Made account management an optional feature on a realm, and added login and logout to account management pages

services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java

@@ -13,6 +13,7 @@ import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.services.resources.AccountService;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.services.resources.SaasService;
 
@@ -61,6 +62,11 @@ public class AuthenticationManager {
         return createLoginCookie(realm, user, cookieName, cookiePath);
     }
 
+    public NewCookie createAccountIdentityCookie(RealmModel realm, UserModel user, URI uri) {
+        String cookieName = AccountService.ACCOUNT_IDENTITY_COOKIE;
+        String cookiePath = uri.getPath();
+        return createLoginCookie(realm, user, cookieName, cookiePath);
+    }
 
     protected NewCookie createLoginCookie(RealmModel realm, UserModel user, String cookieName, String cookiePath) {
         SkeletonKeyToken identityToken = createIdentityToken(realm, user.getLoginName());
@@ -99,6 +105,11 @@ public class AuthenticationManager {
         expireCookie(SaasService.SAAS_IDENTITY_COOKIE, cookiePath);
     }
 
+    public void expireAccountIdentityCookie(URI uri) {
+        String cookiePath = uri.getPath();
+        expireCookie(AccountService.ACCOUNT_IDENTITY_COOKIE, cookiePath);
+    }
+
     public void expireCookie(String cookieName, String path) {
         HttpResponse response = ResteasyProviderFactory.getContextData(HttpResponse.class);
         if (response == null) {
@@ -120,6 +131,11 @@ public class AuthenticationManager {
         return authenticateIdentityCookie(realm, uriInfo, headers, cookieName);
     }
 
+    public UserModel authenticateAccountIdentityCookie(RealmModel realm, UriInfo uriInfo, HttpHeaders headers) {
+        String cookieName = AccountService.ACCOUNT_IDENTITY_COOKIE;
+        return authenticateIdentityCookie(realm, uriInfo, headers, cookieName);
+    }
+
     public UserModel authenticateSaasIdentity(RealmModel realm, UriInfo uriInfo, HttpHeaders headers) {
         UserModel user = authenticateSaasIdentityCookie(realm, uriInfo, headers);
         if (user != null) return user;

services/src/main/java/org/keycloak/services/managers/RealmManager.java

@@ -90,6 +90,36 @@ public class RealmManager {
         if (rep.getDefaultRoles() != null) {
             realm.updateDefaultRoles(rep.getDefaultRoles());
         }
+
+        if (rep.isAccountManagement()) {
+            enableAccountManagement(realm);
+        } else {
+            disableAccountManagement(realm);
+        }
+    }
+
+    private void enableAccountManagement(RealmModel realm) {
+        ApplicationModel application = realm.getApplicationById(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+        if (application == null) {
+            application = realm.addApplication(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+
+            UserCredentialModel password = new UserCredentialModel();
+            password.setType(UserCredentialModel.PASSWORD);
+            password.setValue(UUID.randomUUID().toString()); // just a random password as we'll never access it
+
+            realm.updateCredential(application.getApplicationUser(), password);
+
+            RoleModel applicationRole = realm.getRole(Constants.APPLICATION_ROLE);
+            realm.grantRole(application.getApplicationUser(), applicationRole);
+        }
+        application.setEnabled(true);
+    }
+
+    private void disableAccountManagement(RealmModel realm) {
+        ApplicationModel application = realm.getApplicationNameMap().get(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+        if (application != null) {
+            application.setEnabled(false); // TODO Should we delete the application instead?
+        }
     }
 
     public RealmModel importRealm(RealmRepresentation rep, UserModel realmCreator) {
@@ -214,6 +244,10 @@ public class RealmManager {
                 }
             }
         }
+
+        if (rep.isAccountManagement() != null && rep.isAccountManagement()) {
+            enableAccountManagement(newRealm);
+        }
     }
 
     public void createRole(RealmModel newRealm, RoleRepresentation roleRep) {
@@ -370,6 +404,9 @@ public class RealmManager {
         rep.setAccessCodeLifespan(realm.getAccessCodeLifespan());
         rep.setAccessCodeLifespanUserAction(realm.getAccessCodeLifespanUserAction());
 
+        ApplicationModel accountManagementApplication = realm.getApplicationNameMap().get(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+        rep.setAccountManagement(accountManagementApplication != null && accountManagementApplication.isEnabled());
+
         List<RoleModel> defaultRoles = realm.getDefaultRoles();
         if (defaultRoles.size() > 0) {
             String[] d = new String[defaultRoles.size()];

services/src/main/java/org/keycloak/services/managers/ResourceAdminManager.java

@@ -37,16 +37,20 @@ public class ResourceAdminManager {
     }
 
     protected boolean logoutResource(RealmModel realm, ApplicationModel resource, String user, ResteasyClient client) {
-        LogoutAction adminAction = new LogoutAction(TokenIdGenerator.generateId(), System.currentTimeMillis() / 1000 + 30, resource.getName(), user);
-        String token = new TokenManager().encodeToken(realm, adminAction);
-        Form form = new Form();
-        form.param("token", token);
         String managementUrl = resource.getManagementUrl();
-        logger.info("logout user: " + user + " resource: " + resource.getName() + " url" + managementUrl);
-        Response response = client.target(managementUrl).queryParam("action", "logout").request().post(Entity.form(form));
-        boolean success = response.getStatus() == 204;
-        response.close();
-        return success;
+        if (managementUrl != null) {
+            LogoutAction adminAction = new LogoutAction(TokenIdGenerator.generateId(), System.currentTimeMillis() / 1000 + 30, resource.getName(), user);
+            String token = new TokenManager().encodeToken(realm, adminAction);
+            Form form = new Form();
+            form.param("token", token);
+            logger.info("logout user: " + user + " resource: " + resource.getName() + " url" + managementUrl);
+            Response response = client.target(managementUrl).queryParam("action", "logout").request().post(Entity.form(form));
+            boolean success = response.getStatus() == 204;
+            response.close();
+            return success;
+        } else {
+            return false;
+        }
     }
 
 }

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -21,37 +21,35 @@
  */
 package org.keycloak.services.resources;
 
+import java.net.URI;
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
+import javax.ws.rs.*;
+import javax.ws.rs.core.*;
 import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.core.UriInfo;
 import javax.ws.rs.ext.Providers;
 
+import org.jboss.resteasy.annotations.cache.NoCache;
 import org.jboss.resteasy.jose.jws.JWSInput;
 import org.jboss.resteasy.jose.jws.crypto.RSAProvider;
+import org.jboss.resteasy.logging.Logger;
 import org.jboss.resteasy.spi.HttpRequest;
+import org.keycloak.AbstractOAuthClient;
+import org.keycloak.jaxrs.JaxrsOAuthClient;
+import org.keycloak.models.*;
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.services.email.EmailSender;
 import org.keycloak.services.managers.AccessCodeEntry;
 import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.managers.TokenManager;
 import org.keycloak.services.messages.Messages;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
 import org.keycloak.models.UserModel.RequiredAction;
 import org.keycloak.services.resources.flows.Flows;
 import org.keycloak.services.resources.flows.FormFlows;
+import org.keycloak.services.resources.flows.Pages;
+import org.keycloak.services.resources.flows.Urls;
 import org.keycloak.services.validation.Validation;
 import org.picketlink.idm.credential.util.TimeBasedOTP;
 
@@ -60,6 +58,10 @@ import org.picketlink.idm.credential.util.TimeBasedOTP;
  */
 public class AccountService {
 
+    private static final Logger logger = Logger.getLogger(AccountService.class);
+
+    public static final String ACCOUNT_IDENTITY_COOKIE = "KEYCLOAK_ACCOUNT_IDENTITY";
+
     private RealmModel realm;
 
     @Context
@@ -72,37 +74,64 @@ public class AccountService {
     private UriInfo uriInfo;
 
     @Context
-    protected Providers providers;
+    private Providers providers;
 
-    protected AuthenticationManager authManager = new AuthenticationManager();
+    private AuthenticationManager authManager = new AuthenticationManager();
+
+    private ApplicationModel application;
 
     private TokenManager tokenManager;
 
-    public AccountService(RealmModel realm, TokenManager tokenManager) {
+    public AccountService(RealmModel realm, ApplicationModel application, TokenManager tokenManager) {
         this.realm = realm;
+        this.application = application;
         this.tokenManager = tokenManager;
     }
 
+    private Response forwardToPage(String path, String template) {
+        UserModel user = getUser(false);
+        if (user != null) {
+            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToForm(template);
+        } else {
+            return login(path);
+        }
+    }
+
+    @Path("")
+    @GET
+    public Response accountPage() {
+        return forwardToPage(null, Pages.ACCOUNT);
+    }
+
+    @Path("social")
+    @GET
+    public Response socialPage() {
+        return forwardToPage("social", Pages.SOCIAL);
+    }
+
+    @Path("totp")
+    @GET
+    public Response totpPage() {
+        return forwardToPage("totp", Pages.TOTP);
+    }
+
+    @Path("password")
+    @GET
+    public Response passwordPage() {
+        return forwardToPage("password", Pages.PASSWORD);
+    }
+
     @Path("access")
     @GET
     public Response accessPage() {
-        UserModel user = getUserFromAuthManager();
-        if (user != null) {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToAccess();
-        } else {
-            return Response.status(Status.FORBIDDEN).build();
-        }
+        return forwardToPage("access", Pages.ACCESS);
     }
 
     @Path("")
     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response processAccountUpdate(final MultivaluedMap<String, String> formData) {
-        UserModel user = getUserFromAuthManager();
-        if (user == null) {
-            return Response.status(Status.FORBIDDEN).build();
-        }
-
+        UserModel user = getUser(true);
         user.setFirstName(formData.getFirst("firstName"));
         user.setLastName(formData.getFirst("lastName"));
         user.setEmail(formData.getFirst("email"));
@@ -113,7 +142,7 @@ public class AccountService {
     @Path("totp-remove")
     @GET
     public Response processTotpRemove() {
-        UserModel user = getUserFromAuthManager();
+        UserModel user = getUser(true);
         user.setTotp(false);
         return Flows.forms(realm, request, uriInfo).setError("successTotpRemoved").setErrorType(FormFlows.MessageType.SUCCESS)
                 .setUser(user).forwardToTotp();
@@ -123,31 +152,21 @@ public class AccountService {
     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response processTotpUpdate(final MultivaluedMap<String, String> formData) {
-        UserModel user = getUserFromAuthManager();
-        if (user == null) {
-            return Response.status(Status.FORBIDDEN).build();
-        }
-
-        FormFlows forms = Flows.forms(realm, request, uriInfo);
+        UserModel user = getUser(true);
 
         String totp = formData.getFirst("totp");
         String totpSecret = formData.getFirst("totpSecret");
 
-        String error = null;
-
+        FormFlows forms = Flows.forms(realm, request, uriInfo).setUser(user);
         if (Validation.isEmpty(totp)) {
-            error = Messages.MISSING_TOTP;
+            return forms.setError(Messages.MISSING_TOTP).forwardToTotp();
         } else if (!new TimeBasedOTP().validate(totp, totpSecret.getBytes())) {
-            error = Messages.INVALID_TOTP;
-        }
-
-        if (error != null) {
-            return forms.setError(error).setUser(user).forwardToTotp();
+            return forms.setError(Messages.INVALID_TOTP).forwardToTotp();
         }
 
         UserCredentialModel credentials = new UserCredentialModel();
         credentials.setType(CredentialRepresentation.TOTP);
-        credentials.setValue(formData.getFirst("totpSecret"));
+        credentials.setValue(totpSecret);
         realm.updateCredential(user, credentials);
 
         user.setTotp(true);
@@ -160,10 +179,7 @@ public class AccountService {
     @POST
     @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
     public Response processPasswordUpdate(final MultivaluedMap<String, String> formData) {
-        UserModel user = getUserFromAuthManager();
-        if (user == null) {
-            return Response.status(Status.FORBIDDEN).build();
-        }
+        UserModel user = getUser(true);
 
         FormFlows forms = Flows.forms(realm, request, uriInfo).setUser(user);
 
@@ -172,18 +188,17 @@ public class AccountService {
         String passwordConfirm = formData.getFirst("password-confirm");
 
         if (Validation.isEmpty(passwordNew)) {
-            forms.setError(Messages.MISSING_PASSWORD).forwardToPassword();
+            return forms.setError(Messages.MISSING_PASSWORD).forwardToPassword();
         } else if (!passwordNew.equals(passwordConfirm)) {
-            forms.setError(Messages.INVALID_PASSWORD_CONFIRM).forwardToPassword();
+            return forms.setError(Messages.INVALID_PASSWORD_CONFIRM).forwardToPassword();
         }
 
         if (Validation.isEmpty(password)) {
-            forms.setError(Messages.MISSING_PASSWORD).forwardToPassword();
+            return forms.setError(Messages.MISSING_PASSWORD).forwardToPassword();
         } else if (!realm.validatePassword(user, password)) {
-            forms.setError(Messages.INVALID_PASSWORD_EXISTING).forwardToPassword();
+            return forms.setError(Messages.INVALID_PASSWORD_EXISTING).forwardToPassword();
         }
 
-
         UserCredentialModel credentials = new UserCredentialModel();
         credentials.setType(CredentialRepresentation.PASSWORD);
         credentials.setValue(passwordNew);
@@ -193,50 +208,112 @@ public class AccountService {
         return Flows.forms(realm, request, uriInfo).setUser(user).forwardToPassword();
     }
 
-    @Path("")
+    @Path("login-redirect")
     @GET
-    public Response accountPage() {
-        UserModel user = getUserFromAuthManager();
-        if (user != null) {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToAccount();
-        } else {
-            return Response.status(Status.FORBIDDEN).build();
+    public Response loginRedirect(@QueryParam("code") String code,
+                                  @QueryParam("state") String state,
+                                  @QueryParam("error") String error,
+                                  @Context HttpHeaders headers) {
+        try {
+            if (error != null) {
+                logger.debug("error from oauth");
+                throw new ForbiddenException("error");
+            }
+            if (!realm.isEnabled()) {
+                logger.debug("realm not enabled");
+                throw new ForbiddenException();
+            }
+            UserModel client = application.getApplicationUser();
+            if (!client.isEnabled() || !application.isEnabled()) {
+                logger.debug("account management app not enabled");
+                throw new ForbiddenException();
+            }
+            if (code == null) {
+                logger.debug("code not specified");
+                throw new BadRequestException();
+            }
+            if (state == null) {
+                logger.debug("state not specified");
+                throw new BadRequestException();
+            }
+            String path = new JaxrsOAuthClient().checkStateCookie(uriInfo, headers);
+
+            JWSInput input = new JWSInput(code, providers);
+            boolean verifiedCode = false;
+            try {
+                verifiedCode = RSAProvider.verify(input, realm.getPublicKey());
+            } catch (Exception ignored) {
+                logger.debug("Failed to verify signature", ignored);
+            }
+            if (!verifiedCode) {
+                logger.debug("unverified access code");
+                throw new BadRequestException();
+            }
+            String key = input.readContent(String.class);
+            AccessCodeEntry accessCode = tokenManager.pullAccessCode(key);
+            if (accessCode == null) {
+                logger.debug("bad access code");
+                throw new BadRequestException();
+            }
+            if (accessCode.isExpired()) {
+                logger.debug("access code expired");
+                throw new BadRequestException();
+            }
+            if (!accessCode.getToken().isActive()) {
+                logger.debug("access token expired");
+                throw new BadRequestException();
+            }
+            if (!accessCode.getRealm().getId().equals(realm.getId())) {
+                logger.debug("bad realm");
+                throw new BadRequestException();
+
+            }
+            if (!client.getLoginName().equals(accessCode.getClient().getLoginName())) {
+                logger.debug("bad client");
+                throw new BadRequestException();
+            }
+
+            UriBuilder redirectBuilder = Urls.accountBase(uriInfo.getBaseUri());
+            if (path != null) {
+                redirectBuilder.path(path);
+            }
+            URI redirectUri = redirectBuilder.build(realm.getId());
+
+            NewCookie cookie = authManager.createAccountIdentityCookie(realm, accessCode.getUser(), Urls.accountBase(uriInfo.getBaseUri()).build(realm.getId()));
+            return Response.status(302).cookie(cookie).location(redirectUri).build();
+        } finally {
+            authManager.expireCookie(AbstractOAuthClient.OAUTH_TOKEN_REQUEST_STATE, uriInfo.getAbsolutePath().getPath());
         }
     }
 
-    @Path("social")
+    @Path("logout")
     @GET
-    public Response socialPage() {
-        UserModel user = getUserFromAuthManager();
-        if (user != null) {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToSocial();
-        } else {
-            return Response.status(Status.FORBIDDEN).build();
-        }
+    public Response logout() {
+        // TODO Should use single-sign out via TokenService
+        URI baseUri = Urls.accountBase(uriInfo.getBaseUri()).build(realm.getId());
+        authManager.expireIdentityCookie(realm, uriInfo);
+        authManager.expireAccountIdentityCookie(baseUri);
+        return Response.status(302).location(baseUri).build();
     }
 
-    @Path("totp")
-    @GET
-    public Response totpPage() {
-        UserModel user = getUserFromAuthManager();
-        if (user != null) {
-            return Flows.forms(realm, request, uriInfo).setUser(user).forwardToTotp();
-        } else {
-            return Response.status(Status.FORBIDDEN).build();
-        }
+    private Response login(String path) {
+        JaxrsOAuthClient oauth = new JaxrsOAuthClient();
+        String authUrl = Urls.realmLoginPage(uriInfo.getBaseUri(), realm.getId()).toString();
+        oauth.setAuthUrl(authUrl);
+
+        oauth.setClientId(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+
+        URI accountUri = Urls.accountPageBuilder(uriInfo.getBaseUri()).path(AccountService.class, "loginRedirect").build(realm.getId());
+
+        oauth.setStateCookiePath(accountUri.getPath());
+        return oauth.redirect(uriInfo, accountUri.toString(), path);
     }
 
-    @Path("password")
-    @GET
-    public Response passwordPage() {
-        UserModel user = getUserFromAuthManager();
-        if (user == null) {
-            return Response.status(Status.FORBIDDEN).build();
+    private UserModel getUser(boolean required) {
+        UserModel user = authManager.authenticateAccountIdentityCookie(realm, uriInfo, headers);
+        if (user == null && required) {
+            throw new ForbiddenException();
         }
-        return Flows.forms(realm, request, uriInfo).setUser(user).forwardToPassword();
-    }
-
-    private UserModel getUserFromAuthManager() {
-        return authManager.authenticateIdentityCookie(realm, uriInfo, headers);
+        return user;
     }
 }

services/src/main/java/org/keycloak/services/resources/RealmsResource.java

@@ -1,6 +1,8 @@
 package org.keycloak.services.resources;
 
 import org.jboss.resteasy.logging.Logger;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.Constants;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.managers.TokenManager;
 import org.keycloak.models.KeycloakSession;
@@ -66,7 +68,14 @@ public class RealmsResource {
             logger.debug("realm not found");
             throw new NotFoundException();
         }
-        AccountService accountService = new AccountService(realm, tokenManager);
+
+        ApplicationModel application = realm.getApplicationNameMap().get(Constants.ACCOUNT_MANAGEMENT_APPLICATION);
+        if (application == null || !application.isEnabled()) {
+            logger.debug("account management not enabled");
+            throw new NotFoundException();
+        }
+
+        AccountService accountService = new AccountService(realm, application, tokenManager);
         resourceContext.initResource(accountService);
         return accountService;
     }

services/src/main/java/org/keycloak/services/resources/RequiredActionsService.java

@@ -127,7 +127,7 @@ public class RequiredActionsService {
 
         UserCredentialModel credentials = new UserCredentialModel();
         credentials.setType(CredentialRepresentation.TOTP);
-        credentials.setValue(formData.getFirst("totpSecret"));
+        credentials.setValue(totpSecret);
         realm.updateCredential(user, credentials);
 
         user.setTotp(true);

services/src/main/java/org/keycloak/services/resources/flows/FormFlows.java

@@ -141,7 +141,7 @@ public class FormFlows {
         return Response.status(200).entity("form provider not found").build();
     }
 
-    private Response forwardToForm(String template) {
+    public Response forwardToForm(String template) {
 
         FormService.FormServiceDataBean formDataBean = new FormService.FormServiceDataBean(realm, userModel, formData, error);
         formDataBean.setMessageType(messageType);

services/src/main/java/org/keycloak/services/resources/flows/Urls.java

@@ -35,12 +35,16 @@ public class Urls {
         return accountBase(baseUri).path(AccountService.class, "accessPage").build(realmId);
     }
 
-    private static UriBuilder accountBase(URI baseUri) {
+    public static UriBuilder accountBase(URI baseUri) {
         return realmBase(baseUri).path(RealmsResource.class, "getAccountService");
     }
 
     public static URI accountPage(URI baseUri, String realmId) {
-        return accountBase(baseUri).path(AccountService.class, "accountPage").build(realmId);
+        return accountPageBuilder(baseUri).build(realmId);
+    }
+
+    public static UriBuilder accountPageBuilder(URI baseUri) {
+        return accountBase(baseUri).path(AccountService.class, "accountPage");
     }
 
     public static URI accountPasswordPage(URI baseUri, String realmId) {
@@ -59,6 +63,10 @@ public class Urls {
         return accountBase(baseUri).path(AccountService.class, "processTotpRemove").build(realmId);
     }
 
+    public static URI accountLogout(URI baseUri, String realmId) {
+        return accountBase(baseUri).path(AccountService.class, "logout").build(realmId);
+    }
+
     public static URI loginActionUpdatePassword(URI baseUri, String realmId) {
         return requiredActionsBase(baseUri).path(RequiredActionsService.class, "updatePassword").build(realmId);
     }

services/src/test/java/org/keycloak/test/ApplicationModelTest.java

@@ -1,23 +1,20 @@
 package org.keycloak.test;
 
-import java.util.Iterator;
-import java.util.List;
-
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
-import org.keycloak.models.ApplicationModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
+import org.keycloak.models.*;
 import org.keycloak.representations.idm.ApplicationRepresentation;
 import org.keycloak.services.managers.ApplicationManager;
 import org.keycloak.services.managers.RealmManager;
 import org.keycloak.services.resources.KeycloakApplication;
 
+import java.util.Iterator;
+import java.util.List;
+
+import static org.junit.Assert.assertNotNull;
+
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */