Merge pull request #447 from patriot1burke/master

bump version
2014-06-02 12:22:40 -04:00 · 2014-06-02 12:21:58 -04:00 · 2014-06-02 12:03:09 -04:00 · 2014-06-02 12:02:42 -04:00 · 2014-06-02 11:22:51 -04:00 · 2014-06-02 11:22:19 -04:00
1283 changed files with 239920 additions and 85063 deletions
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-2</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui-styles</artifactId>
-	<name>Keycloak Admin UI Styles</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>
@@ -1,71 +0,0 @@
-/* http://meyerweb.com/eric/tools/css/reset/ 
-   v2.0 | 20110126
-   License: none (public domain)
-*/
-
-html, body, div, span, applet, object, iframe,
-h1, h2, h3, h4, h5, h6, p, blockquote, pre,
-a, abbr, acronym, address, big, cite, code,
-del, dfn, em, img, ins, kbd, q, s, samp,
-small, strike, strong, sub, sup, tt, var,
-b, u, i, center,
-dl, dt, dd, ol, ul, li,
-fieldset, form, label, legend,
-table, caption, tbody, tfoot, thead, tr, th, td,
-article, aside, canvas, details, embed, 
-figure, figcaption, footer, header, hgroup, 
-menu, nav, output, ruby, section, summary,
-time, mark, audio, video {
-	margin: 0;
-	padding: 0;
-	border: 0;
-	font-size: 100%;
-	font: inherit;
-	vertical-align: baseline;
-}
-/* HTML5 display-role reset for older browsers */
-article, aside, details, figcaption, figure, 
-footer, header, hgroup, menu, nav, section {
-	display: block;
-}
-body {
-	line-height: 1;
-}
-ol, ul {
-	list-style: none;
-}
-blockquote, q {
-	quotes: none;
-}
-blockquote:before, blockquote:after,
-q:before, q:after {
-	content: '';
-	content: none;
-}
-table {
-	border-collapse: collapse;
-	border-spacing: 0;
-}
-
-/* Clearfix */
-
-.clearfix:after {
-	content: ".";
-	display: block;
-	clear: both;
-	visibility: hidden;
-	line-height: 0;
-	height: 0;
-}
- 
-.clearfix {
-	display: inline-block;
-}
- 
-html[xmlns] .clearfix {
-	display: block;
-}
- 
-* html .clearfix {
-	height: 1%;
-}
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="23px" height="14px" viewBox="0 0 23 14" enable-background="new 0 0 23 14" xml:space="preserve">
-<polyline fill="none" stroke="#009AD8" stroke-miterlimit="10" points="1,13 7,7 1,1 "/>
-</svg>
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="22px" height="52px" viewBox="0 0 22 52" enable-background="new 0 0 22 52" xml:space="preserve">
-<polygon fill="#828487" points="11,16 6.818,11.818 7.525,11.111 11,14.586 14.475,11.111 15.182,11.818 "/>
-<polygon fill="#DBDADA" points="11,42 6.818,37.818 7.525,37.111 11,40.586 14.475,37.111 15.182,37.818 "/>
-</svg>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-2</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui</artifactId>
-	<name>Keycloak Admin UI</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>
@@ -1,191 +0,0 @@
-<!doctype html>
-<html lang="en">
-
-<head>
-    <style>
-        .mock_view {
-            padding: 2em 2em;
-        }
-
-    </style>
-
-    <meta charset="utf-8">
-    <title>Keycloak Admin Console</title>
-
-    <link rel="icon" href="/auth/admin-ui/img/favicon.ico">
-
-    <!-- Frameworks -->
-    <!--link rel="stylesheet" href="/auth/admin-ui/bootstrap/css/bootstrap.css"-->
-    <link rel="stylesheet" href="/auth/admin-ui/patternfly/css/patternfly.css">
-
-    <!-- Page styles -->
-    <link rel="stylesheet" href="/auth/admin-ui/css/admin-console.css">
-    <link href="lib/select2-3.4.1/select2.css" rel="stylesheet">
-
-    <script src="lib/jquery/jquery-1.10.2.js" type="text/javascript"></script>
-    <script src="lib/select2-3.4.1/select2.js" type="text/javascript"></script>
-
-    <script src="lib/angular/angular.js"></script>
-    <script src="lib/angular/angular-resource.js"></script>
-    <script src="lib/angular/ui-bootstrap-tpls-0.4.0.js"></script>
-
-    <script src="lib/jquery/jquery.idletimer.js" type="text/javascript"></script>
-    <script src="lib/jquery/jquery.idletimeout.js" type="text/javascript"></script>
-    <script src="lib/angular/select2.js" type="text/javascript"></script>
-    <script src="lib/fileupload/angular-file-upload.min.js"></script>     <!--
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/dropdown.js"></script>
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/tooltip.js"></script>
-    -->
-    <script src="/auth/admin-ui/js/bootstrap-tokenfield.js"></script>
-
-    <script src="/auth/admin-ui/bootstrap/js/bootstrap.js"></script>
-
-    <script src="js/app.js"></script>
-    <script src="js/controllers/realm.js"></script>
-    <script src="js/controllers/applications.js"></script>
-    <script src="js/controllers/oauth-clients.js"></script>
-    <script src="js/controllers/users.js"></script>
-    <script src="js/loaders.js"></script>
-    <script src="js/services.js"></script>
-
-    <style>
-        [ng\:cloak], [ng-cloak], .ng-cloak {
-            display: none !important;
-        }
-    </style>
-</head>
-
-<body class="admin-console" data-ng-controller="GlobalCtrl" ng-cloak>
-<div id="idletimeout">
-    You will be logged off in <strong><span></span> seconds</strong> due to inactivity.
-    <a id="idletimeout-resume" href="#">Click here to continue using this web page</a>.
-</div>
-
-
-<div class="feedback-aligner" data-ng-show="notification" data-ng-click="notification = null">
-    <div class="alert alert-{{notification.type}}"><strong>{{notification.header}}</strong> {{notification.message}}</div>
-</div>
-
-<header class="navbar navbar-default navbar-pf navbar-main header">
-    <div class="container">
-        <nav id="kc-navigation" class="navbar" role="navigation">
-            <div class="navbar-header">
-                <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse-1">
-                    <span class="sr-only">Toggle navigation</span>
-                    <span class="icon-bar"></span>
-                    <span class="icon-bar"></span>
-                    <span class="icon-bar"></span>
-                </button>
-                <h1 class="navbar-title"><Strong>KeyCloak</Strong> Central Login</h1>
-            </div>
-            <div class="collapse navbar-collapse navbar-collapse-1">
-                <ul class="nav navbar-nav navbar-utility" data-ng-show="auth.loggedIn">
-                    <li class="dropdown">
-                        <a data-toggle="dropdown" class="dropdown-toggle" href="#">
-                            <span class="pficon pficon-user"></span>
-                            {{auth.user.displayName}}<b class="caret"></b>
-                        </a>
-                        <ul class="dropdown-menu">
-                            <li><a href="/auth/rest/realms/keycloak-admin/account?referrer=admin-console">Manage Account</a></li>
-                            <li class="separator"><a href="/auth/rest/admin/logout">Sign Out</a></li>
-                        </ul>
-                    </li>
-                </ul>
-                <ul class="nav navbar-nav navbar-primary persistent-secondary" data-ng-controller="RealmDropdownCtrl">
-                    <li class="dropdown context" data-ng-show="showNav()">
-                        <a href="#" class="dropdown-toggle" data-toggle="dropdown">
-                            Realm: {{current.realm.id}}
-                            <b class="caret"></b>
-                        </a>
-                        <ul class="dropdown-menu">
-                            <li data-ng-repeat="realm in current.realms">
-                                <a href="" ng-click="changeRealm(realm.id)" >{{realm.id}}</a>
-                            </li>
-                        </ul>
-                    </li>
-
-
-                    <!--------------------------------------->
-                    <li class="active">
-                        <a href="#">Settings</a>
-                        <ul class="nav navbar-nav navbar-persistent">
-                            <li class="active">
-                                <a href="#">General</a>
-                            </li>
-                            <li>
-                                <a href="#">Roles</a>
-                            </li>
-                            <li>
-                                <a href="#">Default Roles</a>
-                            </li>
-                            <li>
-                                <a href="#">Credentials</a>
-                            </li>
-                            <li>
-                                <a href="#">Token</a>
-                            </li>
-                            <li>
-                                <a href="#">Keys</a>
-                            </li>
-                            <li>
-                                <a href="#">Email</a>
-                            </li>
-                        </ul>
-                    </li>
-                    <li>
-                        <a href="#">User</a>
-                    </li>
-                    <li>
-                        <a href="#">Applications</a>
-                    </li>
-                    <li>
-                        <a href="#">OAuth Clients</a>
-                    </li>
-                    <!--------------------------------------->
-
-
-                    <li class="active pull-right" data-ng-show="auth.loggedIn">
-                        <a class="button primary" href="#/create/realm" data-ng-class="path[0] == 'create' && path[1] == 'realm' && 'active'"
-                           data-ng-show="auth.loggedIn">Add Realm</a>
-                    </li>
-                </ul>
-            </div>
-        </nav>
-
-    </div>
-</header>
-
-<div class="container">
-    <div class="mock_view" data-ng-view id="view"></div>
-    <div id="loading" class="loading-backdrop">
-        <div class="loading">
-            <span>Loading...</span>
-        </div>
-    </div>
-</div>
-
-<script type="text/javascript">
-    $.idleTimeout('#idletimeout', '#idletimeout a', {
-        idleAfter: 300,
-        pollingInterval: 60,
-        keepAliveURL: '/auth/rest/admin/keepalive',
-        serverResponseEquals: '',
-        failedRequests: 1,
-        onTimeout: function(){
-            $(this).slideUp();
-            window.location = "/auth/rest/admin/logout";
-        },
-        onIdle: function(){
-            $(this).slideDown(); // show the warning bar
-        },
-        onCountdown: function( counter ){
-            $(this).find("span").html( counter ); // update the counter
-        },
-        onResume: function(){
-            $(this).slideUp(); // hide the warning bar
-        }
-    });
-</script>
-
-</body>
-</html>
@@ -1,352 +0,0 @@
-module.controller('ApplicationRoleListCtrl', function($scope, $location, realm, application, roles) {
-    $scope.realm = realm;
-    $scope.roles = roles;
-    $scope.application = application;
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-});
-
-module.controller('ApplicationCredentialsCtrl', function($scope, $location, realm, application, ApplicationCredentials, Notifications) {
-    $scope.realm = realm;
-    $scope.application = application;
-    var secret = ApplicationCredentials.get({ realm : realm.realm, application : application.name },
-        function() {
-            $scope.secret = secret.value;
-        }
-    );
-
-    $scope.changePassword = function() {
-        var secret = ApplicationCredentials.update({ realm : realm.realm, application : application.name },
-            function() {
-                Notifications.success('The secret has been changed.');
-                $scope.secret = secret.value;
-            },
-            function() {
-                Notifications.error("The secret was not changed due to a problem.");
-                $scope.secret = "error";
-            }
-        );
-    };
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-});
-
-module.controller('ApplicationSessionsCtrl', function($scope, $location, realm, application) {
-    $scope.realm = realm;
-    $scope.application = application;
-});
-
-module.controller('ApplicationRoleDetailCtrl', function($scope, realm, application, role, roles, applications,
-                                                        Role, ApplicationRole, RoleById, RoleRealmComposites, RoleApplicationComposites,
-                                                        $http, $location, Dialog, Notifications) {
-    $scope.realm = realm;
-    $scope.application = application;
-    $scope.role = angular.copy(role);
-    $scope.create = !role.name;
-
-    $scope.changed = $scope.create;
-
-    $scope.save = function() {
-        if ($scope.create) {
-            ApplicationRole.save({
-                realm: realm.realm,
-                application : application.name
-            }, $scope.role, function (data, headers) {
-                $scope.changed = false;
-                role = angular.copy($scope.role);
-
-                var l = headers().location;
-                var id = l.substring(l.lastIndexOf("/") + 1);
-                $location.url("/realms/" + realm.realm + "/applications/" + application.name + "/roles/" + id);
-                Notifications.success("The role has been created.");
-            });
-        } else {
-            $scope.update();
-        }
-    };
-
-    $scope.remove = function() {
-        Dialog.confirmDelete($scope.role.name, 'role', function() {
-            $scope.role.$remove({
-                realm : realm.realm,
-                application : application.name,
-                role : $scope.role.name
-            }, function() {
-                $location.url("/realms/" + realm.realm + "/applications/" + application.name + "/roles");
-                Notifications.success("The role has been deleted.");
-            });
-        });
-    };
-
-    $scope.cancel = function () {
-        $location.url("/realms/" + realm.realm + "/applications/" + application.name + "/roles");
-    };
-
-
-    roleControl($scope, realm, role, roles, applications,
-        ApplicationRole, RoleById, RoleRealmComposites, RoleApplicationComposites,
-        $http, $location, Notifications, Dialog);
-
-});
-
-module.controller('ApplicationListCtrl', function($scope, realm, applications, Application, $location) {
-    console.log('ApplicationListCtrl');
-    $scope.realm = realm;
-    $scope.applications = applications;
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-});
-
-module.controller('ApplicationInstallationCtrl', function($scope, realm, application, ApplicationInstallation,ApplicationInstallationJBoss, $http, $routeParams) {
-    console.log('ApplicationInstallationCtrl');
-    $scope.realm = realm;
-    $scope.application = application;
-    $scope.installation = null;
-    $scope.download = null;
-    $scope.configFormat = null;
-
-    $scope.configFormats = [
-        "keycloak.json",
-        "Wildfly/JBoss Subsystem XML"
-    ];
-
-    $scope.changeFormat = function() {
-        if ($scope.configFormat == "keycloak.json") {
-            var url = ApplicationInstallation.url({ realm: $routeParams.realm, application: $routeParams.application });
-            var installation = $http.get(url).success(function(data) {
-                var tmp = angular.fromJson(data);
-                $scope.installation = angular.toJson(tmp, true);
-            })
-            $scope.download = url;
-        } else if ($scope.configFormat == "Wildfly/JBoss Subsystem XML") {
-            var url = ApplicationInstallationJBoss.url({ realm: $routeParams.realm, application: $routeParams.application });
-            var installation = $http.get(url).success(function(data) {
-                $scope.installation = data;
-            })
-            $scope.download = url;
-        }
-
-    };
-
-});
-
-module.controller('ApplicationDetailCtrl', function($scope, realm, application, Application, $location, Dialog, Notifications) {
-    console.log('ApplicationDetailCtrl');
-
-    $scope.realm = realm;
-    $scope.create = !application.name;
-    if (!$scope.create) {
-        $scope.application= angular.copy(application);
-    } else {
-        $scope.application = {};
-        $scope.application.webOrigins = [];
-        $scope.application.redirectUris = [];
-    }
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-
-    $scope.$watch('application', function() {
-        if (!angular.equals($scope.application, application)) {
-            $scope.changed = true;
-        }
-    }, true);
-
-    $scope.deleteWebOrigin = function(index) {
-        $scope.application.webOrigins.splice(index, 1);
-    }
-    $scope.addWebOrigin = function() {
-        $scope.application.webOrigins.push($scope.newWebOrigin);
-        $scope.newWebOrigin = "";
-    }
-    $scope.deleteRedirectUri = function(index) {
-        $scope.application.redirectUris.splice(index, 1);
-    }
-    $scope.addRedirectUri = function() {
-        $scope.application.redirectUris.push($scope.newRedirectUri);
-        $scope.newRedirectUri = "";
-    }
-
-    $scope.save = function() {
-        if ($scope.create) {
-            Application.save({
-                realm: realm.realm,
-                application: ''
-            }, $scope.application, function (data, headers) {
-                $scope.changed = false;
-                var l = headers().location;
-                var id = l.substring(l.lastIndexOf("/") + 1);
-                $location.url("/realms/" + realm.realm + "/applications/" + id);
-                Notifications.success("The application has been created.");
-            });
-        } else {
-            Application.update({
-                realm : realm.realm,
-                application : application.name
-            }, $scope.application, function() {
-                $scope.changed = false;
-                application = angular.copy($scope.application);
-                Notifications.success("Your changes have been saved to the application.");
-            });
-        }
-    };
-
-    $scope.reset = function() {
-        $scope.application = angular.copy(application);
-        $scope.changed = false;
-    };
-
-    $scope.cancel = function() {
-        $location.url("/realms/" + realm.realm + "/applications");
-    };
-
-    $scope.remove = function() {
-        Dialog.confirmDelete($scope.application.name, 'application', function() {
-            $scope.application.$remove({
-                realm : realm.realm,
-                application : $scope.application.name
-            }, function() {
-                $location.url("/realms/" + realm.realm + "/applications");
-                Notifications.success("The application has been deleted.");
-            });
-        });
-    };
-
-
-});
-
-module.controller('ApplicationScopeMappingCtrl', function($scope, $http, realm, application, roles, applications, ApplicationRealmScopeMapping, ApplicationApplicationScopeMapping, ApplicationRole) {
-    $scope.realm = realm;
-    $scope.application = application;
-    $scope.realmRoles = angular.copy(roles);
-    $scope.selectedRealmRoles = [];
-    $scope.selectedRealmMappings = [];
-    $scope.realmMappings = [];
-    $scope.applications = applications;
-    $scope.applicationRoles = [];
-    $scope.selectedApplicationRoles = [];
-    $scope.selectedApplicationMappings = [];
-    $scope.applicationMappings = [];
-
-
-
-    $scope.realmMappings = ApplicationRealmScopeMapping.query({realm : realm.realm, application : application.name}, function(){
-        for (var i = 0; i < $scope.realmMappings.length; i++) {
-            var role = $scope.realmMappings[i];
-            for (var j = 0; j < $scope.realmRoles.length; j++) {
-                var realmRole = $scope.realmRoles[j];
-                if (realmRole.id == role.id) {
-                    var idx = $scope.realmRoles.indexOf(realmRole);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        break;
-                    }
-                }
-            }
-        }
-    });
-
-    $scope.addRealmRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/applications/' + application.name + '/scope-mappings/realm',
-                $scope.selectedRealmRoles).success(function() {
-                for (var i = 0; i < $scope.selectedRealmRoles.length; i++) {
-                    var role = $scope.selectedRealmRoles[i];
-                    var idx = $scope.realmRoles.indexOf($scope.selectedRealmRoles[i]);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        $scope.realmMappings.push(role);
-                    }
-                }
-                $scope.selectRealmRoles = [];
-            });
-    };
-
-    $scope.deleteRealmRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/applications/' + application.name +  '/scope-mappings/realm',
-            {data : $scope.selectedRealmMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedRealmMappings.length; i++) {
-                    var role = $scope.selectedRealmMappings[i];
-                    var idx = $scope.realmMappings.indexOf($scope.selectedRealmMappings[i]);
-                    if (idx != -1) {
-                        $scope.realmMappings.splice(idx, 1);
-                        $scope.realmRoles.push(role);
-                    }
-                }
-                $scope.selectedRealmMappings = [];
-            });
-    };
-
-    $scope.addApplicationRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/applications/' + application.name +  '/scope-mappings/applications/' + $scope.targetApp.name,
-                $scope.selectedApplicationRoles).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationRoles.length; i++) {
-                    var role = $scope.selectedApplicationRoles[i];
-                    var idx = $scope.applicationRoles.indexOf($scope.selectedApplicationRoles[i]);
-                    if (idx != -1) {
-                        $scope.applicationRoles.splice(idx, 1);
-                        $scope.applicationMappings.push(role);
-                    }
-                }
-                $scope.selectedApplicationRoles = [];
-            });
-    };
-
-    $scope.deleteApplicationRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/applications/' + application.name +  '/scope-mappings/applications/' + $scope.targetApp.name,
-            {data : $scope.selectedApplicationMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationMappings.length; i++) {
-                    var role = $scope.selectedApplicationMappings[i];
-                    var idx = $scope.applicationMappings.indexOf($scope.selectedApplicationMappings[i]);
-                    if (idx != -1) {
-                        $scope.applicationMappings.splice(idx, 1);
-                        $scope.applicationRoles.push(role);
-                    }
-                }
-                $scope.selectedApplicationMappings = [];
-            });
-    };
-
-
-    $scope.changeApplication = function() {
-        if ($scope.targetApp) {
-            $scope.applicationRoles = ApplicationRole.query({realm : realm.realm, application : $scope.targetApp.name}, function() {
-                    $scope.applicationMappings = ApplicationApplicationScopeMapping.query({realm : realm.realm, application : application.name, targetApp : $scope.targetApp.name}, function(){
-                        for (var i = 0; i < $scope.applicationMappings.length; i++) {
-                            var role = $scope.applicationMappings[i];
-                            for (var j = 0; j < $scope.applicationRoles.length; j++) {
-                                var realmRole = $scope.applicationRoles[j];
-                                if (realmRole.id == role.id) {
-                                    var idx = $scope.applicationRoles.indexOf(realmRole);
-                                    if (idx != -1) {
-                                        $scope.applicationRoles.splice(idx, 1);
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                    });
-
-                }
-            );
-        } else {
-            $scope.applicationRoles = null;
-        }
-    };
-
-
-
-});
@@ -1,255 +0,0 @@
-module.controller('OAuthClientCredentialsCtrl', function($scope, $location, realm, oauth, OAuthClientCredentials, Notifications) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-
-    var secret = OAuthClientCredentials.get({ realm : realm.realm, oauth : oauth.id },
-        function() {
-            $scope.secret = secret.value;
-        }
-    );
-
-    $scope.changePassword = function() {
-        var secret = OAuthClientCredentials.update({ realm : realm.realm,  oauth : oauth.id  },
-            function() {
-                Notifications.success('The secret has been changed.');
-                $scope.secret = secret.value;
-            },
-            function() {
-                Notifications.error("The secret was not changed due to a problem.");
-                $scope.secret = "error";
-            }
-        );
-    };
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-
-});
-
-module.controller('OAuthClientListCtrl', function($scope, realm, oauthClients, OAuthClient, $location) {
-    $scope.realm = realm;
-    $scope.oauthClients = oauthClients;
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-});
-
-module.controller('OAuthClientDetailCtrl', function($scope, realm, oauth, OAuthClient, $location, Dialog, Notifications) {
-    $scope.realm = realm;
-    $scope.create = !oauth.id;
-    if (!$scope.create) {
-        $scope.oauth= angular.copy(oauth);
-    } else {
-        $scope.oauth = {};
-        $scope.oauth.webOrigins = [];
-        $scope.oauth.redirectUris = [];
-    }
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-
-    $scope.$watch('oauth', function() {
-        if (!angular.equals($scope.oauth, oauth)) {
-            $scope.changed = true;
-        }
-    }, true);
-
-    $scope.deleteWebOrigin = function(index) {
-        $scope.oauth.webOrigins.splice(index, 1);
-    }
-    $scope.addWebOrigin = function() {
-        $scope.oauth.webOrigins.push($scope.newWebOrigin);
-        $scope.newWebOrigin = "";
-    }
-    $scope.deleteRedirectUri = function(index) {
-        $scope.oauth.redirectUris.splice(index, 1);
-    }
-    $scope.addRedirectUri = function() {
-        $scope.oauth.redirectUris.push($scope.newRedirectUri);
-        $scope.newRedirectUri = "";
-    }
-
-    $scope.save = function() {
-        if ($scope.create) {
-            OAuthClient.save({
-                realm: realm.realm
-            }, $scope.oauth, function (data, headers) {
-                $scope.changed = false;
-                var l = headers().location;
-                var id = l.substring(l.lastIndexOf("/") + 1);
-                $location.url("/realms/" + realm.realm + "/oauth-clients/" + id);
-                Notifications.success("The oauth client has been created.");
-            });
-        } else {
-            OAuthClient.update({
-                realm : realm.realm,
-                id : oauth.id
-            }, $scope.oauth, function() {
-                $scope.changed = false;
-                oauth = angular.copy($scope.oauth);
-                Notifications.success("Your changes have been saved to the oauth client.");
-            });
-        }
-    };
-
-    $scope.reset = function() {
-        $scope.oauth = angular.copy(oauth);
-        $scope.changed = false;
-    };
-
-    $scope.cancel = function() {
-        $location.url("/realms/" + realm.realm + "/oauth-clients");
-    };
-
-    $scope.remove = function() {
-        Dialog.confirmDelete($scope.oauth.name, 'oauth', function() {
-            $scope.oauth.$remove({
-                realm : realm.realm,
-                id : $scope.oauth.id
-            }, function() {
-                $location.url("/realms/" + realm.realm + "/oauth-clients");
-                Notifications.success("The oauth client has been deleted.");
-            });
-        });
-    };
-
-
-});
-
-module.controller('OAuthClientScopeMappingCtrl', function($scope, $http, realm, oauth, roles, applications, OAuthClientRealmScopeMapping, OAuthClientApplicationScopeMapping, ApplicationRole) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-    $scope.realmRoles = angular.copy(roles);
-    $scope.selectedRealmRoles = [];
-    $scope.selectedRealmMappings = [];
-    $scope.realmMappings = [];
-    $scope.applications = applications;
-    $scope.applicationRoles = [];
-    $scope.selectedApplicationRoles = [];
-    $scope.selectedApplicationMappings = [];
-    $scope.applicationMappings = [];
-
-
-
-    $scope.realmMappings = OAuthClientRealmScopeMapping.query({realm : realm.realm, oauth : oauth.id}, function(){
-        for (var i = 0; i < $scope.realmMappings.length; i++) {
-            var role = $scope.realmMappings[i];
-            for (var j = 0; j < $scope.realmRoles.length; j++) {
-                var realmRole = $scope.realmRoles[j];
-                if (realmRole.id == role.id) {
-                    var idx = $scope.realmRoles.indexOf(realmRole);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        break;
-                    }
-                }
-            }
-        }
-    });
-
-    $scope.addRealmRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id + '/scope-mappings/realm',
-                $scope.selectedRealmRoles).success(function() {
-                for (var i = 0; i < $scope.selectedRealmRoles.length; i++) {
-                    var role = $scope.selectedRealmRoles[i];
-                    var idx = $scope.realmRoles.indexOf($scope.selectedRealmRoles[i]);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        $scope.realmMappings.push(role);
-                    }
-                }
-                $scope.selectRealmRoles = [];
-            });
-    };
-
-    $scope.deleteRealmRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/realm',
-            {data : $scope.selectedRealmMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedRealmMappings.length; i++) {
-                    var role = $scope.selectedRealmMappings[i];
-                    var idx = $scope.realmMappings.indexOf($scope.selectedRealmMappings[i]);
-                    if (idx != -1) {
-                        $scope.realmMappings.splice(idx, 1);
-                        $scope.realmRoles.push(role);
-                    }
-                }
-                $scope.selectedRealmMappings = [];
-            });
-    };
-
-    $scope.addApplicationRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/applications/' + $scope.targetApp.name,
-                $scope.selectedApplicationRoles).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationRoles.length; i++) {
-                    var role = $scope.selectedApplicationRoles[i];
-                    var idx = $scope.applicationRoles.indexOf($scope.selectedApplicationRoles[i]);
-                    if (idx != -1) {
-                        $scope.applicationRoles.splice(idx, 1);
-                        $scope.applicationMappings.push(role);
-                    }
-                }
-                $scope.selectedApplicationRoles = [];
-            });
-    };
-
-    $scope.deleteApplicationRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/applications/' + $scope.targetApp.name,
-            {data : $scope.selectedApplicationMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationMappings.length; i++) {
-                    var role = $scope.selectedApplicationMappings[i];
-                    var idx = $scope.applicationMappings.indexOf($scope.selectedApplicationMappings[i]);
-                    if (idx != -1) {
-                        $scope.applicationMappings.splice(idx, 1);
-                        $scope.applicationRoles.push(role);
-                    }
-                }
-                $scope.selectedApplicationMappings = [];
-            });
-    };
-
-
-    $scope.changeApplication = function() {
-        if ($scope.targetApp) {
-            $scope.applicationRoles = ApplicationRole.query({realm : realm.realm, application : $scope.targetApp.name}, function() {
-                    $scope.applicationMappings = OAuthClientApplicationScopeMapping.query({realm : realm.realm, oauth : oauth.id, targetApp : $scope.targetApp.name}, function(){
-                        for (var i = 0; i < $scope.applicationMappings.length; i++) {
-                            var role = $scope.applicationMappings[i];
-                            for (var j = 0; j < $scope.applicationRoles.length; j++) {
-                                var realmRole = $scope.applicationRoles[j];
-                                if (realmRole.id == role.id) {
-                                    var idx = $scope.applicationRoles.indexOf(realmRole);
-                                    if (idx != -1) {
-                                        $scope.applicationRoles.splice(idx, 1);
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                    });
-
-                }
-            );
-        } else {
-            $scope.targetApp = null;
-        }
-    };
-
-
-
-});
-
-
-module.controller('OAuthClientInstallationCtrl', function($scope, realm, installation, oauth, OAuthClientInstallation, $routeParams) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-    $scope.installation = installation;
-    $scope.download = OAuthClientInstallation.url({ realm: $routeParams.realm, oauth: $routeParams.oauth });
-});
@@ -1,457 +0,0 @@
-/**
- * @license AngularJS v1.0.7
- * (c) 2010-2012 Google, Inc. http://angularjs.org
- * License: MIT
- */
-(function(window, angular, undefined) {
-'use strict';
-
-/**
- * @ngdoc overview
- * @name ngResource
- * @description
- */
-
-/**
- * @ngdoc object
- * @name ngResource.$resource
- * @requires $http
- *
- * @description
- * A factory which creates a resource object that lets you interact with
- * [RESTful](http://en.wikipedia.org/wiki/Representational_State_Transfer) server-side data sources.
- *
- * The returned resource object has action methods which provide high-level behaviors without
- * the need to interact with the low level {@link ng.$http $http} service.
- *
- * # Installation
- * To use $resource make sure you have included the `angular-resource.js` that comes in Angular 
- * package. You can also find this file on Google CDN, bower as well as at
- * {@link http://code.angularjs.org/ code.angularjs.org}.
- *
- * Finally load the module in your application:
- *
- *        angular.module('app', ['ngResource']);
- *
- * and you are ready to get started!
- *
- * @param {string} url A parameterized URL template with parameters prefixed by `:` as in
- *   `/user/:username`. If you are using a URL with a port number (e.g. 
- *   `http://example.com:8080/api`), you'll need to escape the colon character before the port
- *   number, like this: `$resource('http://example.com\\:8080/api')`.
- *
- * @param {Object=} paramDefaults Default values for `url` parameters. These can be overridden in
- *   `actions` methods.
- *
- *   Each key value in the parameter object is first bound to url template if present and then any
- *   excess keys are appended to the url search query after the `?`.
- *
- *   Given a template `/path/:verb` and parameter `{verb:'greet', salutation:'Hello'}` results in
- *   URL `/path/greet?salutation=Hello`.
- *
- *   If the parameter value is prefixed with `@` then the value of that parameter is extracted from
- *   the data object (useful for non-GET operations).
- *
- * @param {Object.<Object>=} actions Hash with declaration of custom action that should extend the
- *   default set of resource actions. The declaration should be created in the following format:
- *
- *       {action1: {method:?, params:?, isArray:?},
- *        action2: {method:?, params:?, isArray:?},
- *        ...}
- *
- *   Where:
- *
- *   - `action` – {string} – The name of action. This name becomes the name of the method on your
- *     resource object.
- *   - `method` – {string} – HTTP request method. Valid methods are: `GET`, `POST`, `PUT`, `DELETE`,
- *     and `JSONP`
- *   - `params` – {object=} – Optional set of pre-bound parameters for this action.
- *   - isArray – {boolean=} – If true then the returned object for this action is an array, see
- *     `returns` section.
- *
- * @returns {Object} A resource "class" object with methods for the default set of resource actions
- *   optionally extended with custom `actions`. The default set contains these actions:
- *
- *       { 'get':    {method:'GET'},
- *         'save':   {method:'POST'},
- *         'query':  {method:'GET', isArray:true},
- *         'remove': {method:'DELETE'},
- *         'delete': {method:'DELETE'} };
- *
- *   Calling these methods invoke an {@link ng.$http} with the specified http method,
- *   destination and parameters. When the data is returned from the server then the object is an
- *   instance of the resource class. The actions `save`, `remove` and `delete` are available on it
- *   as  methods with the `$` prefix. This allows you to easily perform CRUD operations (create,
- *   read, update, delete) on server-side data like this:
- *   <pre>
-        var User = $resource('/user/:userId', {userId:'@id'});
-        var user = User.get({userId:123}, function() {
-          user.abc = true;
-          user.$save();
-        });
-     </pre>
- *
- *   It is important to realize that invoking a $resource object method immediately returns an
- *   empty reference (object or array depending on `isArray`). Once the data is returned from the
- *   server the existing reference is populated with the actual data. This is a useful trick since
- *   usually the resource is assigned to a model which is then rendered by the view. Having an empty
- *   object results in no rendering, once the data arrives from the server then the object is
- *   populated with the data and the view automatically re-renders itself showing the new data. This
- *   means that in most case one never has to write a callback function for the action methods.
- *
- *   The action methods on the class object or instance object can be invoked with the following
- *   parameters:
- *
- *   - HTTP GET "class" actions: `Resource.action([parameters], [success], [error])`
- *   - non-GET "class" actions: `Resource.action([parameters], postData, [success], [error])`
- *   - non-GET instance actions:  `instance.$action([parameters], [success], [error])`
- *
- *
- * @example
- *
- * # Credit card resource
- *
- * <pre>
-     // Define CreditCard class
-     var CreditCard = $resource('/user/:userId/card/:cardId',
-      {userId:123, cardId:'@id'}, {
-       charge: {method:'POST', params:{charge:true}}
-      });
-
-     // We can retrieve a collection from the server
-     var cards = CreditCard.query(function() {
-       // GET: /user/123/card
-       // server returns: [ {id:456, number:'1234', name:'Smith'} ];
-
-       var card = cards[0];
-       // each item is an instance of CreditCard
-       expect(card instanceof CreditCard).toEqual(true);
-       card.name = "J. Smith";
-       // non GET methods are mapped onto the instances
-       card.$save();
-       // POST: /user/123/card/456 {id:456, number:'1234', name:'J. Smith'}
-       // server returns: {id:456, number:'1234', name: 'J. Smith'};
-
-       // our custom method is mapped as well.
-       card.$charge({amount:9.99});
-       // POST: /user/123/card/456?amount=9.99&charge=true {id:456, number:'1234', name:'J. Smith'}
-     });
-
-     // we can create an instance as well
-     var newCard = new CreditCard({number:'0123'});
-     newCard.name = "Mike Smith";
-     newCard.$save();
-     // POST: /user/123/card {number:'0123', name:'Mike Smith'}
-     // server returns: {id:789, number:'01234', name: 'Mike Smith'};
-     expect(newCard.id).toEqual(789);
- * </pre>
- *
- * The object returned from this function execution is a resource "class" which has "static" method
- * for each action in the definition.
- *
- * Calling these methods invoke `$http` on the `url` template with the given `method` and `params`.
- * When the data is returned from the server then the object is an instance of the resource type and
- * all of the non-GET methods are available with `$` prefix. This allows you to easily support CRUD
- * operations (create, read, update, delete) on server-side data.
-
-   <pre>
-     var User = $resource('/user/:userId', {userId:'@id'});
-     var user = User.get({userId:123}, function() {
-       user.abc = true;
-       user.$save();
-     });
-   </pre>
- *
- * It's worth noting that the success callback for `get`, `query` and other method gets passed
- * in the response that came from the server as well as $http header getter function, so one
- * could rewrite the above example and get access to http headers as:
- *
-   <pre>
-     var User = $resource('/user/:userId', {userId:'@id'});
-     User.get({userId:123}, function(u, getResponseHeaders){
-       u.abc = true;
-       u.$save(function(u, putResponseHeaders) {
-         //u => saved user object
-         //putResponseHeaders => $http header getter
-       });
-     });
-   </pre>
-
- * # Buzz client
-
-   Let's look at what a buzz client created with the `$resource` service looks like:
-    <doc:example>
-      <doc:source jsfiddle="false">
-       <script>
-         function BuzzController($resource) {
-           this.userId = 'googlebuzz';
-           this.Activity = $resource(
-             'https://www.googleapis.com/buzz/v1/activities/:userId/:visibility/:activityId/:comments',
-             {alt:'json', callback:'JSON_CALLBACK'},
-             {get:{method:'JSONP', params:{visibility:'@self'}}, replies: {method:'JSONP', params:{visibility:'@self', comments:'@comments'}}}
-           );
-         }
-
-         BuzzController.prototype = {
-           fetch: function() {
-             this.activities = this.Activity.get({userId:this.userId});
-           },
-           expandReplies: function(activity) {
-             activity.replies = this.Activity.replies({userId:this.userId, activityId:activity.id});
-           }
-         };
-         BuzzController.$inject = ['$resource'];
-       </script>
-
-       <div ng-controller="BuzzController">
-         <input ng-model="userId"/>
-         <button ng-click="fetch()">fetch</button>
-         <hr/>
-         <div ng-repeat="item in activities.data.items">
-           <h1 style="font-size: 15px;">
-             <img src="{{item.actor.thumbnailUrl}}" style="max-height:30px;max-width:30px;"/>
-             <a href="{{item.actor.profileUrl}}">{{item.actor.name}}</a>
-             <a href ng-click="expandReplies(item)" style="float: right;">Expand replies: {{item.links.replies[0].count}}</a>
-           </h1>
-           {{item.object.content | html}}
-           <div ng-repeat="reply in item.replies.data.items" style="margin-left: 20px;">
-             <img src="{{reply.actor.thumbnailUrl}}" style="max-height:30px;max-width:30px;"/>
-             <a href="{{reply.actor.profileUrl}}">{{reply.actor.name}}</a>: {{reply.content | html}}
-           </div>
-         </div>
-       </div>
-      </doc:source>
-      <doc:scenario>
-      </doc:scenario>
-    </doc:example>
- */
-angular.module('ngResource', ['ng']).
-  factory('$resource', ['$http', '$parse', function($http, $parse) {
-    var DEFAULT_ACTIONS = {
-      'get':    {method:'GET'},
-      'save':   {method:'POST'},
-      'query':  {method:'GET', isArray:true},
-      'remove': {method:'DELETE'},
-      'delete': {method:'DELETE'}
-    };
-    var noop = angular.noop,
-        forEach = angular.forEach,
-        extend = angular.extend,
-        copy = angular.copy,
-        isFunction = angular.isFunction,
-        getter = function(obj, path) {
-          return $parse(path)(obj);
-        };
-
-    /**
-     * We need our custom method because encodeURIComponent is too aggressive and doesn't follow
-     * http://www.ietf.org/rfc/rfc3986.txt with regards to the character set (pchar) allowed in path
-     * segments:
-     *    segment       = *pchar
-     *    pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
-     *    pct-encoded   = "%" HEXDIG HEXDIG
-     *    unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
-     *    sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
-     *                     / "*" / "+" / "," / ";" / "="
-     */
-    function encodeUriSegment(val) {
-      return encodeUriQuery(val, true).
-        replace(/%26/gi, '&').
-        replace(/%3D/gi, '=').
-        replace(/%2B/gi, '+');
-    }
-
-
-    /**
-     * This method is intended for encoding *key* or *value* parts of query component. We need a custom
-     * method becuase encodeURIComponent is too agressive and encodes stuff that doesn't have to be
-     * encoded per http://tools.ietf.org/html/rfc3986:
-     *    query       = *( pchar / "/" / "?" )
-     *    pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
-     *    unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
-     *    pct-encoded   = "%" HEXDIG HEXDIG
-     *    sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
-     *                     / "*" / "+" / "," / ";" / "="
-     */
-    function encodeUriQuery(val, pctEncodeSpaces) {
-      return encodeURIComponent(val).
-        replace(/%40/gi, '@').
-        replace(/%3A/gi, ':').
-        replace(/%24/g, '$').
-        replace(/%2C/gi, ',').
-        replace(/%20/g, (pctEncodeSpaces ? '%20' : '+'));
-    }
-
-    function Route(template, defaults) {
-      this.template = template = template + '#';
-      this.defaults = defaults || {};
-      var urlParams = this.urlParams = {};
-      forEach(template.split(/\W/), function(param){
-        if (param && (new RegExp("(^|[^\\\\]):" + param + "\\W").test(template))) {
-          urlParams[param] = true;
-        }
-      });
-      this.template = template.replace(/\\:/g, ':');
-    }
-
-    Route.prototype = {
-      url: function(params) {
-        var self = this,
-            url = this.template,
-            val,
-            encodedVal;
-
-        params = params || {};
-        forEach(this.urlParams, function(_, urlParam){
-          val = params.hasOwnProperty(urlParam) ? params[urlParam] : self.defaults[urlParam];
-          if (angular.isDefined(val) && val !== null) {
-            encodedVal = encodeUriSegment(val);
-            url = url.replace(new RegExp(":" + urlParam + "(\\W)", "g"), encodedVal + "$1");
-          } else {
-            url = url.replace(new RegExp("(\/?):" + urlParam + "(\\W)", "g"), function(match,
-                leadingSlashes, tail) {
-              if (tail.charAt(0) == '/') {
-                return tail;
-              } else {
-                return leadingSlashes + tail;
-              }
-            });
-          }
-        });
-        url = url.replace(/\/?#$/, '');
-        var query = [];
-        forEach(params, function(value, key){
-          if (!self.urlParams[key]) {
-            query.push(encodeUriQuery(key) + '=' + encodeUriQuery(value));
-          }
-        });
-        query.sort();
-        url = url.replace(/\/*$/, '');
-        return url + (query.length ? '?' + query.join('&') : '');
-      }
-    };
-
-
-    function ResourceFactory(url, paramDefaults, actions) {
-      var route = new Route(url);
-
-      actions = extend({}, DEFAULT_ACTIONS, actions);
-
-      function extractParams(data, actionParams){
-        var ids = {};
-        actionParams = extend({}, paramDefaults, actionParams);
-        forEach(actionParams, function(value, key){
-          ids[key] = value.charAt && value.charAt(0) == '@' ? getter(data, value.substr(1)) : value;
-        });
-        return ids;
-      }
-
-      function Resource(value){
-        copy(value || {}, this);
-      }
-
-      forEach(actions, function(action, name) {
-        action.method = angular.uppercase(action.method);
-        var hasBody = action.method == 'POST' || action.method == 'PUT' || action.method == 'PATCH';
-        Resource[name] = function(a1, a2, a3, a4) {
-          var params = {};
-          var data;
-          var success = noop;
-          var error = null;
-          switch(arguments.length) {
-          case 4:
-            error = a4;
-            success = a3;
-            //fallthrough
-          case 3:
-          case 2:
-            if (isFunction(a2)) {
-              if (isFunction(a1)) {
-                success = a1;
-                error = a2;
-                break;
-              }
-
-              success = a2;
-              error = a3;
-              //fallthrough
-            } else {
-              params = a1;
-              data = a2;
-              success = a3;
-              break;
-            }
-          case 1:
-            if (isFunction(a1)) success = a1;
-            else if (hasBody) data = a1;
-            else params = a1;
-            break;
-          case 0: break;
-          default:
-            throw "Expected between 0-4 arguments [params, data, success, error], got " +
-              arguments.length + " arguments.";
-          }
-
-          var value = this instanceof Resource ? this : (action.isArray ? [] : new Resource(data));
-          $http({
-            method: action.method,
-            url: route.url(extend({}, extractParams(data, action.params || {}), params)),
-            data: data
-          }).then(function(response) {
-              var data = response.data;
-
-              if (data) {
-                if (action.isArray) {
-                  value.length = 0;
-                  forEach(data, function(item) {
-                    value.push(new Resource(item));
-                  });
-                } else {
-                  copy(data, value);
-                }
-              }
-              (success||noop)(value, response.headers);
-            }, error);
-
-          return value;
-        };
-
-
-        Resource.prototype['$' + name] = function(a1, a2, a3) {
-          var params = extractParams(this),
-              success = noop,
-              error;
-
-          switch(arguments.length) {
-          case 3: params = a1; success = a2; error = a3; break;
-          case 2:
-          case 1:
-            if (isFunction(a1)) {
-              success = a1;
-              error = a2;
-            } else {
-              params = a1;
-              success = a2 || noop;
-            }
-          case 0: break;
-          default:
-            throw "Expected between 1-3 arguments [params, success, error], got " +
-              arguments.length + " arguments.";
-          }
-          var data = hasBody ? this : undefined;
-          Resource[name].call(this, params, data, success, error);
-        };
-      });
-
-      Resource.bind = function(additionalParamDefaults){
-        return ResourceFactory(url, extend({}, paramDefaults, additionalParamDefaults), actions);
-      };
-
-      return Resource;
-    }
-
-    return ResourceFactory;
-  }]);
-
-
-})(window, window.angular);
@@ -1,537 +0,0 @@
-/**
- * @license AngularJS v1.0.7
- * (c) 2010-2012 Google, Inc. http://angularjs.org
- * License: MIT
- */
-(function(window, angular, undefined) {
-'use strict';
-
-/**
- * @ngdoc overview
- * @name ngSanitize
- * @description
- */
-
-/*
- * HTML Parser By Misko Hevery (misko@hevery.com)
- * based on:  HTML Parser By John Resig (ejohn.org)
- * Original code by Erik Arvidsson, Mozilla Public License
- * http://erik.eae.net/simplehtmlparser/simplehtmlparser.js
- *
- * // Use like so:
- * htmlParser(htmlString, {
- *     start: function(tag, attrs, unary) {},
- *     end: function(tag) {},
- *     chars: function(text) {},
- *     comment: function(text) {}
- * });
- *
- */
-
-
-/**
- * @ngdoc service
- * @name ngSanitize.$sanitize
- * @function
- *
- * @description
- *   The input is sanitized by parsing the html into tokens. All safe tokens (from a whitelist) are
- *   then serialized back to properly escaped html string. This means that no unsafe input can make
- *   it into the returned string, however, since our parser is more strict than a typical browser
- *   parser, it's possible that some obscure input, which would be recognized as valid HTML by a
- *   browser, won't make it through the sanitizer.
- *
- * @param {string} html Html input.
- * @returns {string} Sanitized html.
- *
- * @example
-   <doc:example module="ngSanitize">
-     <doc:source>
-       <script>
-         function Ctrl($scope) {
-           $scope.snippet =
-             '<p style="color:blue">an html\n' +
-             '<em onmouseover="this.textContent=\'PWN3D!\'">click here</em>\n' +
-             'snippet</p>';
-         }
-       </script>
-       <div ng-controller="Ctrl">
-          Snippet: <textarea ng-model="snippet" cols="60" rows="3"></textarea>
-           <table>
-             <tr>
-               <td>Filter</td>
-               <td>Source</td>
-               <td>Rendered</td>
-             </tr>
-             <tr id="html-filter">
-               <td>html filter</td>
-               <td>
-                 <pre>&lt;div ng-bind-html="snippet"&gt;<br/>&lt;/div&gt;</pre>
-               </td>
-               <td>
-                 <div ng-bind-html="snippet"></div>
-               </td>
-             </tr>
-             <tr id="escaped-html">
-               <td>no filter</td>
-               <td><pre>&lt;div ng-bind="snippet"&gt;<br/>&lt;/div&gt;</pre></td>
-               <td><div ng-bind="snippet"></div></td>
-             </tr>
-             <tr id="html-unsafe-filter">
-               <td>unsafe html filter</td>
-               <td><pre>&lt;div ng-bind-html-unsafe="snippet"&gt;<br/>&lt;/div&gt;</pre></td>
-               <td><div ng-bind-html-unsafe="snippet"></div></td>
-             </tr>
-           </table>
-         </div>
-     </doc:source>
-     <doc:scenario>
-       it('should sanitize the html snippet ', function() {
-         expect(using('#html-filter').element('div').html()).
-           toBe('<p>an html\n<em>click here</em>\nsnippet</p>');
-       });
-
-       it('should escape snippet without any filter', function() {
-         expect(using('#escaped-html').element('div').html()).
-           toBe("&lt;p style=\"color:blue\"&gt;an html\n" +
-                "&lt;em onmouseover=\"this.textContent='PWN3D!'\"&gt;click here&lt;/em&gt;\n" +
-                "snippet&lt;/p&gt;");
-       });
-
-       it('should inline raw snippet if filtered as unsafe', function() {
-         expect(using('#html-unsafe-filter').element("div").html()).
-           toBe("<p style=\"color:blue\">an html\n" +
-                "<em onmouseover=\"this.textContent='PWN3D!'\">click here</em>\n" +
-                "snippet</p>");
-       });
-
-       it('should update', function() {
-         input('snippet').enter('new <b>text</b>');
-         expect(using('#html-filter').binding('snippet')).toBe('new <b>text</b>');
-         expect(using('#escaped-html').element('div').html()).toBe("new &lt;b&gt;text&lt;/b&gt;");
-         expect(using('#html-unsafe-filter').binding("snippet")).toBe('new <b>text</b>');
-       });
-     </doc:scenario>
-   </doc:example>
- */
-var $sanitize = function(html) {
-  var buf = [];
-    htmlParser(html, htmlSanitizeWriter(buf));
-    return buf.join('');
-};
-
-
-// Regular Expressions for parsing tags and attributes
-var START_TAG_REGEXP = /^<\s*([\w:-]+)((?:\s+[\w:-]+(?:\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|[^>\s]+))?)*)\s*(\/?)\s*>/,
-  END_TAG_REGEXP = /^<\s*\/\s*([\w:-]+)[^>]*>/,
-  ATTR_REGEXP = /([\w:-]+)(?:\s*=\s*(?:(?:"((?:[^"])*)")|(?:'((?:[^'])*)')|([^>\s]+)))?/g,
-  BEGIN_TAG_REGEXP = /^</,
-  BEGING_END_TAGE_REGEXP = /^<\s*\//,
-  COMMENT_REGEXP = /<!--(.*?)-->/g,
-  CDATA_REGEXP = /<!\[CDATA\[(.*?)]]>/g,
-  URI_REGEXP = /^((ftp|https?):\/\/|mailto:|#)/,
-  NON_ALPHANUMERIC_REGEXP = /([^\#-~| |!])/g; // Match everything outside of normal chars and " (quote character)
-
-
-// Good source of info about elements and attributes
-// http://dev.w3.org/html5/spec/Overview.html#semantics
-// http://simon.html5.org/html-elements
-
-// Safe Void Elements - HTML5
-// http://dev.w3.org/html5/spec/Overview.html#void-elements
-var voidElements = makeMap("area,br,col,hr,img,wbr");
-
-// Elements that you can, intentionally, leave open (and which close themselves)
-// http://dev.w3.org/html5/spec/Overview.html#optional-tags
-var optionalEndTagBlockElements = makeMap("colgroup,dd,dt,li,p,tbody,td,tfoot,th,thead,tr"),
-    optionalEndTagInlineElements = makeMap("rp,rt"),
-    optionalEndTagElements = angular.extend({}, optionalEndTagInlineElements, optionalEndTagBlockElements);
-
-// Safe Block Elements - HTML5
-var blockElements = angular.extend({}, optionalEndTagBlockElements, makeMap("address,article,aside," +
-        "blockquote,caption,center,del,dir,div,dl,figure,figcaption,footer,h1,h2,h3,h4,h5,h6," +
-        "header,hgroup,hr,ins,map,menu,nav,ol,pre,script,section,table,ul"));
-
-// Inline Elements - HTML5
-var inlineElements = angular.extend({}, optionalEndTagInlineElements, makeMap("a,abbr,acronym,b,bdi,bdo," +
-        "big,br,cite,code,del,dfn,em,font,i,img,ins,kbd,label,map,mark,q,ruby,rp,rt,s,samp,small," +
-        "span,strike,strong,sub,sup,time,tt,u,var"));
-
-
-// Special Elements (can contain anything)
-var specialElements = makeMap("script,style");
-
-var validElements = angular.extend({}, voidElements, blockElements, inlineElements, optionalEndTagElements);
-
-//Attributes that have href and hence need to be sanitized
-var uriAttrs = makeMap("background,cite,href,longdesc,src,usemap");
-var validAttrs = angular.extend({}, uriAttrs, makeMap(
-    'abbr,align,alt,axis,bgcolor,border,cellpadding,cellspacing,class,clear,'+
-    'color,cols,colspan,compact,coords,dir,face,headers,height,hreflang,hspace,'+
-    'ismap,lang,language,nohref,nowrap,rel,rev,rows,rowspan,rules,'+
-    'scope,scrolling,shape,span,start,summary,target,title,type,'+
-    'valign,value,vspace,width'));
-
-function makeMap(str) {
-  var obj = {}, items = str.split(','), i;
-  for (i = 0; i < items.length; i++) obj[items[i]] = true;
-  return obj;
-}
-
-
-/**
- * @example
- * htmlParser(htmlString, {
- *     start: function(tag, attrs, unary) {},
- *     end: function(tag) {},
- *     chars: function(text) {},
- *     comment: function(text) {}
- * });
- *
- * @param {string} html string
- * @param {object} handler
- */
-function htmlParser( html, handler ) {
-  var index, chars, match, stack = [], last = html;
-  stack.last = function() { return stack[ stack.length - 1 ]; };
-
-  while ( html ) {
-    chars = true;
-
-    // Make sure we're not in a script or style element
-    if ( !stack.last() || !specialElements[ stack.last() ] ) {
-
-      // Comment
-      if ( html.indexOf("<!--") === 0 ) {
-        index = html.indexOf("-->");
-
-        if ( index >= 0 ) {
-          if (handler.comment) handler.comment( html.substring( 4, index ) );
-          html = html.substring( index + 3 );
-          chars = false;
-        }
-
-      // end tag
-      } else if ( BEGING_END_TAGE_REGEXP.test(html) ) {
-        match = html.match( END_TAG_REGEXP );
-
-        if ( match ) {
-          html = html.substring( match[0].length );
-          match[0].replace( END_TAG_REGEXP, parseEndTag );
-          chars = false;
-        }
-
-      // start tag
-      } else if ( BEGIN_TAG_REGEXP.test(html) ) {
-        match = html.match( START_TAG_REGEXP );
-
-        if ( match ) {
-          html = html.substring( match[0].length );
-          match[0].replace( START_TAG_REGEXP, parseStartTag );
-          chars = false;
-        }
-      }
-
-      if ( chars ) {
-        index = html.indexOf("<");
-
-        var text = index < 0 ? html : html.substring( 0, index );
-        html = index < 0 ? "" : html.substring( index );
-
-        if (handler.chars) handler.chars( decodeEntities(text) );
-      }
-
-    } else {
-      html = html.replace(new RegExp("(.*)<\\s*\\/\\s*" + stack.last() + "[^>]*>", 'i'), function(all, text){
-        text = text.
-          replace(COMMENT_REGEXP, "$1").
-          replace(CDATA_REGEXP, "$1");
-
-        if (handler.chars) handler.chars( decodeEntities(text) );
-
-        return "";
-      });
-
-      parseEndTag( "", stack.last() );
-    }
-
-    if ( html == last ) {
-      throw "Parse Error: " + html;
-    }
-    last = html;
-  }
-
-  // Clean up any remaining tags
-  parseEndTag();
-
-  function parseStartTag( tag, tagName, rest, unary ) {
-    tagName = angular.lowercase(tagName);
-    if ( blockElements[ tagName ] ) {
-      while ( stack.last() && inlineElements[ stack.last() ] ) {
-        parseEndTag( "", stack.last() );
-      }
-    }
-
-    if ( optionalEndTagElements[ tagName ] && stack.last() == tagName ) {
-      parseEndTag( "", tagName );
-    }
-
-    unary = voidElements[ tagName ] || !!unary;
-
-    if ( !unary )
-      stack.push( tagName );
-
-    var attrs = {};
-
-    rest.replace(ATTR_REGEXP, function(match, name, doubleQuotedValue, singleQoutedValue, unqoutedValue) {
-      var value = doubleQuotedValue
-        || singleQoutedValue
-        || unqoutedValue
-        || '';
-
-      attrs[name] = decodeEntities(value);
-    });
-    if (handler.start) handler.start( tagName, attrs, unary );
-  }
-
-  function parseEndTag( tag, tagName ) {
-    var pos = 0, i;
-    tagName = angular.lowercase(tagName);
-    if ( tagName )
-      // Find the closest opened tag of the same type
-      for ( pos = stack.length - 1; pos >= 0; pos-- )
-        if ( stack[ pos ] == tagName )
-          break;
-
-    if ( pos >= 0 ) {
-      // Close all the open elements, up the stack
-      for ( i = stack.length - 1; i >= pos; i-- )
-        if (handler.end) handler.end( stack[ i ] );
-
-      // Remove the open elements from the stack
-      stack.length = pos;
-    }
-  }
-}
-
-/**
- * decodes all entities into regular string
- * @param value
- * @returns {string} A string with decoded entities.
- */
-var hiddenPre=document.createElement("pre");
-function decodeEntities(value) {
-  hiddenPre.innerHTML=value.replace(/</g,"&lt;");
-  return hiddenPre.innerText || hiddenPre.textContent || '';
-}
-
-/**
- * Escapes all potentially dangerous characters, so that the
- * resulting string can be safely inserted into attribute or
- * element text.
- * @param value
- * @returns escaped text
- */
-function encodeEntities(value) {
-  return value.
-    replace(/&/g, '&amp;').
-    replace(NON_ALPHANUMERIC_REGEXP, function(value){
-      return '&#' + value.charCodeAt(0) + ';';
-    }).
-    replace(/</g, '&lt;').
-    replace(/>/g, '&gt;');
-}
-
-/**
- * create an HTML/XML writer which writes to buffer
- * @param {Array} buf use buf.jain('') to get out sanitized html string
- * @returns {object} in the form of {
- *     start: function(tag, attrs, unary) {},
- *     end: function(tag) {},
- *     chars: function(text) {},
- *     comment: function(text) {}
- * }
- */
-function htmlSanitizeWriter(buf){
-  var ignore = false;
-  var out = angular.bind(buf, buf.push);
-  return {
-    start: function(tag, attrs, unary){
-      tag = angular.lowercase(tag);
-      if (!ignore && specialElements[tag]) {
-        ignore = tag;
-      }
-      if (!ignore && validElements[tag] == true) {
-        out('<');
-        out(tag);
-        angular.forEach(attrs, function(value, key){
-          var lkey=angular.lowercase(key);
-          if (validAttrs[lkey]==true && (uriAttrs[lkey]!==true || value.match(URI_REGEXP))) {
-            out(' ');
-            out(key);
-            out('="');
-            out(encodeEntities(value));
-            out('"');
-          }
-        });
-        out(unary ? '/>' : '>');
-      }
-    },
-    end: function(tag){
-        tag = angular.lowercase(tag);
-        if (!ignore && validElements[tag] == true) {
-          out('</');
-          out(tag);
-          out('>');
-        }
-        if (tag == ignore) {
-          ignore = false;
-        }
-      },
-    chars: function(chars){
-        if (!ignore) {
-          out(encodeEntities(chars));
-        }
-      }
-  };
-}
-
-
-// define ngSanitize module and register $sanitize service
-angular.module('ngSanitize', []).value('$sanitize', $sanitize);
-
-/**
- * @ngdoc directive
- * @name ngSanitize.directive:ngBindHtml
- *
- * @description
- * Creates a binding that will sanitize the result of evaluating the `expression` with the
- * {@link ngSanitize.$sanitize $sanitize} service and innerHTML the result into the current element.
- *
- * See {@link ngSanitize.$sanitize $sanitize} docs for examples.
- *
- * @element ANY
- * @param {expression} ngBindHtml {@link guide/expression Expression} to evaluate.
- */
-angular.module('ngSanitize').directive('ngBindHtml', ['$sanitize', function($sanitize) {
-  return function(scope, element, attr) {
-    element.addClass('ng-binding').data('$binding', attr.ngBindHtml);
-    scope.$watch(attr.ngBindHtml, function ngBindHtmlWatchAction(value) {
-      value = $sanitize(value);
-      element.html(value || '');
-    });
-  };
-}]);
-
-/**
- * @ngdoc filter
- * @name ngSanitize.filter:linky
- * @function
- *
- * @description
- *   Finds links in text input and turns them into html links. Supports http/https/ftp/mailto and
- *   plain email address links.
- *
- * @param {string} text Input text.
- * @returns {string} Html-linkified text.
- *
- * @usage
-   <span ng-bind-html="linky_expression | linky"></span>
- *
- * @example
-   <doc:example module="ngSanitize">
-     <doc:source>
-       <script>
-         function Ctrl($scope) {
-           $scope.snippet =
-             'Pretty text with some links:\n'+
-             'http://angularjs.org/,\n'+
-             'mailto:us@somewhere.org,\n'+
-             'another@somewhere.org,\n'+
-             'and one more: ftp://127.0.0.1/.';
-         }
-       </script>
-       <div ng-controller="Ctrl">
-       Snippet: <textarea ng-model="snippet" cols="60" rows="3"></textarea>
-       <table>
-         <tr>
-           <td>Filter</td>
-           <td>Source</td>
-           <td>Rendered</td>
-         </tr>
-         <tr id="linky-filter">
-           <td>linky filter</td>
-           <td>
-             <pre>&lt;div ng-bind-html="snippet | linky"&gt;<br>&lt;/div&gt;</pre>
-           </td>
-           <td>
-             <div ng-bind-html="snippet | linky"></div>
-           </td>
-         </tr>
-         <tr id="escaped-html">
-           <td>no filter</td>
-           <td><pre>&lt;div ng-bind="snippet"&gt;<br>&lt;/div&gt;</pre></td>
-           <td><div ng-bind="snippet"></div></td>
-         </tr>
-       </table>
-     </doc:source>
-     <doc:scenario>
-       it('should linkify the snippet with urls', function() {
-         expect(using('#linky-filter').binding('snippet | linky')).
-           toBe('Pretty text with some links:&#10;' +
-                '<a href="http://angularjs.org/">http://angularjs.org/</a>,&#10;' +
-                '<a href="mailto:us@somewhere.org">us@somewhere.org</a>,&#10;' +
-                '<a href="mailto:another@somewhere.org">another@somewhere.org</a>,&#10;' +
-                'and one more: <a href="ftp://127.0.0.1/">ftp://127.0.0.1/</a>.');
-       });
-
-       it ('should not linkify snippet without the linky filter', function() {
-         expect(using('#escaped-html').binding('snippet')).
-           toBe("Pretty text with some links:\n" +
-                "http://angularjs.org/,\n" +
-                "mailto:us@somewhere.org,\n" +
-                "another@somewhere.org,\n" +
-                "and one more: ftp://127.0.0.1/.");
-       });
-
-       it('should update', function() {
-         input('snippet').enter('new http://link.');
-         expect(using('#linky-filter').binding('snippet | linky')).
-           toBe('new <a href="http://link">http://link</a>.');
-         expect(using('#escaped-html').binding('snippet')).toBe('new http://link.');
-       });
-     </doc:scenario>
-   </doc:example>
- */
-angular.module('ngSanitize').filter('linky', function() {
-  var LINKY_URL_REGEXP = /((ftp|https?):\/\/|(mailto:)?[A-Za-z0-9._%+-]+@)\S*[^\s\.\;\,\(\)\{\}\<\>]/,
-      MAILTO_REGEXP = /^mailto:/;
-
-  return function(text) {
-    if (!text) return text;
-    var match;
-    var raw = text;
-    var html = [];
-    // TODO(vojta): use $sanitize instead
-    var writer = htmlSanitizeWriter(html);
-    var url;
-    var i;
-    while ((match = raw.match(LINKY_URL_REGEXP))) {
-      // We can not end in these as they are sometimes found at the end of the sentence
-      url = match[0];
-      // if we did not match ftp/http/mailto then assume mailto
-      if (match[2] == match[3]) url = 'mailto:' + url;
-      i = match.index;
-      writer.chars(raw.substr(0, i));
-      writer.start('a', {href:url});
-      writer.chars(match[0].replace(MAILTO_REGEXP, ''));
-      writer.end('a');
-      raw = raw.substring(i + match[0].length);
-    }
-    writer.chars(raw);
-    return html.join('');
-  };
-});
-
-
-})(window, window.angular);
@@ -1,195 +0,0 @@
-/**
- * Enhanced Select2 Dropmenus
- *
- * @AJAX Mode - When in this mode, your value will be an object (or array of objects) of the data used by Select2
- * This change is so that you do not have to do an additional query yourself on top of Select2's own query
- * @params [options] {object} The configuration options passed to $.fn.select2(). Refer to the documentation
- */
-angular.module('ui.select2', []).value('uiSelect2Config', {}).directive('uiSelect2', ['uiSelect2Config', '$timeout', function (uiSelect2Config, $timeout) {
-    var options = {};
-    if (uiSelect2Config) {
-        angular.extend(options, uiSelect2Config);
-    }
-    return {
-        require: 'ngModel',
-        compile: function (tElm, tAttrs) {
-            var watch,
-                repeatOption,
-                repeatAttr,
-                isSelect = tElm.is('select'),
-                isMultiple = (tAttrs.multiple !== undefined);
-
-            // Enable watching of the options dataset if in use
-            if (tElm.is('select')) {
-                repeatOption = tElm.find('option[ng-repeat], option[data-ng-repeat]');
-
-                if (repeatOption.length) {
-                    repeatAttr = repeatOption.attr('ng-repeat') || repeatOption.attr('data-ng-repeat');
-                    watch = jQuery.trim(repeatAttr.split('|')[0]).split(' ').pop();
-                }
-            }
-
-            return function (scope, elm, attrs, controller) {
-                // instance-specific options
-                var opts = angular.extend({}, options, scope.$eval(attrs.uiSelect2));
-
-                /*
-                 Convert from Select2 view-model to Angular view-model.
-                 */
-                var convertToAngularModel = function(select2_data) {
-                    var model;
-                    if (opts.simple_tags) {
-                        model = []
-                        angular.forEach(select2_data, function(value, index) {
-                            model.push(value.id)
-                        })
-                    } else {
-                        model = select2_data
-                    }
-                    return model
-                }
-
-                /*
-                 Convert from Angular view-model to Select2 view-model.
-                 */
-                var convertToSelect2Model = function(angular_data) {
-                    var model = []
-                    if (!angular_data) {
-                        return model;
-                    }
-
-                    if (opts.simple_tags) {
-                        model = [];
-                        angular.forEach(
-                            angular_data,
-                            function(value, index) {
-                                model.push({'id': value, 'text': value});
-                            })
-                    } else {
-                        model = angular_data;
-                    }
-                    return model
-                }
-
-                if (isSelect) {
-                    // Use <select multiple> instead
-                    delete opts.multiple;
-                    delete opts.initSelection;
-                } else if (isMultiple) {
-                    opts.multiple = true;
-                }
-
-                if (controller) {
-                    // Watch the model for programmatic changes
-                    scope.$watch(tAttrs.ngModel, function(current, old) {
-                        if (!current) {
-                            return
-                        }
-                        if (current == old) {
-                            return
-                        }
-                        controller.$render()
-                    }, true)
-                    controller.$render = function () {
-                        if (isSelect) {
-                            elm.select2('val', controller.$viewValue);
-                        } else {
-                            if (opts.multiple) {
-                                elm.select2(
-                                    'data', convertToSelect2Model(controller.$viewValue));
-                            } else {
-                                if (angular.isObject(controller.$viewValue)) {
-                                    elm.select2('data', controller.$viewValue);
-                                } else if (!controller.$viewValue) {
-                                    elm.select2('data', null);
-                                } else {
-                                    elm.select2('val', controller.$viewValue);
-                                }
-                            }
-                        }
-                    };
-
-                    // Watch the options dataset for changes
-                    if (watch) {
-                        scope.$watch(watch, function (newVal, oldVal, scope) {
-                            if (!newVal) return;
-                            // Delayed so that the options have time to be rendered
-                            $timeout(function () {
-                                elm.select2('val', controller.$viewValue);
-                                // Refresh angular to remove the superfluous option
-                                elm.trigger('change');
-                            });
-                        });
-                    }
-
-                    // Update valid and dirty statuses
-                    controller.$parsers.push(function (value) {
-                        var div = elm.prev()
-                        div
-                            .toggleClass('ng-invalid', !controller.$valid)
-                            .toggleClass('ng-valid', controller.$valid)
-                            .toggleClass('ng-invalid-required', !controller.$valid)
-                            .toggleClass('ng-valid-required', controller.$valid)
-                            .toggleClass('ng-dirty', controller.$dirty)
-                            .toggleClass('ng-pristine', controller.$pristine);
-                        return value;
-                    });
-
-                    if (!isSelect) {
-                        // Set the view and model value and update the angular template manually for the ajax/multiple select2.
-                        elm.bind("change", function () {
-                            if (scope.$$phase) return;
-                            scope.$apply(function () {
-                                controller.$setViewValue(
-                                    convertToAngularModel(elm.select2('data')));
-                            });
-                        });
-
-                        if (opts.initSelection) {
-                            var initSelection = opts.initSelection;
-                            opts.initSelection = function (element, callback) {
-                                initSelection(element, function (value) {
-                                    controller.$setViewValue(convertToAngularModel(value));
-                                    callback(value);
-                                });
-                            };
-                        }
-                    }
-                }
-
-                elm.bind("$destroy", function() {
-                    elm.select2("destroy");
-                });
-
-                attrs.$observe('disabled', function (value) {
-                    elm.select2('enable', !value);
-                });
-
-                attrs.$observe('readonly', function (value) {
-                    elm.select2('readonly', !!value);
-                });
-
-                if (attrs.ngMultiple) {
-                    scope.$watch(attrs.ngMultiple, function(newVal) {
-                        elm.select2(opts);
-                    });
-                }
-
-                // Initialize the plugin late so that the injected DOM does not disrupt the template compiler
-                $timeout(function () {
-                    elm.select2(opts);
-
-                    // Set initial value - I'm not sure about this but it seems to need to be there
-                    elm.val(controller.$viewValue);
-                    // important!
-                    controller.$render();
-
-                    // Not sure if I should just check for !isSelect OR if I should check for 'tags' key
-                    if (!opts.initSelection && !isSelect)
-                        controller.$setViewValue(
-                            convertToAngularModel(elm.select2('data')));
-                });
-            };
-        }
-    };
-}]);
@@ -1,48 +0,0 @@
-<nav id="kc-navigation" class="navbar" role="navigation">
-    <div class="navbar-header">
-        <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse-1">
-            <span class="sr-only">Toggle navigation</span>
-            <span class="icon-bar"></span>
-            <span class="icon-bar"></span>
-            <span class="icon-bar"></span>
-        </button>
-        <h1 class="navbar-title"></h1>
-    </div>
-    <div class="collapse navbar-collapse navbar-collapse-1">
-        <ul class="nav navbar-nav navbar-utility" data-ng-show="auth.loggedIn">
-            <li class="dropdown">
-                <a data-toggle="dropdown" class="dropdown-toggle" href="#">
-                    <span class="pficon pficon-user"></span>
-                    {{auth.user.displayName}}<b class="caret"></b>
-                </a>
-                <ul class="dropdown-menu">
-                    <li><a href="/auth/rest/realms/keycloak-admin/account?referrer=admin-console">Manage Account</a></li>
-                    <li class="separator"><a href="/auth/rest/admin/logout">Sign Out</a></li>
-                </ul>
-            </li>
-        </ul>
-        <ul class="nav navbar-nav navbar-primary persistent-secondary" data-ng-controller="RealmDropdownCtrl">
-            <li class="dropdown context" data-ng-show="showNav()">
-                <a href="#" class="dropdown-toggle" data-toggle="dropdown">
-                    {{current.realm.realm}}
-                    <b class="caret"></b>
-                </a>
-                <ul class="dropdown-menu">
-                    <li data-ng-repeat="realm in current.realms">
-                        <a href="" ng-click="changeRealm(realm.realm)">{{realm.realm}}</a>
-                    </li>
-                </ul>
-            </li>
-            <li class="active pull-right" data-ng-show="auth.loggedIn">
-                <a class="button primary" href="#/create/realm" data-ng-class="path[0] == 'create' && path[1] == 'realm' && 'active'"
-                   data-ng-show="auth.loggedIn">Add Realm</a>
-            </li>
-        </ul>
-    </div>
-</nav>
-<!-- TODO remove once this page is properly styled -->
-<style type="text/css">
-    .icon-spinner6 {
-        cursor: pointer;
-    }
-</style>
@@ -1,104 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create">
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">Settings</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/installation">Installation</a></li>
-    </ul>
-    <div id="content">
-        <ol class="breadcrumb" data-ng-show="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-            <li class="active">Add OAuth Client</li>
-        </ol>
-        <h2 data-ng-show="create"><span>{{realm.realm}}</span> Add OAuth Client</h2>
-        <p class="subtitle" data-ng-show="create"><span class="required">*</span> Required fields</p>
-        <ol class="breadcrumb" data-ng-hide="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">{{oauth.name}}</a></li>
-            <li class="active">Settings</li>
-        </ol>
-        <h2 data-ng-hide="create"><span>{{oauth.name}}</span> Settings</h2>
-        <form class="form-horizontal" name="oauthForm" novalidate>
-            <fieldset class="border-top">
-
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="create">*</span></label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="name" name="name" data-ng-model="oauth.name" autofocus
-                               required>
-                    </div>
-                </div>
-
-                <div class="form-group clearfix block">
-                    <label class="col-sm-2 control-label" for="enabled">Enabled</label>
-                    <div class="col-sm-4">
-                        <input ng-model="oauth.enabled" name="enabled" id="enabled" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="newWebOrigin">Web Origin</label>
-                    <div class="col-sm-4">
-                        <div ng-repeat="webOrigin in oauth.webOrigins" class="kc-item-deletable row">
-                            <div class="col-sm-9">
-                                <input  class="form-control" type="text" data-ng-class="{'input-below':!$first}"
-                                        name="webOrigin" id="webOrigin" data-ng-model="webOrigin" readonly />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-danger" type="button" data-ng-click="deleteWebOrigin($index)">
-                                    Delete</button>
-                            </div>
-                        </div>
-                        <div class="row">
-                            <div class="col-sm-9">
-                                <input  class="form-control" type="text" name="newWebOrigin" id="newWebOrigin"
-                                        placeholder="New Web Origin..." data-ng-model="newWebOrigin"
-                                        data-ng-class="{'input-below':oauth.webOrigins.length}" />
-                            </div>
-                            <div class="col-sm-2">
-                                <button  class="btn btn-primary" data-ng-click="addWebOrigin()" ng-show="newWebOrigin.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="newRedirectUri">Redirect URI</label>
-                    <div class="col-sm-4">
-                        <div ng-repeat="redirectUri in oauth.redirectUris" class="kc-item-deletable row">
-                            <div class="col-sm-9">
-                                <input  class="form-control" type="text" data-ng-class="{'input-below':!$first}"
-                                        name="redirectUri" id="redirectUri" data-ng-model="redirectUri" readonly />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-danger" type="button" data-ng-click="deleteRedirectUri($index)">
-                                    Delete</button>
-                            </div>
-                        </div>
-                        <div class="row">
-                            <div class="col-sm-9">
-                                <input  class="form-control" type="text" name="newRedirectUri" id="newRedirectUri"
-                                        placeholder="New Redirect URI..." data-ng-model="newRedirectUri"
-                                        data-ng-class="{'input-below':oauth.redirectUris.length}" />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-primary" data-ng-click="addRedirectUri()" ng-show="newRedirectUri.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </fieldset>
-
-            <div class="pull-right form-actions" data-ng-show="create">
-                <button kc-cancel data-ng-click="cancel()">Cancel</button>
-                <button kc-save data-ng-show="changed">Save</button>
-            </div>
-            <div class="pull-right form-actions" data-ng-show="!create">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-                <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,104 +0,0 @@
-<div class="bs-sidebar col-sm-3 " data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-sm-9" role="main">
-    <kc-navigation data-kc-current="general" data-kc-realm="realm.realm" data-kc-social="social"></kc-navigation>
-    <div id="content">
-        <ol class="breadcrumb" data-ng-hide="createRealm">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}">Settings</a></li>
-            <li class="active">General</li>
-        </ol>
-        <h2 class="pull-left" data-ng-show="createRealm">Add Realm</h2>
-        <h2 data-ng-hide="createRealm"><span>{{realm.realm}}</span> General Settings</h2>
-        <p class="subtitle" data-ng-show="createRealm"><span class="required">*</span> Required fields</p>
-        <form class="form-horizontal" name="realmForm" novalidate>
-            <fieldset>
-                <legend class="aj-collapse open"><span class="text">Required Settings</span></legend>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="createRealm">*</span></label>
-
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="name" name="name" data-ng-model="realm.realm" autofocus required>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="enabled">Enabled</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.enabled" name="enabled" id="enabled" onoffswitch />
-                    </div>
-                </div>
-            </fieldset>
-            <fieldset>
-                <legend><span class="text">Login Options</span></legend>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="social">Social login</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.social" name="social" id="social" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group" data-ng-show="realm.social">
-                    <label class="col-sm-2 control-label" for="updateProfileOnInitialSocialLogin">Update profile on first social login</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.updateProfileOnInitialSocialLogin" name="updateProfileOnInitialSocialLogin" id="updateProfileOnInitialSocialLogin" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label for="registrationAllowed" class="col-sm-2 control-label">User registration</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.registrationAllowed" name="registrationAllowed" id="registrationAllowed" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label for="resetPasswordAllowed" class="col-sm-2 control-label">Reset password</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.resetPasswordAllowed" name="resetPasswordAllowed" id="resetPasswordAllowed" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label for="verifyEmail" class="col-sm-2 control-label">Verify email</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.verifyEmail" name="verifyEmail" id="verifyEmail" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label for="requireSsl" class="col-sm-2 control-label">Require SSL</label>
-                    <div class="col-sm-4">
-                        <input ng-model="realm.requireSsl" name="requireSsl" id="requireSsl" onoffswitch />
-                    </div>
-                </div>
-            </fieldset>
-            <fieldset>
-                <legend><span class="text">Optional Settings</span></legend>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="loginTheme">Login Theme</label>
-                    <div class="col-sm-4">
-                        <select kc-select id="loginTheme"
-                                data-kc-placeholder="Select one..."
-                                data-kc-model="realm.loginTheme"
-                                data-kc-options="serverInfo.themes.login">
-                        </select>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="accountTheme">Account Theme</label>
-                    <div class="col-sm-4">
-                        <select kc-select id="accountTheme"
-                                data-kc-placeholder="Select one..."
-                                data-kc-model="realm.accountTheme"
-                                data-kc-options="serverInfo.themes.account">
-                        </select>
-                    </div>
-                </div>
-            </fieldset>
-
-            <div class="pull-right form-actions" data-ng-show="createRealm">
-                <button kc-cancel data-ng-click="cancel()">Cancel</button>
-                <button kc-save data-ng-show="changed">Save</button>
-            </div>
-            <div class="pull-right form-actions" data-ng-show="!createRealm">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-                <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,34 +0,0 @@
-<div id="wrapper" class="container">
-    <div class="row">
-        <div class="bs-sidebar col-md-3 clearfix">
-            <ul data-ng-hide="createRealm">
-                <li class="active"><a href="#/realms">Realms</a></li>
-            </ul>
-        </div>
-        <div id="content-area" class="col-md-9" role="main">
-            <div class="top-nav" data-ng-hide="createRealm">
-                <ul class="rcue-tabs">
-
-                </ul>
-            </div>
-            <div id="content">
-
-                <h1>
-                    <span class="gray">Realms</span>
-                </h1>
-
-                <table class="table table-striped table-bordered">
-                    <thead>
-                    <tr>
-                        <th>Realm</th>
-                    </tr>
-                    </thead>
-                    <tr data-ng-repeat="r in realms">
-                        <td><a href="#/realms/{{r.realm}}">{{r.realm}}</a></td>
-                    </tr>
-                </table>
-            </div>
-        </div>
-        <div id="container-right-bg"></div>
-    </div>
-</div>
@@ -1,10 +0,0 @@
-<ul data-ng-hide="createRealm">
-    <li data-ng-class="((!path[2] || path[1] == 'role' || path[2] == 'roles' || path[2] == 'token-settings' ||
-    path[2] == 'social-settings' || path[2] == 'required-credentials' || path[2] == 'default-roles' || path[2] == 'registration-settings' ||
-    path[2] == 'keys-settings' || path[2] == 'smtp-settings') && path[3] != 'applications') && 'active'"><a href="#/realms/{{realm.realm}}">Settings</a></li>
-    <li data-ng-class="(path[2] == 'users' || path[1] == 'user') && 'active'"><a href="#/realms/{{realm.realm}}/users">Users</a>
-    </li>
-    <li data-ng-class="(path[2] == 'applications' || path[1] == 'application' || path[3] == 'applications') && 'active'"><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
-    <li data-ng-class="(path[2] == 'oauth-clients' || path[1] == 'oauth-client') && 'active'"><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-</ul>
-
@@ -1,14 +0,0 @@
-<div class="modal-dialog" tabindex="-1" role="dialog">
-    <div class="modal-content">
-        <div class="modal-header">
-            <button type="button" class="close" data-dismiss="modal" aria-hidden="true">
-                <span class="pficon pficon-close"></span>
-            </button>
-            <h4 class="modal-title" id="myModalLabel">{{ title }}</h4>
-        </div>
-        <div class="modal-body"><p ng-bind-html-unsafe="message"></p></div>
-        <div class="modal-footer">
-            <button ng-repeat="btn in buttons" ng-click="close(btn.result)" class="" ng-class="btn.cssClass">{{ btn.label }}</button>
-        </div>
-    </div>
-</div>
@@ -1,10 +0,0 @@
-<ul class="nav nav-tabs nav-tabs-pf">
-    <li ng-class="{active: kcCurrent == 'general'}"><a href="#/realms/{{kcRealm}}">General</a></li>
-    <li ng-class="{active: kcCurrent == 'social'}" data-ng-show="kcSocial"><a href="#/realms/{{kcRealm}}/social-settings">Social</a></li>
-    <li ng-class="{active: kcCurrent == 'roles'}"><a href="#/realms/{{kcRealm}}/roles">Roles</a></li>
-    <li ng-class="{active: kcCurrent == 'defRoles'}"><a href="#/realms/{{kcRealm}}/default-roles">Default Roles</a></li>
-    <li ng-class="{active: kcCurrent == 'credentials'}"><a href="#/realms/{{kcRealm}}/required-credentials">Credentials</a></li>
-    <li ng-class="{active: kcCurrent == 'token'}"><a href="#/realms/{{kcRealm}}/token-settings">Token</a></li>
-    <li ng-class="{active: kcCurrent == 'keys'}"><a href="#/realms/{{kcRealm}}/keys-settings">Keys</a></li>
-    <li ng-class="{active: kcCurrent == 'email'}"><a href="#/realms/{{kcRealm}}/smtp-settings">Email</a></li>
-</ul>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-api</artifactId>
+    <name>Keycloak Audit API</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>
@@ -0,0 +1,149 @@
+package org.keycloak.audit;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Audit {
+
+    private static final Logger log = Logger.getLogger(Audit.class);
+
+    private List<AuditListener> listeners;
+    private Event event;
+
+    public Audit(List<AuditListener> listeners, RealmModel realm, String ipAddress) {
+        this.listeners = listeners;
+        this.event = new Event();
+
+        realm(realm);
+        ipAddress(ipAddress);
+    }
+
+    Audit() {
+    }
+
+    public Audit realm(RealmModel realm) {
+        event.setRealmId(realm.getId());
+        return this;
+    }
+
+    public Audit realm(String realmId) {
+        event.setRealmId(realmId);
+        return this;
+    }
+
+    public Audit client(ClientModel client) {
+        event.setClientId(client.getClientId());
+        return this;
+    }
+
+    public Audit client(String clientId) {
+        event.setClientId(clientId);
+        return this;
+    }
+
+    public Audit user(UserModel user) {
+        event.setUserId(user.getId());
+        return this;
+    }
+
+    public Audit user(String userId) {
+        event.setUserId(userId);
+        return this;
+    }
+
+    public Audit session(UserSessionModel session) {
+        event.setSessionId(session.getId());
+        return this;
+    }
+
+    public Audit session(String sessionId) {
+        event.setSessionId(sessionId);
+        return this;
+    }
+
+    public Audit ipAddress(String ipAddress) {
+        event.setIpAddress(ipAddress);
+        return this;
+    }
+
+    public Audit event(EventType e) {
+        event.setEvent(e);
+        return this;
+    }
+
+    public Audit detail(String key, String value) {
+        if (value == null || value.equals("")) {
+            return this;
+        }
+
+        if (event.getDetails() == null) {
+            event.setDetails(new HashMap<String, String>());
+        }
+        event.getDetails().put(key, value);
+        return this;
+    }
+
+    public Audit removeDetail(String key) {
+        if (event.getDetails() != null) {
+            event.getDetails().remove(key);
+        }
+        return this;
+    }
+
+    public Event getEvent() {
+        return event;
+    }
+
+    public void success() {
+        send();
+    }
+
+    public void error(String error) {
+        event.setEvent(EventType.valueOf(event.getEvent().name() + "_ERROR"));
+        event.setError(error);
+        send();
+    }
+
+    public Audit clone() {
+        Audit clone = new Audit();
+        clone.listeners = listeners;
+        clone.event = event.clone();
+        return clone;
+    }
+
+    public Audit reset() {
+        Event old = event;
+
+        event = new Event();
+        event.setRealmId(old.getRealmId());
+        event.setIpAddress(old.getIpAddress());
+        event.setClientId(old.getClientId());
+        event.setUserId(old.getUserId());
+
+        return this;
+    }
+
+    private void send() {
+        event.setTime(System.currentTimeMillis());
+
+        if (listeners != null) {
+            for (AuditListener l : listeners) {
+                try {
+                    l.onEvent(event);
+                } catch (Throwable t) {
+                    log.error("Failed to send event to " + l, t);
+                }
+            }
+        }
+    }
+
+}
@@ -0,0 +1,12 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditListener extends Provider {
+
+    public void onEvent(Event event);
+
+}
@@ -0,0 +1,10 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditListenerFactory extends ProviderFactory<AuditListener> {
+
+}
@@ -0,0 +1,27 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuditListenerSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "audit-listener";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuditListener.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuditListenerFactory.class;
+    }
+
+}
@@ -0,0 +1,16 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditProvider extends AuditListener {
+
+    public EventQuery createQuery();
+
+    public void clear();
+
+    public void clear(String realmId);
+
+    public void clear(String realmId, long olderThan);
+
+}
@@ -0,0 +1,10 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditProviderFactory extends ProviderFactory<AuditProvider> {
+
+}
@@ -0,0 +1,27 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuditProviderSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "audit";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuditProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuditProviderFactory.class;
+    }
+
+}
@@ -0,0 +1,22 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Details {
+
+    String EMAIL = "email";
+    String PREVIOUS_EMAIL = "previous_email";
+    String UPDATED_EMAIL = "updated_email";
+    String CODE_ID = "code_id";
+    String REDIRECT_URI = "redirect_uri";
+    String RESPONSE_TYPE = "response_type";
+    String AUTH_METHOD = "auth_method";
+    String REGISTER_METHOD = "register_method";
+    String USERNAME = "username";
+    String REMEMBER_ME = "remember_me";
+    String TOKEN_ID = "token_id";
+    String REFRESH_TOKEN_ID = "refresh_token_id";
+    String UPDATED_REFRESH_TOKEN_ID = "updated_refresh_token_id";
+
+}
@@ -0,0 +1,41 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Errors {
+
+    String REALM_DISABLED = "realm_disabled";
+
+    String CLIENT_NOT_FOUND = "client_not_found";
+    String CLIENT_DISABLED = "client_disabled";
+    String INVALID_CLIENT_CREDENTIALS = "invalid_client_credentials";
+
+    String USER_NOT_FOUND = "user_not_found";
+    String USER_DISABLED = "user_disabled";
+    String USER_TEMPORARILY_DISABLED = "user_temporarily_disabled";
+    String INVALID_USER_CREDENTIALS = "invalid_user_credentials";
+
+    String USERNAME_MISSING = "username_missing";
+    String USERNAME_IN_USE = "username_in_use";
+
+    String INVALID_REDIRECT_URI = "invalid_redirect_uri";
+    String INVALID_CODE = "invalid_code";
+    String INVALID_TOKEN = "invalid_token";
+    String INVALID_REGISTRATION = "invalid_registration";
+    String INVALID_FORM = "invalid_form";
+
+    String REGISTRATION_DISABLED = "registration_disabled";
+
+    String REJECTED_BY_USER = "rejected_by_user";
+
+    String NOT_ALLOWED = "not_allowed";
+
+    String SOCIAL_PROVIDER_NOT_FOUND = "social_provider_not_found";
+    String SOCIAL_ID_IN_USE = "social_id_in_use";
+
+    String USER_NOT_LOGGED_IN = "user_not_logged_in";
+    String USER_SESSION_NOT_FOUND = "user_session_not_found";
+
+
+}
@@ -0,0 +1,115 @@
+package org.keycloak.audit;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Event {
+
+    private long time;
+
+    private EventType event;
+
+    private String realmId;
+
+    private String clientId;
+
+    private String userId;
+
+    private String sessionId;
+
+    private String ipAddress;
+
+    private String error;
+
+    private Map<String, String> details;
+
+    public long getTime() {
+        return time;
+    }
+
+    public void setTime(long time) {
+        this.time = time;
+    }
+
+    public EventType getEvent() {
+        return event;
+    }
+
+    public void setEvent(EventType event) {
+        this.event = event;
+    }
+
+    public String getRealmId() {
+        return realmId;
+    }
+
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
+
+    public String getSessionId() {
+        return sessionId;
+    }
+
+    public void setSessionId(String sessionId) {
+        this.sessionId = sessionId;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public void setIpAddress(String ipAddress) {
+        this.ipAddress = ipAddress;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public Map<String, String> getDetails() {
+        return details;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
+
+    public Event clone() {
+        Event clone = new Event();
+        clone.time = time;
+        clone.event = event;
+        clone.realmId = realmId;
+        clone.clientId = clientId;
+        clone.userId = userId;
+        clone.sessionId = sessionId;
+        clone.ipAddress = ipAddress;
+        clone.error = error;
+        clone.details = details != null ? new HashMap<String, String>(details) : null;
+        return clone;
+    }
+
+}
@@ -0,0 +1,26 @@
+package org.keycloak.audit;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface EventQuery {
+
+    public EventQuery event(EventType... events);
+
+    public EventQuery realm(String realmId);
+
+    public EventQuery client(String clientId);
+
+    public EventQuery user(String userId);
+
+    public EventQuery ipAddress(String ipAddress);
+
+    public EventQuery firstResult(int result);
+
+    public EventQuery maxResults(int results);
+
+    public List<Event> getResultList();
+
+}
@@ -0,0 +1,42 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public enum EventType {
+
+    LOGIN,
+    LOGIN_ERROR,
+    REGISTER,
+    REGISTER_ERROR,
+    LOGOUT,
+    LOGOUT_ERROR,
+    CODE_TO_TOKEN,
+    CODE_TO_TOKEN_ERROR,
+    REFRESH_TOKEN,
+    REFRESH_TOKEN_ERROR,
+    SOCIAL_LINK,
+    SOCIAL_LINK_ERROR,
+    REMOVE_SOCIAL_LINK,
+    REMOVE_SOCIAL_LINK_ERROR,
+
+    UPDATE_EMAIL,
+    UPDATE_EMAIL_ERROR,
+    UPDATE_PROFILE,
+    UPDATE_PROFILE_ERROR,
+    UPDATE_PASSWORD,
+    UPDATE_PASSWORD_ERROR,
+    UPDATE_TOTP,
+    UPDATE_TOTP_ERROR,
+    VERIFY_EMAIL,
+    VERIFY_EMAIL_ERROR,
+
+    REMOVE_TOTP,
+    REMOVE_TOTP_ERROR,
+
+    SEND_VERIFY_EMAIL,
+    SEND_VERIFY_EMAIL_ERROR,
+    SEND_RESET_PASSWORD,
+    SEND_RESET_PASSWORD_ERROR
+
+}
@@ -0,0 +1,2 @@
+org.keycloak.audit.AuditProviderSpi
+org.keycloak.audit.AuditListenerSpi
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-email</artifactId>
+    <name>Keycloak Audit Email Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-email-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>
@@ -0,0 +1,57 @@
+package org.keycloak.audit.email;
+
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventType;
+import org.keycloak.email.EmailException;
+import org.keycloak.email.EmailProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+
+import java.util.Date;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class EmailAuditListener implements AuditListener {
+
+    private static final Logger log = Logger.getLogger(EmailAuditListener.class);
+
+    private KeycloakSession keycloakSession;
+    private EmailProvider emailProvider;
+    private Set<EventType> includedEvents;
+
+    public EmailAuditListener(KeycloakSession keycloakSession, EmailProvider emailProvider, Set<EventType> includedEvents) {
+        this.keycloakSession = keycloakSession;
+        this.emailProvider = emailProvider;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            if (event.getRealmId() != null && event.getUserId() != null) {
+                RealmModel realm = keycloakSession.getRealm(event.getRealmId());
+                UserModel user = realm.getUserById(event.getUserId());
+                if (user != null && user.getEmail() != null && user.isEmailVerified()) {
+                    try {
+                        emailProvider.setRealm(realm).setUser(user).sendEvent(event);
+                    } catch (EmailException e) {
+                        log.error("Failed to send event mail", e);
+                    }
+                }
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+}
@@ -0,0 +1,62 @@
+package org.keycloak.audit.email;
+
+import org.keycloak.Config;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.AuditListenerFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.email.EmailProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderSession;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class EmailAuditListenerFactory implements AuditListenerFactory {
+
+    private static final Set<EventType> SUPPORTED_EVENTS = new HashSet<EventType>();
+    static {
+        Collections.addAll(SUPPORTED_EVENTS, EventType.LOGIN_ERROR, EventType.UPDATE_PASSWORD, EventType.REMOVE_TOTP, EventType.UPDATE_TOTP);
+    }
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditListener create(ProviderSession providerSession) {
+        KeycloakSession keycloakSession = providerSession.getProvider(KeycloakSession.class);
+        EmailProvider emailProvider = providerSession.getProvider(EmailProvider.class);
+        return new EmailAuditListener(keycloakSession, emailProvider, includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            includedEvents.addAll(SUPPORTED_EVENTS);
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "email";
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.audit.email.EmailAuditListenerFactory
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-jboss-logging</artifactId>
+    <name>Keycloak Audit JBoss Logging Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>
@@ -0,0 +1,66 @@
+package org.keycloak.audit.log;
+
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.Event;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JBossLoggingAuditListener implements AuditListener {
+
+    private final Logger logger;
+
+    public JBossLoggingAuditListener(Logger logger) {
+        this.logger = logger;
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        Logger.Level level = event.getError() != null ? Logger.Level.WARN : Logger.Level.INFO;
+
+        if (logger.isEnabled(level)) {
+            StringBuilder sb = new StringBuilder();
+
+            sb.append("event=");
+            sb.append(event.getEvent());
+            sb.append(", realmId=");
+            sb.append(event.getRealmId());
+            sb.append(", clientId=");
+            sb.append(event.getClientId());
+            sb.append(", userId=");
+            sb.append(event.getUserId());
+            sb.append(", ipAddress=");
+            sb.append(event.getIpAddress());
+
+            if (event.getError() != null) {
+                sb.append(", error=");
+                sb.append(event.getError());
+            }
+
+            if (event.getDetails() != null) {
+                for (Map.Entry<String, String> e : event.getDetails().entrySet()) {
+                    sb.append(", ");
+                    sb.append(e.getKey());
+                    if (e.getValue() == null || e.getValue().indexOf(' ') == -1) {
+                        sb.append("=");
+                        sb.append(e.getValue());
+                    } else {
+                        sb.append("='");
+                        sb.append(e.getValue());
+                        sb.append("'");
+                    }
+                }
+            }
+
+            logger.log(level, sb.toString());
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+}
@@ -0,0 +1,36 @@
+package org.keycloak.audit.log;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.AuditListenerFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JBossLoggingAuditListenerFactory implements AuditListenerFactory {
+
+    public static final String ID = "jboss-logging";
+
+    private static final Logger logger = Logger.getLogger("org.keycloak.audit");
+
+    @Override
+    public AuditListener create(ProviderSession providerSession) {
+        return new JBossLoggingAuditListener(logger);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.audit.log.JBossLoggingAuditListenerFactory
@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-jpa</artifactId>
+    <name>Keycloak Audit JPA Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-tests</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>
@@ -0,0 +1,115 @@
+package org.keycloak.audit.jpa;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Entity
+public class EventEntity {
+
+    @Id
+    private String id;
+
+    private long time;
+
+    private String event;
+
+    private String realmId;
+
+    private String clientId;
+
+    private String userId;
+
+    private String sessionId;
+
+    private String ipAddress;
+
+    private String error;
+
+    @Column(length = 2550)
+    private String detailsJson;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public long getTime() {
+        return time;
+    }
+
+    public void setTime(long time) {
+        this.time = time;
+    }
+
+    public String getEvent() {
+        return event;
+    }
+
+    public void setEvent(String event) {
+        this.event = event;
+    }
+
+    public String getRealmId() {
+        return realmId;
+    }
+
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
+
+    public String getSessionId() {
+        return sessionId;
+    }
+
+    public void setSessionId(String sessionId) {
+        this.sessionId = sessionId;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public void setIpAddress(String ipAddress) {
+        this.ipAddress = ipAddress;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public String getDetailsJson() {
+        return detailsJson;
+    }
+
+    public void setDetailsJson(String detailsJson) {
+        this.detailsJson = detailsJson;
+    }
+
+}
@@ -0,0 +1,122 @@
+package org.keycloak.audit.jpa;
+
+import org.codehaus.jackson.map.ObjectMapper;
+import org.codehaus.jackson.type.TypeReference;
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import javax.persistence.EntityManager;
+import javax.persistence.EntityTransaction;
+import java.io.IOException;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProvider implements AuditProvider {
+
+    private static final ObjectMapper mapper = new ObjectMapper();
+    private static final TypeReference<Map<String, String>> mapType = new TypeReference<Map<String, String>>() {
+    };
+    private static final Logger logger = Logger.getLogger(JpaAuditProvider.class);
+
+    private EntityManager em;
+    private EntityTransaction tx;
+    private Set<EventType> includedEvents;
+
+    public JpaAuditProvider(EntityManager em, Set<EventType> includedEvents) {
+        this.em = em;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public EventQuery createQuery() {
+        return new JpaEventQuery(em);
+    }
+
+    @Override
+    public void clear() {
+        beginTx();
+        em.createQuery("delete from EventEntity").executeUpdate();
+    }
+
+    @Override
+    public void clear(String realmId) {
+        beginTx();
+        em.createQuery("delete from EventEntity where realmId = :realmId").setParameter("realmId", realmId).executeUpdate();
+    }
+
+    @Override
+    public void clear(String realmId, long olderThan) {
+        beginTx();
+        em.createQuery("delete from EventEntity where realmId = :realmId and time < :time").setParameter("realmId", realmId).setParameter("time", olderThan).executeUpdate();
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            beginTx();
+            em.persist(convert(event));
+        }
+    }
+
+    @Override
+    public void close() {
+        if (tx != null) {
+            tx.commit();
+        }
+
+        em.close();
+    }
+
+    private void beginTx() {
+        if (tx == null) {
+            tx = em.getTransaction();
+            tx.begin();
+        }
+    }
+
+    static EventEntity convert(Event o) {
+        EventEntity e = new EventEntity();
+        e.setId(UUID.randomUUID().toString());
+        e.setTime(o.getTime());
+        e.setEvent(o.getEvent().toString());
+        e.setRealmId(o.getRealmId());
+        e.setClientId(o.getClientId());
+        e.setUserId(o.getUserId());
+        e.setSessionId(o.getSessionId());
+        e.setIpAddress(o.getIpAddress());
+        e.setError(o.getError());
+        try {
+            e.setDetailsJson(mapper.writeValueAsString(o.getDetails()));
+        } catch (IOException ex) {
+            logger.error("Failed to write log details", ex);
+        }
+        return e;
+    }
+
+    static Event convert(EventEntity o) {
+        Event e = new Event();
+        e.setTime(o.getTime());
+        e.setEvent(EventType.valueOf(o.getEvent()));
+        e.setRealmId(o.getRealmId());
+        e.setClientId(o.getClientId());
+        e.setUserId(o.getUserId());
+        e.setSessionId(o.getSessionId());
+        e.setIpAddress(o.getIpAddress());
+        e.setError(o.getError());
+        try {
+            Map<String, String> details = mapper.readValue(o.getDetailsJson(), mapType);
+            e.setDetails(details);
+        } catch (IOException ex) {
+            logger.error("Failed to read log details", ex);
+        }
+        return e;
+    }
+
+}
@@ -0,0 +1,62 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderSession;
+
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProviderFactory implements AuditProviderFactory {
+
+    public static final String ID = "jpa";
+    private EntityManagerFactory emf;
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditProvider create(ProviderSession providerSession) {
+        return new JpaAuditProvider(emf.createEntityManager(), includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        emf = Persistence.createEntityManagerFactory("jpa-keycloak-audit-store");
+
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            for (EventType i : EventType.values()) {
+                includedEvents.add(i);
+            }
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+        emf.close();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}
@@ -0,0 +1,111 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import javax.persistence.criteria.CriteriaBuilder;
+import javax.persistence.criteria.CriteriaQuery;
+import javax.persistence.criteria.Predicate;
+import javax.persistence.criteria.Root;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaEventQuery implements EventQuery {
+
+    private final EntityManager em;
+    private final CriteriaBuilder cb;
+    private final CriteriaQuery<EventEntity> cq;
+    private final Root<EventEntity> root;
+    private final ArrayList<Predicate> predicates;
+    private Integer firstResult;
+    private Integer maxResults;
+
+    public JpaEventQuery(EntityManager em) {
+        this.em = em;
+
+        cb = em.getCriteriaBuilder();
+        cq = cb.createQuery(EventEntity.class);
+        root = cq.from(EventEntity.class);
+        predicates = new ArrayList<Predicate>(4);
+    }
+
+    @Override
+    public EventQuery event(EventType... events) {
+        List<String> eventStrings = new LinkedList<String>();
+        for (EventType e : events) {
+            eventStrings.add(e.toString());
+        }
+        predicates.add(root.get("event").in(eventStrings));
+        return this;
+    }
+
+    @Override
+    public EventQuery realm(String realmId) {
+        predicates.add(cb.equal(root.get("realmId"), realmId));
+        return this;
+    }
+
+    @Override
+    public EventQuery client(String clientId) {
+        predicates.add(cb.equal(root.get("clientId"), clientId));
+        return this;
+    }
+
+    @Override
+    public EventQuery user(String userId) {
+        predicates.add(cb.equal(root.get("userId"), userId));
+        return this;
+    }
+
+    @Override
+    public EventQuery ipAddress(String ipAddress) {
+        predicates.add(cb.equal(root.get("ipAddress"), ipAddress));
+        return this;
+    }
+
+    @Override
+    public EventQuery firstResult(int firstResult) {
+        this.firstResult = firstResult;
+        return this;
+    }
+
+    @Override
+    public EventQuery maxResults(int maxResults) {
+        this.maxResults = maxResults;
+        return this;
+    }
+
+    @Override
+    public List<Event> getResultList() {
+        if (!predicates.isEmpty()) {
+            cq.where(cb.and(predicates.toArray(new Predicate[predicates.size()])));
+        }
+
+        cq.orderBy(cb.desc(root.get("time")));
+
+        TypedQuery<EventEntity> query = em.createQuery(cq);
+
+        if (firstResult != null) {
+            query.setFirstResult(firstResult);
+        }
+
+        if (maxResults != null) {
+            query.setMaxResults(maxResults);
+        }
+
+        List<Event> events = new LinkedList<Event>();
+        for (EventEntity e : query.getResultList()) {
+            events.add(JpaAuditProvider.convert(e));
+        }
+
+        return events;
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.audit.jpa.JpaAuditProviderFactory
@@ -0,0 +1,15 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.audit.tests.AbstractAuditProviderTest;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProviderTest extends AbstractAuditProviderTest {
+
+    @Override
+    protected String getProviderId() {
+        return JpaAuditProviderFactory.ID;
+    }
+
+}
@@ -0,0 +1,22 @@
+<persistence xmlns="http://java.sun.com/xml/ns/persistence"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
+    version="1.0">
+    <persistence-unit name="jpa-keycloak-audit-store" transaction-type="RESOURCE_LOCAL">
+        <provider>org.hibernate.ejb.HibernatePersistence</provider>
+
+        <class>org.keycloak.audit.jpa.EventEntity</class>
+
+        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+
+        <properties>
+            <property name="hibernate.connection.url" value="jdbc:h2:mem:test"/>
+            <property name="hibernate.connection.driver_class" value="org.h2.Driver"/>
+            <property name="hibernate.connection.username" value="sa"/>
+            <property name="hibernate.connection.password" value=""/>
+            <property name="hibernate.hbm2ddl.auto" value="create-drop" />
+            <property name="hibernate.show_sql" value="false" />
+            <property name="hibernate.format_sql" value="true" />
+        </properties>
+    </persistence-unit>
+</persistence>
@@ -0,0 +1,136 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-mongo</artifactId>
+    <name>Keycloak Audit Mongo Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.4</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-tests</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+    <properties>
+        <keycloak.audit.mongo.host>localhost</keycloak.audit.mongo.host>
+        <keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
+        <keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
+        <keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
+        <keycloak.audit.mongo.bindIp>127.0.0.1</keycloak.audit.mongo.bindIp>
+    </properties>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>1.6</source>
+                    <target>1.6</target>
+                </configuration>
+            </plugin>
+
+            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>test</id>
+                        <phase>integration-test</phase>
+                        <goals>
+                            <goal>test</goal>
+                        </goals>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <keycloak.audit.mongo.host>${keycloak.audit.mongo.host}</keycloak.audit.mongo.host>
+                                <keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
+                                <keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
+                                <keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
+                                <keycloak.audit.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.audit.mongo.bindIp>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>default-test</id>
+                        <configuration>
+                            <skip>true</skip>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
+            <!-- Embedded mongo -->
+            <plugin>
+                <groupId>com.github.joelittlejohn.embedmongo</groupId>
+                <artifactId>embedmongo-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>start-mongodb</id>
+                        <phase>pre-integration-test</phase>
+                        <goals>
+                            <goal>start</goal>
+                        </goals>
+                        <configuration>
+                            <port>${keycloak.audit.mongo.port}</port>
+                            <logging>file</logging>
+                            <logFile>${project.build.directory}/mongodb.log</logFile>
+                            <bindIp>${keycloak.audit.mongo.bindIp}</bindIp>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>stop-mongodb</id>
+                        <phase>post-integration-test</phase>
+                        <goals>
+                            <goal>stop</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+        </plugins>
+    </build>
+</project>
@@ -0,0 +1,107 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBCollection;
+import com.mongodb.DBObject;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProvider implements AuditProvider {
+
+    private DBCollection audit;
+    private Set<EventType> includedEvents;
+
+    public MongoAuditProvider(DBCollection audit, Set<EventType> includedEvents) {
+        this.audit = audit;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public EventQuery createQuery() {
+        return new MongoEventQuery(audit);
+    }
+
+    @Override
+    public void clear() {
+        audit.remove(new BasicDBObject());
+    }
+
+    @Override
+    public void clear(String realmId) {
+        audit.remove(new BasicDBObject("realmId", realmId));
+    }
+
+    @Override
+    public void clear(String realmId, long olderThan) {
+        BasicDBObject q = new BasicDBObject();
+        q.put("realmId", realmId);
+        q.put("time", new BasicDBObject("$lt", olderThan));
+        audit.remove(q);
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            audit.insert(convert(event));
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    static DBObject convert(Event o) {
+        BasicDBObject e = new BasicDBObject();
+        e.put("time", o.getTime());
+        e.put("event", o.getEvent().toString());
+        e.put("realmId", o.getRealmId());
+        e.put("clientId", o.getClientId());
+        e.put("userId", o.getUserId());
+        e.put("sessionId", o.getSessionId());
+        e.put("ipAddress", o.getIpAddress());
+        e.put("error", o.getError());
+
+        BasicDBObject details = new BasicDBObject();
+        if (o.getDetails() != null) {
+            for (Map.Entry<String, String> entry : o.getDetails().entrySet()) {
+                details.put(entry.getKey(), entry.getValue());
+            }
+        }
+        e.put("details", details);
+
+        return e;
+    }
+
+    static Event convert(BasicDBObject o) {
+        Event e = new Event();
+        e.setTime(o.getLong("time"));
+        e.setEvent(EventType.valueOf(o.getString("event")));
+        e.setRealmId(o.getString("realmId"));
+        e.setClientId(o.getString("clientId"));
+        e.setUserId(o.getString("userId"));
+        e.setSessionId(o.getString("sessionId"));
+        e.setIpAddress(o.getString("ipAddress"));
+        e.setError(o.getString("error"));
+
+        BasicDBObject d = (BasicDBObject) o.get("details");
+        if (d != null) {
+            Map<String, String> details = new HashMap<String, String>();
+            for (Object k : d.keySet()) {
+                details.put((String) k, d.getString((String) k));
+            }
+            e.setDetails(details);
+        }
+
+        return e;
+    }
+
+}
@@ -0,0 +1,96 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import com.mongodb.WriteConcern;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderSession;
+
+import java.net.UnknownHostException;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProviderFactory implements AuditProviderFactory {
+
+    protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
+
+    public static final String ID = "mongo";
+    private MongoClient client;
+    private DB db;
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditProvider create(ProviderSession providerSession) {
+        return new MongoAuditProvider(db.getCollection("audit"), includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        try {
+            String host = config.get("host", ServerAddress.defaultHost());
+            int port = config.getInt("port", ServerAddress.defaultPort());
+            String dbName = config.get("db", "keycloak-audit");
+            boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
+
+            String user = config.get("user");
+            String password = config.get("password");
+            if (user != null && password != null) {
+                MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
+            } else {
+                client = new MongoClient(host, port);
+            }
+
+            client.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
+            db = client.getDB(dbName);
+
+            if (clearOnStartup) {
+                db.getCollection("audit").drop();
+            }
+
+            logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
+        } catch (UnknownHostException e) {
+            throw new RuntimeException(e);
+        }
+
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            for (EventType i : EventType.values()) {
+                includedEvents.add(i);
+            }
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+        client.close();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}
@@ -0,0 +1,93 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBCollection;
+import com.mongodb.DBCursor;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoEventQuery implements EventQuery {
+
+    private Integer firstResult;
+    private Integer maxResults;
+    private DBCollection audit;
+    private final BasicDBObject query;
+
+    public MongoEventQuery(DBCollection audit) {
+        this.audit = audit;
+        query = new BasicDBObject();
+    }
+
+    @Override
+    public EventQuery event(EventType... events) {
+        List<String> eventStrings = new LinkedList<String>();
+        for (EventType e : events) {
+            eventStrings.add(e.toString());
+        }
+        query.put("event", new BasicDBObject("$in", eventStrings));
+        return this;
+    }
+
+    @Override
+    public EventQuery realm(String realmId) {
+        query.put("realmId", realmId);
+        return this;
+    }
+
+    @Override
+    public EventQuery client(String clientId) {
+        query.put("clientId", clientId);
+        return this;
+    }
+
+    @Override
+    public EventQuery user(String userId) {
+        query.put("userId", userId);
+        return this;
+    }
+
+    @Override
+    public EventQuery ipAddress(String ipAddress) {
+        query.put("ipAddress", ipAddress);
+        return this;
+    }
+
+    @Override
+    public EventQuery firstResult(int firstResult) {
+        this.firstResult = firstResult;
+        return this;
+    }
+
+    @Override
+    public EventQuery maxResults(int maxResults) {
+        this.maxResults = maxResults;
+        return this;
+    }
+
+    @Override
+    public List<Event> getResultList() {
+        DBCursor cur = audit.find(query).sort(new BasicDBObject("time", -1));
+        if (firstResult != null) {
+            cur.skip(firstResult);
+        }
+        if (maxResults != null) {
+            cur.limit(maxResults);
+        }
+
+        List<Event> events = new LinkedList<Event>();
+        while (cur.hasNext()) {
+            events.add(MongoAuditProvider.convert((BasicDBObject) cur.next()));
+        }
+
+        return events;
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.audit.mongo.MongoAuditProviderFactory
@@ -0,0 +1,15 @@
+package org.keycloak.audit.mongo;
+
+import org.keycloak.audit.tests.AbstractAuditProviderTest;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProviderTest extends AbstractAuditProviderTest {
+
+    @Override
+    protected String getProviderId() {
+        return MongoAuditProviderFactory.ID;
+    }
+
+}
@@ -0,0 +1,26 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+
+    <name>Audit Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.keycloak</groupId>
+    <artifactId>keycloak-audit-parent</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>api</module>
+        <module>email</module>
+        <module>jpa</module>
+        <module>jboss-logging</module>
+        <module>mongo</module>
+        <module>tests</module>
+    </modules>
+</project>
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-tests</artifactId>
+    <name>Keycloak Audit Tests</name>
+    <description/>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>
@@ -0,0 +1,139 @@
+package org.keycloak.audit.tests;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderFactory;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.ServiceLoader;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public abstract class AbstractAuditProviderTest {
+
+    private ProviderFactory<AuditProvider> factory;
+    private AuditProvider provider;
+
+    @Before
+    public void before() {
+        String providerId = getProviderId();
+        ServiceLoader<AuditProviderFactory> factories = ServiceLoader.load(AuditProviderFactory.class);
+        for (AuditProviderFactory f : factories) {
+            if (f.getId().equals(providerId)) {
+                factory = f;
+                factory.init(Config.scope("audit", providerId));
+            }
+        }
+
+        provider = factory.create(null);
+    }
+
+    protected abstract String getProviderId();
+
+    @After
+    public void after() {
+        provider.clear();
+        provider.close();
+        factory.close();
+    }
+
+    @Test
+    public void save() {
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+    }
+
+    @Test
+    public void query() {
+        long oldest = System.currentTimeMillis() - 30000;
+        long newest = System.currentTimeMillis() + 30000;
+
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
+        provider.onEvent(create(EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(oldest, EventType.LOGIN, "realmId", "clientId2", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        Assert.assertEquals(5, provider.createQuery().client("clientId").getResultList().size());
+        Assert.assertEquals(5, provider.createQuery().realm("realmId").getResultList().size());
+        Assert.assertEquals(4, provider.createQuery().event(EventType.LOGIN).getResultList().size());
+        Assert.assertEquals(6, provider.createQuery().event(EventType.LOGIN, EventType.REGISTER).getResultList().size());
+        Assert.assertEquals(4, provider.createQuery().user("userId").getResultList().size());
+
+        Assert.assertEquals(1, provider.createQuery().user("userId").event(EventType.REGISTER).getResultList().size());
+
+        Assert.assertEquals(2, provider.createQuery().maxResults(2).getResultList().size());
+        Assert.assertEquals(1, provider.createQuery().firstResult(5).getResultList().size());
+
+        Assert.assertEquals(newest, provider.createQuery().maxResults(1).getResultList().get(0).getTime());
+        Assert.assertEquals(oldest, provider.createQuery().firstResult(5).maxResults(1).getResultList().get(0).getTime());
+    }
+
+    @Test
+    public void clear() {
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        provider.clear("realmId");
+
+        Assert.assertEquals(1, provider.createQuery().getResultList().size());
+    }
+
+    @Test
+    public void clearOld() {
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        provider.clear("realmId", System.currentTimeMillis() - 10000);
+
+        Assert.assertEquals(3, provider.createQuery().getResultList().size());
+    }
+
+    private Event create(EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
+        return create(System.currentTimeMillis(), event, realmId, clientId, userId, ipAddress, error);
+    }
+
+    private Event create(long time, EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
+        Event e = new Event();
+        e.setTime(time);
+        e.setEvent(event);
+        e.setRealmId(realmId);
+        e.setClientId(clientId);
+        e.setUserId(userId);
+        e.setIpAddress(ipAddress);
+        e.setError(error);
+
+        Map<String, String> details = new HashMap<String, String>();
+        details.put("key1", "value1");
+        details.put("key2", "value2");
+
+        e.setDetails(details);
+
+        return e;
+    }
+
+}
@@ -0,0 +1,48 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-api</artifactId>
+    <name>Keycloak Authentication SPI</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
@@ -0,0 +1,15 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthProviderConstants {
+
+    // Model is default provider. See AuthenticationProviderModel.DEFAULT_PROVIDER
+    public static final String PROVIDER_NAME_MODEL = "model";
+    public static final String PROVIDER_NAME_EXTERNAL_MODEL = "externalModel";
+    public static final String PROVIDER_NAME_PICKETLINK = "picketlink";
+
+    // Used in external-model provider
+    public static final String EXTERNAL_REALM_ID = "externalRealmId";
+}
@@ -0,0 +1,12 @@
+package org.keycloak.authentication;
+
+/**
+ * Result of authentication by AuthenticationProvider
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public enum AuthProviderStatus {
+
+    SUCCESS, INVALID_CREDENTIALS, FAILED
+
+}
@@ -0,0 +1,83 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthUser {
+
+    private String id;
+    private String username;
+    private String firstName;
+    private String lastName;
+    private String email;
+
+    private String providerName;
+
+    public AuthUser(String id, String username, String providerName) {
+        this.id = id;
+        this.username = username;
+        this.providerName = providerName;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public AuthUser setId(String id) {
+        this.id = id;
+        return this;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public AuthUser setUsername(String username) {
+        this.username = username;
+        return this;
+    }
+
+    public String getFirstName() {
+        return firstName;
+    }
+
+    public AuthUser setName(String name) {
+        int i = name.lastIndexOf(' ');
+        if (i != -1) {
+            firstName  = name.substring(0, i);
+            lastName = name.substring(i + 1);
+        } else {
+            firstName = name;
+        }
+
+        return this;
+    }
+
+    public AuthUser setName(String firstName, String lastName) {
+        this.firstName = firstName;
+        this.lastName = lastName;
+        return this;
+    }
+
+    public String getLastName() {
+        return lastName;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public AuthUser setEmail(String email) {
+        this.email = email;
+        return this;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public AuthUser setProviderName(String providerName) {
+        this.providerName = providerName;
+        return this;
+    }
+}
@@ -0,0 +1,68 @@
+package org.keycloak.authentication;
+
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface AuthenticationProvider extends Provider {
+
+    String getName();
+
+    /**
+     * Get names of all available configuration options of current provider
+     *
+     * @return options or empty list if no options available
+     */
+    List<String> getAvailableOptions();
+
+    /**
+     * Get user by given username or email. Return user instance or null if user doesn't exists in this authentication provider
+     *
+     * @param realm
+     * @param configuration
+     * @param username or email
+     * @return found user or null if user with given username doesn't exists
+     * @throws AuthenticationProviderException
+     */
+    AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
+
+    /**
+     * Try to register user with this authentication provider
+     *
+     * @param realm
+     * @param configuration
+     * @param username
+     * @return ID of newly created user (For example ID from LDAP)
+     * @throws AuthenticationProviderException if user creation couldn't happen
+     */
+    String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
+
+    /**
+     * Standard Authentication flow
+     *
+     * @param username
+     * @param password
+     * @return result of authentication, which might eventually encapsulate info about authenticated user and provider which successfully authenticated
+     */
+    AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
+
+
+    /**
+     * Update credential
+     *
+     * @param realm
+     * @param configuration
+     * @param username
+     * @param password
+     * @return true if credential has been successfully updated
+     * @throws AuthenticationProviderException
+     */
+    boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
+
+
+}
@@ -0,0 +1,24 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthenticationProviderException extends Exception {
+
+    private static final long serialVersionUID = 15L;
+
+    protected AuthenticationProviderException() {
+    }
+
+    public AuthenticationProviderException(String message) {
+        super(message);
+    }
+
+    public AuthenticationProviderException(Throwable cause) {
+        super(cause);
+    }
+
+    public AuthenticationProviderException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}
@@ -0,0 +1,9 @@
+package org.keycloak.authentication;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface AuthenticationProviderFactory extends ProviderFactory<AuthenticationProvider> {
+}
@@ -0,0 +1,219 @@
+package org.keycloak.authentication;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderSession;
+import org.keycloak.util.ProviderLoader;
+
+/**
+ * Access point to authentication SPI. It finds configured and available {@link AuthenticationProvider} instances for current realm
+ * and then delegates method call to them.
+ *
+ * Example of usage: AuthenticationProviderManager.getManager(realm).validateUser("joe", "password");
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthenticationProviderManager {
+
+    private static final Logger logger = Logger.getLogger(AuthenticationProviderManager.class);
+
+    private final RealmModel realm;
+    private final Map<String, AuthenticationProvider> delegates;
+
+    public static AuthenticationProviderManager getManager(RealmModel realm, ProviderSession providerSession) {
+        Iterable<AuthenticationProvider> providers = providerSession.getAllProviders(AuthenticationProvider.class);
+
+        Map<String, AuthenticationProvider> providersMap = new HashMap<String, AuthenticationProvider>();
+        for (AuthenticationProvider provider : providers) {
+            providersMap.put(provider.getName(), provider);
+        }
+
+        return new AuthenticationProviderManager(realm, providersMap);
+    }
+
+    public AuthenticationProviderManager(RealmModel realm, Map<String, AuthenticationProvider> delegates) {
+        this.realm = realm;
+        this.delegates = delegates;
+    }
+
+    public AuthUser getUser(String username) {
+        List<AuthenticationProviderModel> authProviderModels = getConfiguredProviderModels(realm);
+        for (AuthenticationProviderModel providerModel : authProviderModels) {
+            AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
+            if (delegate == null) {
+                continue;
+            }
+
+            try {
+                AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), username);
+                if (authUser != null) {
+                    logger.debugf("User '%s' found with provider '%s'", username, providerModel.getProviderName());
+                    return authUser;
+                }
+            } catch (AuthenticationProviderException ape) {
+                logger.warn(ape.getMessage(), ape);
+            }
+        }
+
+        logger.debugf("User '%s' not found with any provider", username);
+        return null;
+    }
+
+    public AuthProviderStatus validatePassword(UserModel user, String password) {
+        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
+        if (authLink == null) {
+            // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
+            AuthUser authUser = getUser(user.getLoginName());
+            authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
+            realm.setAuthenticationLink(user, authLink);
+            logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
+        }
+
+        String providerName = authLink.getAuthProvider();
+
+        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
+        AuthenticationProvider delegate = getProvider(providerName);
+        if (delegate == null || providerModel == null) {
+            return AuthProviderStatus.FAILED;
+        }
+
+        try {
+            checkCorrectAuthLink(delegate, providerModel, authLink, user.getLoginName());
+
+            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getLoginName(), password);
+            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getLoginName());
+            return currentResult;
+        } catch (AuthenticationProviderException ape) {
+            logger.warn(ape.getMessage(), ape);
+            return AuthProviderStatus.FAILED;
+        }
+    }
+
+    public boolean updatePassword(UserModel user, String password) throws AuthenticationProviderException {
+        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
+        if (authLink == null) {
+            // Find provider with biggest priority where password update is supported. Then register user here and link him
+            List<AuthenticationProviderModel> configuredProviders = getConfiguredProviderModels(realm);
+            for (AuthenticationProviderModel providerModel : configuredProviders) {
+                if (providerModel.isPasswordUpdateSupported()) {
+                    AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
+                    if (delegate != null) {
+                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getLoginName());
+                        if (authUser != null) {
+                            // Linking existing user supported just for "model" provider. In other cases throw exception
+                            if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
+                                authLink = new AuthenticationLinkModel(providerModel.getProviderName(), authUser.getId());
+                                realm.setAuthenticationLink(user, authLink);
+                                logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
+                            } else {
+                                throw new AuthenticationProviderException("User " + authUser.getUsername() + " exists in provider "
+                                        + authUser.getProviderName() + " but is not linked with model user");
+                            }
+                        } else {
+                            String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user.getLoginName());
+                            authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
+                            realm.setAuthenticationLink(user, authLink);
+                            logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
+                        }
+                        break;
+                    }
+                }
+            }
+
+            if (authLink == null) {
+                logger.warnf("No providers found where password update is supported for user '%s'", user.getLoginName());
+                return false;
+            }
+        }
+
+        String providerName = authLink.getAuthProvider();
+
+        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
+        if (providerModel == null) {
+            return false;
+        }
+
+        String username = user.getLoginName();
+
+        // Update just those, which support password update
+        if (providerModel.isPasswordUpdateSupported()) {
+            try {
+                AuthenticationProvider delegate = getProvider(providerName);
+                if (delegate == null) {
+                    return false;
+                }
+
+                checkCorrectAuthLink(delegate, providerModel, authLink, username);
+
+                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getLoginName(), password)) {
+                    logger.debugf("Updated password in authentication provider '%s' for user '%s'", providerName, username);
+                    return true;
+                } else {
+                    logger.warnf("Password not updated in authentication provider '%s' for user '%s'", providerName, username);
+                    return false;
+                }
+            } catch (AuthenticationProviderException ape) {
+                // Rethrow it to upper layer
+                logger.warn("Failed to update password: " + ape.getMessage());
+                throw ape;
+            }
+        } else {
+            logger.warnf("Skip password update for authentication provider '%s' for user '%s'", providerName, username);
+            return false;
+        }
+    }
+
+    private AuthenticationProvider getProvider(String providerName) {
+        AuthenticationProvider delegate = delegates.get(providerName);
+        if (delegate == null) {
+            logger.warnf("Provider '%s' not available on classpath", providerName);
+        }
+        return delegate;
+    }
+
+    private static List<AuthenticationProviderModel> getConfiguredProviderModels(RealmModel realm) {
+        List<AuthenticationProviderModel> configuredProviders = realm.getAuthenticationProviders();
+
+        // Use model based authentication of current realm by default
+        if (configuredProviders == null || configuredProviders.isEmpty()) {
+            configuredProviders = Collections.EMPTY_LIST;
+            logger.warnf("No authentication providers found");
+        }
+
+        return configuredProviders;
+    }
+
+    public static AuthenticationProviderModel getConfiguredProviderModel(RealmModel realm, String providerName) {
+        List<AuthenticationProviderModel> providers = getConfiguredProviderModels(realm);
+        for (AuthenticationProviderModel provider : providers) {
+            if (providerName.equals(provider.getProviderName())) {
+                return provider;
+            }
+        }
+
+        logger.warnf("Provider '%s' not configured in realm", providerName);
+        return null;
+    }
+
+    // Check if ID of linked AuthUser is same as expected ID from authenticationLink . It should catch the case when for example user "john" was deleted in LDAP
+    // and then user "john" has been created again, but it's actually different user with different ID
+    private void checkCorrectAuthLink(AuthenticationProvider authProvider, AuthenticationProviderModel providerModel,
+                                      AuthenticationLinkModel authLinkModel, String username) throws AuthenticationProviderException {
+        AuthUser authUser = authProvider.getUser(realm, providerModel.getConfig(), username);
+        if (authUser == null) {
+            throw new AuthenticationProviderException("User " + username + " not found in authentication provider " + providerModel.getProviderName());
+        }
+        String userExternalId = authUser.getId();
+        if (!userExternalId.equals(authLinkModel.getAuthUserId())) {
+            throw new AuthenticationProviderException("ID did not match! ID from provider: " + userExternalId + ", ID from authentication link: " + authLinkModel.getAuthUserId());
+        }
+    }
+}
@@ -0,0 +1,27 @@
+package org.keycloak.authentication;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuthenticationSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "authentication";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuthenticationProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuthenticationProviderFactory.class;
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.authentication.AuthenticationSpi
@@ -0,0 +1,74 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-model</artifactId>
+    <name>Keycloak Authentication Model Based</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
@@ -0,0 +1,84 @@
+package org.keycloak.authentication.model;
+
+import java.util.Map;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.authentication.AuthProviderStatus;
+import org.keycloak.authentication.AuthUser;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderException;
+
+/**
+ * Authentication provider, which delegates calling of all methods to specified realm
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public abstract class AbstractModelAuthenticationProvider implements AuthenticationProvider {
+
+    private static final Logger logger = Logger.getLogger(AbstractModelAuthenticationProvider.class);
+
+    @Override
+    public AuthUser getUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+        return user == null ? null : createAuthenticatedUserInstance(user);
+    }
+
+    @Override
+    public String registerUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = currentRealm.addUser(username);
+        user.setEnabled(true);
+        return user.getId();
+    }
+
+    @Override
+    public AuthProviderStatus validatePassword(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+
+        boolean result = realm.validatePassword(user, password);
+        return result ? AuthProviderStatus.SUCCESS : AuthProviderStatus.INVALID_CREDENTIALS;
+    }
+
+    @Override
+    public boolean updateCredential(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+
+        // Validate password policy
+        String error = realm.getPasswordPolicy().validate(password);
+        if (error != null) {
+            throw new AuthenticationProviderException(error);
+        }
+
+        UserModel user = realm.getUser(username);
+        if (user == null) {
+            logger.warnf("User '%s' doesn't exists. Skip password update", username);
+            return false;
+        }
+
+        UserCredentialModel cred = new UserCredentialModel();
+        cred.setType(CredentialRepresentation.PASSWORD);
+        cred.setValue(password);
+
+        realm.updateCredential(user, cred);
+        return true;
+    }
+
+    @Override
+    public void close() {
+    }
+
+    protected abstract RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) throws AuthenticationProviderException;
+
+    protected AuthUser createAuthenticatedUserInstance(UserModel user) {
+        return new AuthUser(user.getId(), user.getLoginName(), getName())
+                .setName(user.getFirstName(), user.getLastName())
+                .setEmail(user.getEmail());
+    }
+}
@@ -0,0 +1,53 @@
+package org.keycloak.authentication.model;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+import org.jboss.resteasy.spi.ResteasyProviderFactory;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProviderException;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * AbstractModelAuthenticationProvider, which delegates authentication operations to different (external) realm
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
+
+    public ExternalModelAuthenticationProvider(ProviderSession providerSession) {
+    }
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Arrays.asList(AuthProviderConstants.EXTERNAL_REALM_ID);
+    }
+
+    @Override
+    public RealmModel getRealm(RealmModel currentRealm, Map<String, String> configuration) throws AuthenticationProviderException {
+        String realmId = configuration.get(AuthProviderConstants.EXTERNAL_REALM_ID);
+        if (realmId == null) {
+            throw new AuthenticationProviderException("Option '" + AuthProviderConstants.EXTERNAL_REALM_ID + "' not specified in configuration");
+        }
+
+        // TODO: This won't be needed when KeycloakSession is available from ProviderSession
+        KeycloakSession session = ResteasyProviderFactory.getContextData(KeycloakSession.class);
+        if (session == null) {
+            throw new AuthenticationProviderException("KeycloakSession not available");
+        }
+
+        RealmModel realm = session.getRealm(realmId);
+        if (realm == null) {
+            throw new AuthenticationProviderException("Realm with id '" + realmId + "' doesn't exists");
+        }
+        return realm;
+    }
+}
@@ -0,0 +1,32 @@
+package org.keycloak.authentication.model;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new ExternalModelAuthenticationProvider(providerSession);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
+    }
+
+}
@@ -0,0 +1,31 @@
+package org.keycloak.authentication.model;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.authentication.AuthProviderConstants;
+
+/**
+ * AbstractModelAuthenticationProvider, which uses current realm to call operations on
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_MODEL;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Collections.EMPTY_LIST;
+    }
+
+    @Override
+    protected RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) {
+        return currentRealm;
+    }
+}
@@ -0,0 +1,32 @@
+package org.keycloak.authentication.model;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new ModelAuthenticationProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_MODEL;
+    }
+
+}
@@ -0,0 +1,2 @@
+org.keycloak.authentication.model.ModelAuthenticationProviderFactory
+org.keycloak.authentication.model.ExternalModelAuthenticationProviderFactory
@@ -0,0 +1,101 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-picketlink</artifactId>
+    <name>Keycloak Authentication Picketlink Based</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-picketlink-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-common</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-impl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-simple-schema</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
@@ -0,0 +1,130 @@
+package org.keycloak.authentication.picketlink;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthProviderStatus;
+import org.keycloak.authentication.AuthUser;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.picketlink.IdentityManagerProvider;
+import org.picketlink.idm.IdentityManagementException;
+import org.picketlink.idm.IdentityManager;
+import org.picketlink.idm.credential.Credentials;
+import org.picketlink.idm.credential.Password;
+import org.picketlink.idm.credential.UsernamePasswordCredentials;
+import org.picketlink.idm.model.basic.BasicModel;
+import org.picketlink.idm.model.basic.User;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * AuthenticationProvider, which delegates authentication to picketlink
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PicketlinkAuthenticationProvider implements AuthenticationProvider {
+
+    private static final Logger logger = Logger.getLogger(PicketlinkAuthenticationProvider.class);
+
+    private final IdentityManagerProvider identityManagerProvider;
+
+    public PicketlinkAuthenticationProvider(IdentityManagerProvider identityManagerProvider) {
+        this.identityManagerProvider = identityManagerProvider;
+    }
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Collections.EMPTY_LIST;
+    }
+
+    @Override
+    public AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, username);
+            return picketlinkUser == null ? null : new AuthUser(picketlinkUser.getId(), picketlinkUser.getLoginName(), getName())
+                    .setName(picketlinkUser.getFirstName(), picketlinkUser.getLastName())
+                    .setEmail(picketlinkUser.getEmail())
+                    .setProviderName(getName());
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = new User(username);
+            identityManager.add(picketlinkUser);
+            return picketlinkUser.getId();
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            UsernamePasswordCredentials credential = new UsernamePasswordCredentials();
+            credential.setUsername(username);
+            credential.setPassword(new Password(password.toCharArray()));
+            identityManager.validateCredentials(credential);
+            if (credential.getStatus() == Credentials.Status.VALID) {
+                return AuthProviderStatus.SUCCESS;
+            } else {
+                return AuthProviderStatus.INVALID_CREDENTIALS;
+            }
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, username);
+            if (picketlinkUser == null) {
+                logger.debugf("User '%s' doesn't exists. Skip password update", username);
+                return false;
+            }
+
+            identityManager.updateCredential(picketlinkUser, new Password(password.toCharArray()));
+            return true;
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    public IdentityManager getIdentityManager(RealmModel realm) throws AuthenticationProviderException {
+        return identityManagerProvider.getIdentityManager(realm);
+    }
+
+    private AuthenticationProviderException convertIDMException(IdentityManagementException ie) {
+        Throwable realCause = ie;
+        while (realCause.getCause() != null) {
+            realCause = realCause.getCause();
+        }
+
+        // Use the message from the realCause
+        return new AuthenticationProviderException(realCause.getMessage(), ie);
+    }
+}
@@ -0,0 +1,33 @@
+package org.keycloak.authentication.picketlink;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.picketlink.IdentityManagerProvider;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PicketlinkAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new PicketlinkAuthenticationProvider(providerSession.getProvider(IdentityManagerProvider.class));
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
+    }
+
+}
@@ -0,0 +1 @@
+org.keycloak.authentication.picketlink.PicketlinkAuthenticationProviderFactory
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-2</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+    <packaging>pom</packaging>
+
+    <artifactId>keycloak-authentication-parent</artifactId>
+    <name>Keycloak Authentication</name>
+    <description />
+
+    <modules>
+        <module>authentication-api</module>
+        <module>authentication-model</module>
+        <module>authentication-picketlink</module>
+    </modules>
+
+</project>
@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-2</version>
+        <version>1.0-beta-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -18,11 +19,6 @@
            <artifactId>resteasy-jaxrs</artifactId>
            <scope>provided</scope>
        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-client</artifactId>
-            <scope>provided</scope>
-        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-core</artifactId>
@@ -61,8 +57,8 @@
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                </configuration>
            </plugin>
        </plugins>
@@ -18,11 +18,11 @@ public class SkeletonKeyContextResolver implements ContextResolver<ObjectMapper>
    protected ObjectMapper mapper = new ObjectMapper();

    public SkeletonKeyContextResolver() {
-        mapper.setSerializationInclusion(JsonSerialize.Inclusion.NON_DEFAULT);
+        mapper.setSerializationInclusion(JsonSerialize.Inclusion.NON_NULL);
    }

    public SkeletonKeyContextResolver(boolean indent) {
-        mapper.setSerializationInclusion(JsonSerialize.Inclusion.NON_DEFAULT);
+        mapper.setSerializationInclusion(JsonSerialize.Inclusion.NON_NULL);
        if (indent) {
            mapper.enable(SerializationConfig.Feature.INDENT_OUTPUT);
        }
@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-2</version>
+        <version>1.0-beta-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -45,8 +46,8 @@
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                </configuration>
            </plugin>
        </plugins>
@@ -2,7 +2,6 @@ package org.keycloak;

 import org.keycloak.util.KeycloakUriBuilder;

-import java.security.KeyStore;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicLong;
@@ -12,18 +11,19 @@ import java.util.concurrent.atomic.AtomicLong;
 * @version $Revision: 1 $
 */
 public class AbstractOAuthClient {
-    public static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private final AtomicLong counter = new AtomicLong();
+
    protected String clientId;
    protected Map<String, String> credentials;
-    protected KeyStore truststore;
    protected String authUrl;
    protected String codeUrl;
+    protected String refreshUrl;
    protected String scope;
    protected String stateCookieName = OAUTH_TOKEN_REQUEST_STATE;
    protected String stateCookiePath;
    protected boolean isSecure;
-    protected final AtomicLong counter = new AtomicLong();
-
+    protected boolean publicClient;
    protected String getStateCode() {
        return counter.getAndIncrement() + "/" + UUID.randomUUID().toString();
    }
@@ -44,20 +44,10 @@ public class AbstractOAuthClient {
        this.credentials = credentials;
    }

-    public KeyStore getTruststore() {
-        return truststore;
-    }
-
-    public void setTruststore(KeyStore truststore) {
-        this.truststore = truststore;
-    }
-
    public String getAuthUrl() {
        return authUrl;
    }

-
-
    public void setAuthUrl(String authUrl) {
        this.authUrl = authUrl;
    }
@@ -70,6 +60,14 @@ public class AbstractOAuthClient {
        this.codeUrl = codeUrl;
    }

+    public String getRefreshUrl() {
+        return refreshUrl;
+    }
+
+    public void setRefreshUrl(String refreshUrl) {
+        this.refreshUrl = refreshUrl;
+    }
+
    public String getScope() {
        return scope;
    }
@@ -94,10 +92,18 @@ public class AbstractOAuthClient {
        this.stateCookiePath = stateCookiePath;
    }

+    public boolean isPublicClient() {
+        return publicClient;
+    }
+
+    public void setPublicClient(boolean publicClient) {
+        this.publicClient = publicClient;
+    }
+
    protected String stripOauthParametersFromRedirect(String uri) {
        KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
-                .replaceQueryParam("code", null)
-                .replaceQueryParam("state", null);
+                .replaceQueryParam(OAuth2Constants.CODE, null)
+                .replaceQueryParam(OAuth2Constants.STATE, null);
        return builder.build().toString();
    }

@@ -0,0 +1,145 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Config {
+
+    private static ConfigProvider configProvider = new SystemPropertiesConfigProvider();
+
+    public static void init(ConfigProvider configProvider) {
+        Config.configProvider = configProvider;
+    }
+
+    public static String getAdminRealm() {
+        return configProvider.scope("admin").get("realm", "master");
+    }
+
+    public static String getProvider(String spi) {
+        return configProvider.getProvider(spi);
+    }
+
+    public static Scope scope(String... scope) {
+         return configProvider.scope(scope);
+    }
+
+    public static interface ConfigProvider {
+
+        String getProvider(String spi);
+
+        Scope scope(String... scope);
+
+    }
+
+    public static class SystemPropertiesConfigProvider implements ConfigProvider {
+
+        @Override
+        public String getProvider(String spi) {
+            return System.getProperties().getProperty("keycloak." + spi + ".provider");
+        }
+
+        @Override
+        public Scope scope(String... scope) {
+            StringBuilder sb = new StringBuilder();
+            sb.append("keycloak.");
+            for (String s : scope) {
+                sb.append(s);
+                sb.append(".");
+            }
+            return new SystemPropertiesScope(sb.toString());
+        }
+
+    }
+
+    public static class SystemPropertiesScope implements Scope {
+
+        private String prefix;
+
+        public SystemPropertiesScope(String prefix) {
+            this.prefix = prefix;
+        }
+
+        @Override
+        public String get(String key) {
+            return get(key, null);
+        }
+
+        @Override
+        public String get(String key, String defaultValue) {
+            return System.getProperty(prefix + key, defaultValue);
+        }
+
+        @Override
+        public String[] getArray(String key) {
+            String value = get(key);
+            if (value != null) {
+                String[] a = value.split(",");
+                for (int i = 0; i < a.length; i++) {
+                    a[i] = a[i].trim();
+                }
+                return a;
+            } else {
+                return null;
+            }
+        }
+
+        @Override
+        public Integer getInt(String key) {
+            return getInt(key, null);
+        }
+
+        @Override
+        public Integer getInt(String key, Integer defaultValue) {
+            String v = get(key, null);
+            return v != null ? Integer.parseInt(v) : defaultValue;
+        }
+
+        @Override
+        public Long getLong(String key) {
+            return getLong(key, null);
+        }
+
+        @Override
+        public Long getLong(String key, Long defaultValue) {
+            String v = get(key, null);
+            return v != null ? Long.parseLong(v) : defaultValue;
+        }
+
+        @Override
+        public Boolean getBoolean(String key) {
+            return getBoolean(key, null);
+        }
+
+        @Override
+        public Boolean getBoolean(String key, Boolean defaultValue) {
+            String v = get(key, null);
+            return v != null ? Boolean.parseBoolean(v) : defaultValue;
+        }
+
+    }
+
+    /**
+     * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+     */
+    public static interface Scope {
+
+        String get(String key);
+
+        String get(String key, String defaultValue);
+
+        String[] getArray(String key);
+
+        Integer getInt(String key);
+
+        Integer getInt(String key, Integer defaultValue);
+
+        Long getLong(String key);
+
+        Long getLong(String key, Long defaultValue);
+
+        Boolean getBoolean(String key);
+
+        Boolean getBoolean(String key, Boolean defaultValue);
+
+    }
+}
@@ -0,0 +1,49 @@
+package org.keycloak;
+
+import java.io.Serializable;
+import java.security.Principal;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakPrincipal implements Principal, Serializable {
+    protected final String name;
+    protected final KeycloakSecurityContext context;
+
+    public KeycloakPrincipal(String name, KeycloakSecurityContext context) {
+        this.name = name;
+        this.context = context;
+    }
+
+    public KeycloakSecurityContext getKeycloakSecurityContext() {
+        return context;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        KeycloakPrincipal that = (KeycloakPrincipal) o;
+
+        if (!name.equals(that.name)) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        return name.hashCode();
+    }
+
+    @Override
+    public String toString() {
+        return name;
+    }
+}
@@ -0,0 +1,43 @@
+package org.keycloak;
+
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.IDToken;
+
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakSecurityContext implements Serializable {
+    protected String tokenString;
+    protected AccessToken token;
+    protected IDToken idToken;
+    protected String idTokenString;
+
+    public KeycloakSecurityContext() {
+    }
+
+    public KeycloakSecurityContext(String tokenString, AccessToken token, String idTokenString, IDToken idToken) {
+        this.tokenString = tokenString;
+        this.token = token;
+        this.idToken = idToken;
+        this.idTokenString = idTokenString;
+    }
+
+    public AccessToken getToken() {
+        return token;
+    }
+
+    public String getTokenString() {
+        return tokenString;
+    }
+
+    public IDToken getIdToken() {
+        return idToken;
+    }
+
+    public String getIdTokenString() {
+        return idTokenString;
+    }
+}
@@ -0,0 +1,30 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface OAuth2Constants {
+
+    String CODE = "code";
+
+    String CLIENT_ID = "client_id";
+
+    String ERROR = "error";
+
+    String ERROR_DESCRIPTION = "error_description";
+
+    String REDIRECT_URI = "redirect_uri";
+
+    String SCOPE = "scope";
+
+    String STATE = "state";
+
+    String GRANT_TYPE = "grant_type";
+
+    String RESPONSE_TYPE = "response_type";
+
+    String REFRESH_TOKEN = "refresh_token";
+
+}
+
+
@@ -0,0 +1,64 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class OAuthErrorException extends Exception {
+    public static final String INVALID_REQUEST = "invalid_request";
+    public static final String INVALID_CLIENT = "invalid_client";
+    public static final String INVALID_GRANT = "invalid_grant";
+    public static final String INVALID_SCOPE = "invalid_grant";
+    public static final String UNAUTHORIZED_CLIENT = "unauthorized_client";
+    public static final String UNSUPPORTED_GRANT_TYPE = "unsupported_grant_type";
+
+    public OAuthErrorException(String error, String description, String message, Throwable cause) {
+        super(message, cause);
+        this.error = error;
+        this.description = description;
+    }
+    public OAuthErrorException(String error, String description, String message) {
+        super(message);
+        this.error = error;
+        this.description = description;
+    }
+    public OAuthErrorException(String error, String description) {
+        super(description);
+        this.error = error;
+        this.description = description;
+    }
+    public OAuthErrorException(String error, String description, Throwable cause) {
+        super(description, cause);
+        this.error = error;
+        this.description = description;
+    }
+
+    public OAuthErrorException(String error) {
+        super(error);
+        this.error = error;
+    }
+    public OAuthErrorException(String error, Throwable cause) {
+        super(error, cause);
+        this.error = error;
+    }
+
+
+    protected String error;
+    protected String description;
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+}
@@ -2,7 +2,7 @@ package org.keycloak;

 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.crypto.RSAProvider;
-import org.keycloak.representations.SkeletonKeyToken;
+import org.keycloak.representations.AccessToken;

 import java.io.IOException;
 import java.security.PublicKey;
@@ -12,34 +12,40 @@ import java.security.PublicKey;
 * @version $Revision: 1 $
 */
 public class RSATokenVerifier {
+    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm) throws VerificationException {
+        return verifyToken(tokenString, realmKey, realm, true);
+    }

-    public static SkeletonKeyToken verifyToken(String tokenString, PublicKey realmKey, String realm) throws VerificationException {
+    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
        JWSInput input = new JWSInput(tokenString);
-        boolean verified = false;
-        try {
-            verified = RSAProvider.verify(input, realmKey);
-        } catch (Exception ignore) {
+        if (!isPublicKeyValid(input, realmKey)) throw new VerificationException("Invalid token signature.");

-        }
-        if (!verified) throw new VerificationException("Token signature not validated");
-
-        SkeletonKeyToken token = null;
+        AccessToken token;
        try {
-            token = input.readJsonContent(SkeletonKeyToken.class);
+            token = input.readJsonContent(AccessToken.class);
        } catch (IOException e) {
-            throw new VerificationException(e);
-        }
-        if (!token.isActive()) {
-            throw new VerificationException("Token is not active.");
+            throw new VerificationException("Couldn't parse token signature", e);
        }
        String user = token.getSubject();
        if (user == null) {
-            throw new VerificationException("Token user was null");
+            throw new VerificationException("Token user was null.");
        }
        if (!realm.equals(token.getAudience())) {
-            throw new VerificationException("Token audience doesn't match domain");
+            throw new VerificationException("Token audience doesn't match domain.");

        }
+        if (checkActive && !token.isActive()) {
+            throw new VerificationException("Token is not active.");
+        }
+
        return token;
    }
+
+    private static boolean isPublicKeyValid(JWSInput input, PublicKey realmKey) throws VerificationException {
+        try {
+            return RSAProvider.verify(input, realmKey);
+        } catch (Exception e) {
+            throw new VerificationException("Token signature not validated.", e);
+        }
+    }
 }
@@ -6,6 +6,12 @@ package org.keycloak;
 */
 public interface ServiceUrlConstants {

-    public static final String TOKEN_SERVICE_LOGIN_PATH = "/rest/realms/{realm-name}/tokens/login";
-    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/rest/realms/{realm-name}/tokens/access/codes";
+    public static final String TOKEN_SERVICE_LOGIN_PATH = "/realms/{realm-name}/tokens/login";
+    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/realms/{realm-name}/tokens/access/codes";
+    public static final String TOKEN_SERVICE_REFRESH_PATH = "/realms/{realm-name}/tokens/refresh";
+    public static final String TOKEN_SERVICE_LOGOUT_PATH = "/realms/{realm-name}/tokens/logout";
+    public static final String TOKEN_SERVICE_DIRECT_GRANT_PATH = "/realms/{realm-name}/tokens/grants/access";
+    public static final String ACCOUNT_SERVICE_PATH = "/realms/{realm-name}/account";
+    public static final String REALM_INFO_PATH = "/realms/{realm-name}";
+
 }
				`@@ -0,0 +1 @@`
				`org.keycloak.audit.email.EmailAuditListenerFactory`
				`@@ -0,0 +1 @@`
				`org.keycloak.audit.log.JBossLoggingAuditListenerFactory`
				`@@ -0,0 +1 @@`
				`org.keycloak.audit.jpa.JpaAuditProviderFactory`
				`@@ -0,0 +1 @@`
				`org.keycloak.audit.mongo.MongoAuditProviderFactory`
				`@@ -0,0 +1 @@`
				`org.keycloak.authentication.AuthenticationSpi`
				`@@ -0,0 +1 @@`
				`org.keycloak.authentication.picketlink.PicketlinkAuthenticationProviderFactory`