginPage.open();
+
+            loginPage.login("login-test", "password");
+            
+            Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+            Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+
+            events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
+            
+        } finally {
+            keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+                @Override
+                public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
+                    appRealm.setPasswordPolicy(new PasswordPolicy(null));
+                }
+            });
+            Time.setOffset(0);
+        }
+    }
+    
     @Test
     public void loginNoTimeoutWithLongWait() {
         try {

testsuite/integration/src/test/java/org/keycloak/testsuite/forms/ResetPasswordTest.java

@@ -155,7 +155,7 @@ public class ResetPasswordTest {
         events.expect(EventType.RESET_PASSWORD_ERROR).client((String) null).user((String) null).error("invalid_code").clearDetails().assertEvent();
 
         assertTrue(errorPage.isCurrent());
-        assertEquals("Unknown code, please login again through your application.", errorPage.getError());
+        assertEquals("An error occurred, please login again through your application.", errorPage.getError());
     }
 
     @Test
@@ -354,7 +354,7 @@ public class ResetPasswordTest {
 
             errorPage.assertCurrent();
 
-            assertEquals("Invalid code, please login again through your application.", errorPage.getError());
+            assertEquals("An error occurred, please login again through your application.", errorPage.getError());
 
             events.expectRequiredAction(EventType.RESET_PASSWORD).error("invalid_code").client((String) null).user((String) null).session((String) null).clearDetails().assertEvent();
         } finally {
@@ -538,19 +538,35 @@ public class ResetPasswordTest {
             }
         });
         
-        resetPassword("login-test", "password1");
-        resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
+        try {
+            Time.setOffset(2000000);
+            resetPassword("login-test", "password1");
+            
+            resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
 
-        resetPassword("login-test", "password2");
-        resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
-        resetPasswordInvalidPassword("login-test", "password2", "Invalid password: must not be equal to any of last 3 passwords.");
+            Time.setOffset(4000000);
+            resetPassword("login-test", "password2");
+            
+            resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
+            resetPasswordInvalidPassword("login-test", "password2", "Invalid password: must not be equal to any of last 3 passwords.");
+        
+            Time.setOffset(8000000);
+            resetPassword("login-test", "password3");
+            
+            resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
+            resetPasswordInvalidPassword("login-test", "password2", "Invalid password: must not be equal to any of last 3 passwords.");
+            resetPasswordInvalidPassword("login-test", "password3", "Invalid password: must not be equal to any of last 3 passwords.");
 
-        resetPassword("login-test", "password3");
-        resetPasswordInvalidPassword("login-test", "password1", "Invalid password: must not be equal to any of last 3 passwords.");
-        resetPasswordInvalidPassword("login-test", "password2", "Invalid password: must not be equal to any of last 3 passwords.");
-        resetPasswordInvalidPassword("login-test", "password3", "Invalid password: must not be equal to any of last 3 passwords.");
-
-        resetPassword("login-test", "password");
+            resetPassword("login-test", "password");
+        } finally {
+            keycloakRule.update(new KeycloakRule.KeycloakSetup() {
+                @Override
+                public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
+                    appRealm.setPasswordPolicy(new PasswordPolicy(null));
+                }
+            });
+            Time.setOffset(0);
+        }
     }
 
     @Test

testsuite/integration/src/test/java/org/keycloak/testsuite/i18n/AccountPageTest.java

@@ -77,7 +77,7 @@ public class AccountPageTest {
         accountUpdateProfilePage.openLanguage("German");
         Assert.assertEquals("Deutsch", accountUpdateProfilePage.getLanguageDropdownText());
 
-        accountUpdateProfilePage.openLanguage("Englisch");
+        accountUpdateProfilePage.openLanguage("English");
         Assert.assertEquals("English", accountUpdateProfilePage.getLanguageDropdownText());
         accountUpdateProfilePage.logout();
     }

testsuite/integration/src/test/java/org/keycloak/testsuite/i18n/LoginPageTest.java

@@ -75,7 +75,7 @@ public class LoginPageTest {
         loginPage.openLanguage("German");
         Assert.assertEquals("Deutsch", loginPage.getLanguageDropdownText());
 
-        loginPage.openLanguage("Englisch");
+        loginPage.openLanguage("English");
         Assert.assertEquals("English", loginPage.getLanguageDropdownText());
     }
 

testsuite/integration/src/test/java/org/keycloak/testsuite/model/GrantedConsentModelTest.java

@@ -0,0 +1,266 @@
+package org.keycloak.testsuite.model;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.GrantedConsentModel;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.ProtocolMapperModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.protocol.oidc.OIDCLoginProtocol;
+import org.keycloak.protocol.oidc.mappers.UserPropertyMapper;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class GrantedConsentModelTest extends AbstractModelTest {
+
+    @Before
+    public void setupEnv() {
+        RealmModel realm = realmManager.createRealm("original");
+
+        ClientModel fooClient = realm.addClient("foo-client");
+        ClientModel barClient = realm.addClient("bar-client");
+
+        RoleModel realmRole = realm.addRole("realm-role");
+        RoleModel barClientRole = barClient.addRole("bar-client-role");
+
+        ProtocolMapperModel fooMapper = new ProtocolMapperModel();
+        fooMapper.setName("foo");
+        fooMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        fooMapper.setProtocolMapper(UserPropertyMapper.PROVIDER_ID);
+        fooMapper = fooClient.addProtocolMapper(fooMapper);
+
+        ProtocolMapperModel barMapper = new ProtocolMapperModel();
+        barMapper.setName("bar");
+        barMapper.setProtocol(OIDCLoginProtocol.LOGIN_PROTOCOL);
+        barMapper.setProtocolMapper(UserPropertyMapper.PROVIDER_ID);
+        barMapper = barClient.addProtocolMapper(barMapper);
+
+        UserModel john = session.users().addUser(realm, "john");
+        UserModel mary = session.users().addUser(realm, "mary");
+
+        GrantedConsentModel johnFooGrant = new GrantedConsentModel(fooClient.getId());
+        johnFooGrant.addGrantedRole(realmRole.getId());
+        johnFooGrant.addGrantedRole(barClientRole.getId());
+        johnFooGrant.addGrantedProtocolMapper(fooMapper.getId());
+        john.addGrantedConsent(johnFooGrant);
+
+        GrantedConsentModel johnBarGrant = new GrantedConsentModel(barClient.getId());
+        johnBarGrant.addGrantedProtocolMapper(barMapper.getId());
+        johnBarGrant.addGrantedRole(realmRole.getId());
+
+        // Update should fail as grant doesn't yet exists
+        try {
+            john.updateGrantedConsent(johnBarGrant);
+            Assert.fail("Not expected to end here");
+        } catch (ModelException expected) {
+        }
+
+        john.addGrantedConsent(johnBarGrant);
+
+        GrantedConsentModel maryFooGrant = new GrantedConsentModel(fooClient.getId());
+        maryFooGrant.addGrantedRole(realmRole.getId());
+        maryFooGrant.addGrantedProtocolMapper(fooMapper.getId());
+        mary.addGrantedConsent(maryFooGrant);
+
+        commit();
+    }
+
+    @Test
+    public void basicConsentTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        Map<String, ClientModel> clients = realm.getClientNameMap();
+        ClientModel fooClient = clients.get("foo-client");
+        ClientModel barClient = clients.get("bar-client");
+
+        UserModel john = session.users().getUserByUsername("john", realm);
+        UserModel mary = session.users().getUserByUsername("mary", realm);
+
+        GrantedConsentModel johnFooConsent = john.getGrantedConsentByClient(fooClient.getId());
+        Assert.assertEquals(johnFooConsent.getGrantedRoles().size(), 2);
+        Assert.assertEquals(johnFooConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertTrue(isRoleGranted(realm, "realm-role", johnFooConsent));
+        Assert.assertTrue(isRoleGranted(barClient, "bar-client-role", johnFooConsent));
+        Assert.assertTrue(isMapperGranted(fooClient, "foo", johnFooConsent));
+
+        GrantedConsentModel johnBarConsent = john.getGrantedConsentByClient(barClient.getId());
+        Assert.assertEquals(johnBarConsent.getGrantedRoles().size(), 1);
+        Assert.assertEquals(johnBarConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertTrue(isRoleGranted(realm, "realm-role", johnBarConsent));
+        Assert.assertTrue(isMapperGranted(barClient, "bar", johnBarConsent));
+
+        GrantedConsentModel maryConsent = mary.getGrantedConsentByClient(fooClient.getId());
+        Assert.assertEquals(maryConsent.getGrantedRoles().size(), 1);
+        Assert.assertEquals(maryConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertTrue(isRoleGranted(realm, "realm-role", maryConsent));
+        Assert.assertFalse(isRoleGranted(barClient, "bar-client-role", maryConsent));
+        Assert.assertTrue(isMapperGranted(fooClient, "foo", maryConsent));
+
+        Assert.assertNull(mary.getGrantedConsentByClient(barClient.getId()));
+    }
+
+    @Test
+    public void getAllConsentTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        Map<String, ClientModel> clients = realm.getClientNameMap();
+        ClientModel fooClient = clients.get("foo-client");
+
+        UserModel john = session.users().getUserByUsername("john", realm);
+        UserModel mary = session.users().getUserByUsername("mary", realm);
+
+        List<GrantedConsentModel> johnConsents = john.getGrantedConsents();
+        Assert.assertEquals(2, johnConsents.size());
+
+        List<GrantedConsentModel> maryConsents = mary.getGrantedConsents();
+        Assert.assertEquals(1, maryConsents.size());
+        GrantedConsentModel maryConsent = maryConsents.get(0);
+        Assert.assertEquals(maryConsent.getClientId(), fooClient.getId());
+        Assert.assertEquals(maryConsent.getGrantedRoles().size(), 1);
+        Assert.assertEquals(maryConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertTrue(isRoleGranted(realm, "realm-role", maryConsent));
+        Assert.assertTrue(isMapperGranted(fooClient, "foo", maryConsent));
+    }
+
+    @Test
+    public void updateWithRoleRemovalTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        ClientModel fooClient = realm.getClientNameMap().get("foo-client");
+        UserModel john = session.users().getUserByUsername("john", realm);
+
+        GrantedConsentModel johnConsent = john.getGrantedConsentByClient(fooClient.getId());
+
+        // Remove foo protocol mapper from johnConsent
+        ProtocolMapperModel protMapperModel = fooClient.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, "foo");
+        johnConsent.getGrantedProtocolMappers().remove(protMapperModel.getId());
+
+        // Remove realm-role and add new-realm-role to johnConsent
+        RoleModel realmRole = realm.getRole("realm-role");
+        johnConsent.getGrantedRoles().remove(realmRole.getId());
+
+        RoleModel newRealmRole = realm.addRole("new-realm-role");
+        johnConsent.addGrantedRole(newRealmRole.getId());
+
+        john.updateGrantedConsent(johnConsent);
+
+        commit();
+
+        realm = realmManager.getRealm("original");
+        fooClient = realm.getClientNameMap().get("foo-client");
+        john = session.users().getUserByUsername("john", realm);
+        johnConsent = john.getGrantedConsentByClient(fooClient.getId());
+
+        Assert.assertEquals(johnConsent.getGrantedRoles().size(), 2);
+        Assert.assertEquals(johnConsent.getGrantedProtocolMappers().size(), 0);
+        Assert.assertFalse(isRoleGranted(realm, "realm-role", johnConsent));
+        Assert.assertTrue(isRoleGranted(realm, "new-realm-role", johnConsent));
+        Assert.assertFalse(isMapperGranted(fooClient, "foo", johnConsent));
+    }
+
+    @Test
+    public void revokeTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        ClientModel fooClient = realm.getClientNameMap().get("foo-client");
+        UserModel john = session.users().getUserByUsername("john", realm);
+
+        john.revokeGrantedConsentForClient(fooClient.getId());
+
+        commit();
+
+        realm = realmManager.getRealm("original");
+        john = session.users().getUserByUsername("john", realm);
+        Assert.assertNull(john.getGrantedConsentByClient(fooClient.getId()));
+    }
+
+    @Test
+    public void deleteUserTest() {
+        // Validate user deleted without any referential constraint errors
+        RealmModel realm = realmManager.getRealm("original");
+        UserModel john = session.users().getUserByUsername("john", realm);
+        session.users().removeUser(realm, john);
+    }
+
+    @Test
+    public void deleteProtocolMapperTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        ClientModel fooClient = realm.getClientNameMap().get("foo-client");
+        ProtocolMapperModel fooMapper = fooClient.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, "foo");
+        String fooMapperId = fooMapper.getId();
+        fooClient.removeProtocolMapper(fooMapper);
+
+        commit();
+
+        realm = realmManager.getRealm("original");
+        fooClient = realm.getClientNameMap().get("foo-client");
+        UserModel john = session.users().getUserByUsername("john", realm);
+        GrantedConsentModel johnConsent = john.getGrantedConsentByClient(fooClient.getId());
+
+        Assert.assertEquals(johnConsent.getGrantedRoles().size(), 2);
+        Assert.assertEquals(johnConsent.getGrantedProtocolMappers().size(), 0);
+        Assert.assertFalse(johnConsent.isProtocolMapperGranted(fooMapperId));
+    }
+
+    @Test
+    public void deleteRoleTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        RoleModel realmRole = realm.getRole("realm-role");
+        String realmRoleId = realmRole.getId();
+        realm.removeRole(realmRole);
+
+        commit();
+
+        realm = realmManager.getRealm("original");
+        Map<String, ClientModel> clients = realm.getClientNameMap();
+        ClientModel fooClient = clients.get("foo-client");
+        ClientModel barClient = clients.get("bar-client");
+        UserModel john = session.users().getUserByUsername("john", realm);
+        GrantedConsentModel johnConsent = john.getGrantedConsentByClient(fooClient.getId());
+
+        Assert.assertEquals(johnConsent.getGrantedRoles().size(), 1);
+        Assert.assertEquals(johnConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertFalse(johnConsent.isRoleGranted(realmRoleId));
+        Assert.assertTrue(isRoleGranted(barClient, "bar-client-role", johnConsent));
+    }
+
+    @Test
+    public void deleteClientTest() {
+        RealmModel realm = realmManager.getRealm("original");
+        Map<String, ClientModel> clients = realm.getClientNameMap();
+        ClientModel barClient = clients.get("bar-client");
+        realm.removeClient(barClient.getId());
+
+        commit();
+
+        realm = realmManager.getRealm("original");
+        clients = realm.getClientNameMap();
+        ClientModel fooClient = clients.get("foo-client");
+        Assert.assertNull(clients.get("bar-client"));
+
+        UserModel john = session.users().getUserByUsername("john", realm);
+
+        GrantedConsentModel johnFooConsent = john.getGrantedConsentByClient(fooClient.getId());
+        Assert.assertEquals(johnFooConsent.getGrantedRoles().size(), 1);
+        Assert.assertEquals(johnFooConsent.getGrantedProtocolMappers().size(), 1);
+        Assert.assertTrue(isRoleGranted(realm, "realm-role", johnFooConsent));
+        Assert.assertTrue(isMapperGranted(fooClient, "foo", johnFooConsent));
+
+        Assert.assertNull(john.getGrantedConsentByClient(barClient.getId()));
+    }
+
+    private boolean isRoleGranted(RoleContainerModel roleContainer, String roleName, GrantedConsentModel consentModel) {
+        RoleModel role = roleContainer.getRole(roleName);
+        return consentModel.isRoleGranted(role.getId());
+    }
+
+    private boolean isMapperGranted(ClientModel client, String protocolMapperName, GrantedConsentModel consentModel) {
+        ProtocolMapperModel protocolMapper = client.getProtocolMapperByName(OIDCLoginProtocol.LOGIN_PROTOCOL, protocolMapperName);
+        return consentModel.isProtocolMapperGranted(protocolMapper.getId());
+    }
+}

testsuite/integration/src/test/java/org/keycloak/testsuite/pages/AccountAccessPage.java

@@ -0,0 +1,98 @@
+package org.keycloak.testsuite.pages;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.ws.rs.core.UriBuilder;
+
+import org.keycloak.services.Urls;
+import org.keycloak.testsuite.Constants;
+import org.openqa.selenium.By;
+import org.openqa.selenium.WebElement;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AccountAccessPage extends AbstractAccountPage {
+
+    private String path = Urls.accountAccessPage(UriBuilder.fromUri(Constants.AUTH_SERVER_ROOT).build(), "test").toString();
+
+    @Override
+    public boolean isCurrent() {
+        return driver.getTitle().contains("Account Management") && driver.getCurrentUrl().endsWith("/account/access");
+    }
+
+    @Override
+    public void open() {
+        driver.navigate().to(path);
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    public void revokeGrant(String clientId) {
+        driver.findElement(By.id("revoke-" + clientId)).click();
+    }
+
+    public Map<String, ClientGrant> getClientGrants() {
+        Map<String, ClientGrant> table = new HashMap<String, ClientGrant>();
+        for (WebElement r : driver.findElements(By.tagName("tr"))) {
+            int count = 0;
+            ClientGrant currentGrant = null;
+
+            for (WebElement col : r.findElements(By.tagName("td"))) {
+                count++;
+                switch (count) {
+                    case 1:
+                        currentGrant = new ClientGrant();
+                        String clientId = col.getText();
+                        table.put(clientId, currentGrant);
+                        break;
+                    case 2:
+                        String protMappersStr = col.getText();
+                        String[] protMappers = protMappersStr.split(",");
+                        for (String protMapper : protMappers) {
+                            protMapper = protMapper.trim();
+                            currentGrant.addMapper(protMapper);
+                        }
+                        break;
+                    case 3:
+                        String rolesStr = col.getText();
+                        String[] roles = rolesStr.split(",");
+                        for (String role : roles) {
+                            role = role.trim();
+                            currentGrant.addRole(role);
+                        }
+                        break;
+                }
+            }
+        }
+        table.remove("Client");
+        return table;
+    }
+
+    public static class ClientGrant {
+
+        private final List<String> protocolMapperDescriptions = new ArrayList<String>();
+        private final List<String> roleDescriptions = new ArrayList<String>();
+
+        private void addMapper(String protocolMapper) {
+            protocolMapperDescriptions.add(protocolMapper);
+        }
+
+        private void addRole(String role) {
+            roleDescriptions.add(role);
+        }
+
+        public List<String> getProtocolMapperDescriptions() {
+            return protocolMapperDescriptions;
+        }
+
+        public List<String> getRoleDescriptions() {
+            return roleDescriptions;
+        }
+    }
+}

testsuite/integration/src/test/resources/broker-test/test-broker-realm-with-kc-oidc.json

@@ -32,7 +32,10 @@
                 { "type" : "password",
                     "value" : "password" }
             ],
-            "realmRoles": ["manager"]
+            "realmRoles": ["manager"],
+            "applicationRoles": {
+                "account": [ "manage-account" ]
+            }
         },
         {
             "username" : "test-user-noemail",
@@ -43,7 +46,10 @@
                 { "type" : "password",
                     "value" : "password" }
             ],
-            "realmRoles": ["manager"]
+            "realmRoles": ["manager"],
+            "applicationRoles": {
+                "account": [ "manage-account" ]
+            }
         },
         {
           "username" : "pedroigor",
@@ -53,7 +59,10 @@
             { "type" : "password",
               "value" : "password" }
           ],
-          "realmRoles": ["manager"]
+          "realmRoles": ["manager"],
+          "applicationRoles": {
+              "account": [ "manage-account" ]
+          }
         }
     ],
     "roles" : {