Set version to 1.0-beta-3

KEYCLOAK-534 Fix MS-SQL, Oracle and Sybase

admin-ui-styles/pom.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-3</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui-styles</artifactId>
-	<name>Keycloak Admin UI Styles</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>

admin-ui-styles/src/main/resources/META-INF/resources/admin-ui/css/reset.css

@@ -1,71 +0,0 @@
-/* http://meyerweb.com/eric/tools/css/reset/ 
-   v2.0 | 20110126
-   License: none (public domain)
-*/
-
-html, body, div, span, applet, object, iframe,
-h1, h2, h3, h4, h5, h6, p, blockquote, pre,
-a, abbr, acronym, address, big, cite, code,
-del, dfn, em, img, ins, kbd, q, s, samp,
-small, strike, strong, sub, sup, tt, var,
-b, u, i, center,
-dl, dt, dd, ol, ul, li,
-fieldset, form, label, legend,
-table, caption, tbody, tfoot, thead, tr, th, td,
-article, aside, canvas, details, embed, 
-figure, figcaption, footer, header, hgroup, 
-menu, nav, output, ruby, section, summary,
-time, mark, audio, video {
-	margin: 0;
-	padding: 0;
-	border: 0;
-	font-size: 100%;
-	font: inherit;
-	vertical-align: baseline;
-}
-/* HTML5 display-role reset for older browsers */
-article, aside, details, figcaption, figure, 
-footer, header, hgroup, menu, nav, section {
-	display: block;
-}
-body {
-	line-height: 1;
-}
-ol, ul {
-	list-style: none;
-}
-blockquote, q {
-	quotes: none;
-}
-blockquote:before, blockquote:after,
-q:before, q:after {
-	content: '';
-	content: none;
-}
-table {
-	border-collapse: collapse;
-	border-spacing: 0;
-}
-
-/* Clearfix */
-
-.clearfix:after {
-	content: ".";
-	display: block;
-	clear: both;
-	visibility: hidden;
-	line-height: 0;
-	height: 0;
-}
- 
-.clearfix {
-	display: inline-block;
-}
- 
-html[xmlns] .clearfix {
-	display: block;
-}
- 
-* html .clearfix {
-	height: 1%;
-}

admin-ui-styles/src/main/resources/META-INF/resources/admin-ui/img/icon-sidebar-active.svg

@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="23px" height="14px" viewBox="0 0 23 14" enable-background="new 0 0 23 14" xml:space="preserve">
-<polyline fill="none" stroke="#009AD8" stroke-miterlimit="10" points="1,13 7,7 1,1 "/>
-</svg>

admin-ui-styles/src/main/resources/META-INF/resources/admin-ui/img/sprite-arrow-down.svg

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="22px" height="52px" viewBox="0 0 22 52" enable-background="new 0 0 22 52" xml:space="preserve">
-<polygon fill="#828487" points="11,16 6.818,11.818 7.525,11.111 11,14.586 14.475,11.111 15.182,11.818 "/>
-<polygon fill="#DBDADA" points="11,42 6.818,37.818 7.525,37.111 11,40.586 14.475,37.111 15.182,37.818 "/>
-</svg>

admin-ui-styles/src/main/resources/META-INF/web-fragment.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>

admin-ui/pom.xml

@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-3</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui</artifactId>
-	<name>Keycloak Admin UI</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>

admin-ui/src/main/resources/META-INF/resources/admin/index_mock.html

@@ -1,192 +0,0 @@
-<!doctype html>
-<html lang="en">
-
-<head>
-    <style>
-        .mock_view {
-            padding: 2em 2em;
-        }
-
-    </style>
-
-    <meta charset="utf-8">
-    <title>Keycloak Admin Console</title>
-
-    <link rel="icon" href="/auth/admin-ui/img/favicon.ico">
-
-    <!-- Frameworks -->
-    <!--link rel="stylesheet" href="/auth/admin-ui/bootstrap/css/bootstrap.css"-->
-    <link rel="stylesheet" href="/auth/admin-ui/patternfly/css/patternfly.css">
-
-    <!-- Page styles -->
-    <link rel="stylesheet" href="/auth/admin-ui/css/admin-console.css">
-    <link href="lib/select2-3.4.1/select2.css" rel="stylesheet">
-
-    <script src="lib/jquery/jquery-1.10.2.js" type="text/javascript"></script>
-    <script src="lib/select2-3.4.1/select2.js" type="text/javascript"></script>
-
-    <script src="lib/angular/angular.js"></script>
-    <script src="lib/angular/angular-resource.js"></script>
-    <script src="lib/angular/ui-bootstrap-tpls-0.4.0.js"></script>
-
-    <script src="lib/jquery/jquery.idletimer.js" type="text/javascript"></script>
-    <script src="lib/jquery/jquery.idletimeout.js" type="text/javascript"></script>
-    <script src="lib/angular/select2.js" type="text/javascript"></script>
-    <script src="lib/fileupload/angular-file-upload.min.js"></script>     <!--
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/dropdown.js"></script>
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/tooltip.js"></script>
-    -->
-    <script src="/auth/admin-ui/js/bootstrap-tokenfield.js"></script>
-
-    <script src="/auth/admin-ui/bootstrap/js/bootstrap.js"></script>
-
-    <script src="js/app.js"></script>
-    <script src="js/controllers/realm.js"></script>
-    <script src="js/controllers/applications.js"></script>
-    <script src="js/controllers/oauth-clients.js"></script>
-    <script src="js/controllers/users.js"></script>
-    <script src="js/loaders.js"></script>
-    <script src="js/services.js"></script>
-
-    <style>
-        [ng\:cloak], [ng-cloak], .ng-cloak {
-            display: none !important;
-        }
-    </style>
-</head>
-
-<body class="admin-console" data-ng-controller="GlobalCtrl" ng-cloak>
-<div id="idletimeout">
-    You will be logged off in <strong><span></span> seconds</strong> due to inactivity.
-    <a id="idletimeout-resume" href="#">Click here to continue using this web page</a>.
-</div>
-
-
-<div class="feedback-aligner" data-ng-show="notification" data-ng-click="notification = null">
-    <div class="alert alert-{{notification.type}}"><strong>{{notification.header}}</strong> {{notification.message}}</div>
-</div>
-
-<header class="navbar navbar-default navbar-pf navbar-main header">
-    <nav id="kc-navigation" class="navbar" role="navigation">
-        <div class="navbar-header">
-	        	<div class="container">
-		            <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse-1">
-		                <span class="sr-only">Toggle navigation</span>
-		                <span class="icon-bar"></span>
-		                <span class="icon-bar"></span>
-		                <span class="icon-bar"></span>
-		            </button>
-		            <h1 class="navbar-title"><Strong>KeyCloak</Strong> Central Login</h1>
-	        	</div>
-        </div>
-        <div class="collapse navbar-collapse navbar-collapse-1">
-        		<div class="container">
-		            <ul class="nav navbar-nav navbar-utility" data-ng-show="auth.loggedIn">
-		                <li class="dropdown">
-		                    <a data-toggle="dropdown" class="dropdown-toggle" href="#">
-		                        <span class="pficon pficon-user"></span>
-		                        {{auth.user.displayName}}<b class="caret"></b>
-		                    </a>
-		                    <ul class="dropdown-menu">
-		                        <li><a href="/auth/rest/realms/keycloak-admin/account?referrer=admin-console">Manage Account</a></li>
-		                        <li class="separator"><a href="/auth/rest/admin/logout">Sign Out</a></li>
-		                    </ul>
-		                </li>
-		            </ul>
-		            <ul class="nav navbar-nav navbar-primary persistent-secondary" data-ng-controller="RealmDropdownCtrl">
-		                <li class="dropdown context" data-ng-show="showNav()">
-		                    <a href="#" class="dropdown-toggle" data-toggle="dropdown">
-		                        Realm: {{current.realm.id}}
-		                        <b class="caret"></b>
-		                    </a>
-		                    <ul class="dropdown-menu">
-		                        <li data-ng-repeat="realm in current.realms">
-		                            <a href="" ng-click="changeRealm(realm.id)" >{{realm.id}}</a>
-		                        </li>
-		                    </ul>
-		                </li>
-		
-		
-		                <!--------------------------------------->
-		                <li class="active">
-		                    <a href="#">Settings</a>
-		                    <ul class="nav navbar-nav navbar-persistent">
-		                        <li class="active">
-		                            <a href="#">General</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Roles</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Default Roles</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Credentials</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Token</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Keys</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Email</a>
-		                        </li>
-		                    </ul>
-		                </li>
-		                <li>
-		                    <a href="#">User</a>
-		                </li>
-		                <li>
-		                    <a href="#">Applications</a>
-		                </li>
-		                <li>
-		                    <a href="#">OAuth Clients</a>
-		                </li>
-		                <!--------------------------------------->
-		
-		
-		                <li class="active pull-right" data-ng-show="auth.loggedIn">
-		                    <a class="button primary" href="#/create/realm" data-ng-class="path[0] == 'create' && path[1] == 'realm' && 'active'"
-		                       data-ng-show="auth.loggedIn">Add Realm</a>
-		                </li>
-		            </ul>
-        		</div>
-        </div>
-    </nav>
-</header>
-
-<div class="container">
-    <div class="mock_view" data-ng-view id="view"></div>
-    <div id="loading" class="loading-backdrop">
-        <div class="loading">
-            <span>Loading...</span>
-        </div>
-    </div>
-</div>
-
-<script type="text/javascript">
-    $.idleTimeout('#idletimeout', '#idletimeout a', {
-        idleAfter: 300,
-        pollingInterval: 60,
-        keepAliveURL: '/auth/rest/admin/keepalive',
-        serverResponseEquals: '',
-        failedRequests: 1,
-        onTimeout: function(){
-            $(this).slideUp();
-            window.location = "/auth/rest/admin/logout";
-        },
-        onIdle: function(){
-            $(this).slideDown(); // show the warning bar
-        },
-        onCountdown: function( counter ){
-            $(this).find("span").html( counter ); // update the counter
-        },
-        onResume: function(){
-            $(this).slideUp(); // hide the warning bar
-        }
-    });
-</script>
-
-</body>
-</html>

admin-ui/src/main/resources/META-INF/resources/admin/templates/kc-modal.html

@@ -1,14 +0,0 @@
-<div class="modal-dialog" tabindex="-1" role="dialog">
-    <div class="modal-content">
-        <div class="modal-header">
-            <button type="button" class="close" data-dismiss="modal" aria-hidden="true">
-                <span class="pficon pficon-close"></span>
-            </button>
-            <h4 class="modal-title" id="myModalLabel">{{ title }}</h4>
-        </div>
-        <div class="modal-body"><p ng-bind-html-unsafe="message"></p></div>
-        <div class="modal-footer">
-            <button ng-repeat="btn in buttons" ng-click="close(btn.result)" class="" ng-class="btn.cssClass">{{ btn.label }}</button>
-        </div>
-    </div>
-</div>

admin-ui/src/main/resources/META-INF/web-fragment.xml

@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>

audit/api/pom.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-api</artifactId>
+    <name>Keycloak Audit API</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>

audit/api/src/main/java/org/keycloak/audit/Audit.java

@@ -0,0 +1,149 @@
+package org.keycloak.audit;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+
+import java.util.HashMap;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Audit {
+
+    private static final Logger log = Logger.getLogger(Audit.class);
+
+    private List<AuditListener> listeners;
+    private Event event;
+
+    public Audit(List<AuditListener> listeners, RealmModel realm, String ipAddress) {
+        this.listeners = listeners;
+        this.event = new Event();
+
+        realm(realm);
+        ipAddress(ipAddress);
+    }
+
+    Audit() {
+    }
+
+    public Audit realm(RealmModel realm) {
+        event.setRealmId(realm.getId());
+        return this;
+    }
+
+    public Audit realm(String realmId) {
+        event.setRealmId(realmId);
+        return this;
+    }
+
+    public Audit client(ClientModel client) {
+        event.setClientId(client.getClientId());
+        return this;
+    }
+
+    public Audit client(String clientId) {
+        event.setClientId(clientId);
+        return this;
+    }
+
+    public Audit user(UserModel user) {
+        event.setUserId(user.getId());
+        return this;
+    }
+
+    public Audit user(String userId) {
+        event.setUserId(userId);
+        return this;
+    }
+
+    public Audit session(UserSessionModel session) {
+        event.setSessionId(session.getId());
+        return this;
+    }
+
+    public Audit session(String sessionId) {
+        event.setSessionId(sessionId);
+        return this;
+    }
+
+    public Audit ipAddress(String ipAddress) {
+        event.setIpAddress(ipAddress);
+        return this;
+    }
+
+    public Audit event(EventType e) {
+        event.setEvent(e);
+        return this;
+    }
+
+    public Audit detail(String key, String value) {
+        if (value == null || value.equals("")) {
+            return this;
+        }
+
+        if (event.getDetails() == null) {
+            event.setDetails(new HashMap<String, String>());
+        }
+        event.getDetails().put(key, value);
+        return this;
+    }
+
+    public Audit removeDetail(String key) {
+        if (event.getDetails() != null) {
+            event.getDetails().remove(key);
+        }
+        return this;
+    }
+
+    public Event getEvent() {
+        return event;
+    }
+
+    public void success() {
+        send();
+    }
+
+    public void error(String error) {
+        event.setEvent(EventType.valueOf(event.getEvent().name() + "_ERROR"));
+        event.setError(error);
+        send();
+    }
+
+    public Audit clone() {
+        Audit clone = new Audit();
+        clone.listeners = listeners;
+        clone.event = event.clone();
+        return clone;
+    }
+
+    public Audit reset() {
+        Event old = event;
+
+        event = new Event();
+        event.setRealmId(old.getRealmId());
+        event.setIpAddress(old.getIpAddress());
+        event.setClientId(old.getClientId());
+        event.setUserId(old.getUserId());
+
+        return this;
+    }
+
+    private void send() {
+        event.setTime(System.currentTimeMillis());
+
+        if (listeners != null) {
+            for (AuditListener l : listeners) {
+                try {
+                    l.onEvent(event);
+                } catch (Throwable t) {
+                    log.error("Failed to send event to " + l, t);
+                }
+            }
+        }
+    }
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditListener.java

@@ -0,0 +1,12 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditListener extends Provider {
+
+    public void onEvent(Event event);
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditListenerFactory.java

@@ -0,0 +1,10 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditListenerFactory extends ProviderFactory<AuditListener> {
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditListenerSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuditListenerSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "audit-listener";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuditListener.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuditListenerFactory.class;
+    }
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditProvider.java

@@ -0,0 +1,16 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditProvider extends AuditListener {
+
+    public EventQuery createQuery();
+
+    public void clear();
+
+    public void clear(String realmId);
+
+    public void clear(String realmId, long olderThan);
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditProviderFactory.java

@@ -0,0 +1,10 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface AuditProviderFactory extends ProviderFactory<AuditProvider> {
+
+}

audit/api/src/main/java/org/keycloak/audit/AuditProviderSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.audit;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuditProviderSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "audit";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuditProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuditProviderFactory.class;
+    }
+
+}

audit/api/src/main/java/org/keycloak/audit/Details.java

@@ -0,0 +1,22 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Details {
+
+    String EMAIL = "email";
+    String PREVIOUS_EMAIL = "previous_email";
+    String UPDATED_EMAIL = "updated_email";
+    String CODE_ID = "code_id";
+    String REDIRECT_URI = "redirect_uri";
+    String RESPONSE_TYPE = "response_type";
+    String AUTH_METHOD = "auth_method";
+    String REGISTER_METHOD = "register_method";
+    String USERNAME = "username";
+    String REMEMBER_ME = "remember_me";
+    String TOKEN_ID = "token_id";
+    String REFRESH_TOKEN_ID = "refresh_token_id";
+    String UPDATED_REFRESH_TOKEN_ID = "updated_refresh_token_id";
+
+}

audit/api/src/main/java/org/keycloak/audit/Errors.java

@@ -0,0 +1,41 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Errors {
+
+    String REALM_DISABLED = "realm_disabled";
+
+    String CLIENT_NOT_FOUND = "client_not_found";
+    String CLIENT_DISABLED = "client_disabled";
+    String INVALID_CLIENT_CREDENTIALS = "invalid_client_credentials";
+
+    String USER_NOT_FOUND = "user_not_found";
+    String USER_DISABLED = "user_disabled";
+    String USER_TEMPORARILY_DISABLED = "user_temporarily_disabled";
+    String INVALID_USER_CREDENTIALS = "invalid_user_credentials";
+
+    String USERNAME_MISSING = "username_missing";
+    String USERNAME_IN_USE = "username_in_use";
+
+    String INVALID_REDIRECT_URI = "invalid_redirect_uri";
+    String INVALID_CODE = "invalid_code";
+    String INVALID_TOKEN = "invalid_token";
+    String INVALID_REGISTRATION = "invalid_registration";
+    String INVALID_FORM = "invalid_form";
+
+    String REGISTRATION_DISABLED = "registration_disabled";
+
+    String REJECTED_BY_USER = "rejected_by_user";
+
+    String NOT_ALLOWED = "not_allowed";
+
+    String SOCIAL_PROVIDER_NOT_FOUND = "social_provider_not_found";
+    String SOCIAL_ID_IN_USE = "social_id_in_use";
+
+    String USER_NOT_LOGGED_IN = "user_not_logged_in";
+    String USER_SESSION_NOT_FOUND = "user_session_not_found";
+
+
+}

audit/api/src/main/java/org/keycloak/audit/Event.java

@@ -0,0 +1,115 @@
+package org.keycloak.audit;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Event {
+
+    private long time;
+
+    private EventType event;
+
+    private String realmId;
+
+    private String clientId;
+
+    private String userId;
+
+    private String sessionId;
+
+    private String ipAddress;
+
+    private String error;
+
+    private Map<String, String> details;
+
+    public long getTime() {
+        return time;
+    }
+
+    public void setTime(long time) {
+        this.time = time;
+    }
+
+    public EventType getEvent() {
+        return event;
+    }
+
+    public void setEvent(EventType event) {
+        this.event = event;
+    }
+
+    public String getRealmId() {
+        return realmId;
+    }
+
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
+
+    public String getSessionId() {
+        return sessionId;
+    }
+
+    public void setSessionId(String sessionId) {
+        this.sessionId = sessionId;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public void setIpAddress(String ipAddress) {
+        this.ipAddress = ipAddress;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public Map<String, String> getDetails() {
+        return details;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
+
+    public Event clone() {
+        Event clone = new Event();
+        clone.time = time;
+        clone.event = event;
+        clone.realmId = realmId;
+        clone.clientId = clientId;
+        clone.userId = userId;
+        clone.sessionId = sessionId;
+        clone.ipAddress = ipAddress;
+        clone.error = error;
+        clone.details = details != null ? new HashMap<String, String>(details) : null;
+        return clone;
+    }
+
+}

audit/api/src/main/java/org/keycloak/audit/EventQuery.java

@@ -0,0 +1,26 @@
+package org.keycloak.audit;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface EventQuery {
+
+    public EventQuery event(EventType... events);
+
+    public EventQuery realm(String realmId);
+
+    public EventQuery client(String clientId);
+
+    public EventQuery user(String userId);
+
+    public EventQuery ipAddress(String ipAddress);
+
+    public EventQuery firstResult(int result);
+
+    public EventQuery maxResults(int results);
+
+    public List<Event> getResultList();
+
+}

audit/api/src/main/java/org/keycloak/audit/EventType.java

@@ -0,0 +1,42 @@
+package org.keycloak.audit;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public enum EventType {
+
+    LOGIN,
+    LOGIN_ERROR,
+    REGISTER,
+    REGISTER_ERROR,
+    LOGOUT,
+    LOGOUT_ERROR,
+    CODE_TO_TOKEN,
+    CODE_TO_TOKEN_ERROR,
+    REFRESH_TOKEN,
+    REFRESH_TOKEN_ERROR,
+    SOCIAL_LINK,
+    SOCIAL_LINK_ERROR,
+    REMOVE_SOCIAL_LINK,
+    REMOVE_SOCIAL_LINK_ERROR,
+
+    UPDATE_EMAIL,
+    UPDATE_EMAIL_ERROR,
+    UPDATE_PROFILE,
+    UPDATE_PROFILE_ERROR,
+    UPDATE_PASSWORD,
+    UPDATE_PASSWORD_ERROR,
+    UPDATE_TOTP,
+    UPDATE_TOTP_ERROR,
+    VERIFY_EMAIL,
+    VERIFY_EMAIL_ERROR,
+
+    REMOVE_TOTP,
+    REMOVE_TOTP_ERROR,
+
+    SEND_VERIFY_EMAIL,
+    SEND_VERIFY_EMAIL_ERROR,
+    SEND_RESET_PASSWORD,
+    SEND_RESET_PASSWORD_ERROR
+
+}

audit/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1,2 @@
+org.keycloak.audit.AuditProviderSpi
+org.keycloak.audit.AuditListenerSpi

audit/email/pom.xml

@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-email</artifactId>
+    <name>Keycloak Audit Email Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-email-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>

audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListener.java

@@ -0,0 +1,57 @@
+package org.keycloak.audit.email;
+
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventType;
+import org.keycloak.email.EmailException;
+import org.keycloak.email.EmailProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+
+import java.util.Date;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class EmailAuditListener implements AuditListener {
+
+    private static final Logger log = Logger.getLogger(EmailAuditListener.class);
+
+    private KeycloakSession keycloakSession;
+    private EmailProvider emailProvider;
+    private Set<EventType> includedEvents;
+
+    public EmailAuditListener(KeycloakSession keycloakSession, EmailProvider emailProvider, Set<EventType> includedEvents) {
+        this.keycloakSession = keycloakSession;
+        this.emailProvider = emailProvider;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            if (event.getRealmId() != null && event.getUserId() != null) {
+                RealmModel realm = keycloakSession.getRealm(event.getRealmId());
+                UserModel user = realm.getUserById(event.getUserId());
+                if (user != null && user.getEmail() != null && user.isEmailVerified()) {
+                    try {
+                        emailProvider.setRealm(realm).setUser(user).sendEvent(event);
+                    } catch (EmailException e) {
+                        log.error("Failed to send event mail", e);
+                    }
+                }
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListenerFactory.java

@@ -0,0 +1,62 @@
+package org.keycloak.audit.email;
+
+import org.keycloak.Config;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.AuditListenerFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.email.EmailProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.provider.ProviderSession;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class EmailAuditListenerFactory implements AuditListenerFactory {
+
+    private static final Set<EventType> SUPPORTED_EVENTS = new HashSet<EventType>();
+    static {
+        Collections.addAll(SUPPORTED_EVENTS, EventType.LOGIN_ERROR, EventType.UPDATE_PASSWORD, EventType.REMOVE_TOTP, EventType.UPDATE_TOTP);
+    }
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditListener create(ProviderSession providerSession) {
+        KeycloakSession keycloakSession = providerSession.getProvider(KeycloakSession.class);
+        EmailProvider emailProvider = providerSession.getProvider(EmailProvider.class);
+        return new EmailAuditListener(keycloakSession, emailProvider, includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            includedEvents.addAll(SUPPORTED_EVENTS);
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "email";
+    }
+
+}

audit/email/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -0,0 +1 @@
+org.keycloak.audit.email.EmailAuditListenerFactory

audit/jboss-logging/pom.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-jboss-logging</artifactId>
+    <name>Keycloak Audit JBoss Logging Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>

audit/jboss-logging/src/main/java/org/keycloak/audit/log/JBossLoggingAuditListener.java

@@ -0,0 +1,66 @@
+package org.keycloak.audit.log;
+
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.Event;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JBossLoggingAuditListener implements AuditListener {
+
+    private final Logger logger;
+
+    public JBossLoggingAuditListener(Logger logger) {
+        this.logger = logger;
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        Logger.Level level = event.getError() != null ? Logger.Level.WARN : Logger.Level.INFO;
+
+        if (logger.isEnabled(level)) {
+            StringBuilder sb = new StringBuilder();
+
+            sb.append("event=");
+            sb.append(event.getEvent());
+            sb.append(", realmId=");
+            sb.append(event.getRealmId());
+            sb.append(", clientId=");
+            sb.append(event.getClientId());
+            sb.append(", userId=");
+            sb.append(event.getUserId());
+            sb.append(", ipAddress=");
+            sb.append(event.getIpAddress());
+
+            if (event.getError() != null) {
+                sb.append(", error=");
+                sb.append(event.getError());
+            }
+
+            if (event.getDetails() != null) {
+                for (Map.Entry<String, String> e : event.getDetails().entrySet()) {
+                    sb.append(", ");
+                    sb.append(e.getKey());
+                    if (e.getValue() == null || e.getValue().indexOf(' ') == -1) {
+                        sb.append("=");
+                        sb.append(e.getValue());
+                    } else {
+                        sb.append("='");
+                        sb.append(e.getValue());
+                        sb.append("'");
+                    }
+                }
+            }
+
+            logger.log(level, sb.toString());
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

audit/jboss-logging/src/main/java/org/keycloak/audit/log/JBossLoggingAuditListenerFactory.java

@@ -0,0 +1,36 @@
+package org.keycloak.audit.log;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditListener;
+import org.keycloak.audit.AuditListenerFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JBossLoggingAuditListenerFactory implements AuditListenerFactory {
+
+    public static final String ID = "jboss-logging";
+
+    private static final Logger logger = Logger.getLogger("org.keycloak.audit");
+
+    @Override
+    public AuditListener create(ProviderSession providerSession) {
+        return new JBossLoggingAuditListener(logger);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}

audit/jboss-logging/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -0,0 +1 @@
+org.keycloak.audit.log.JBossLoggingAuditListenerFactory

audit/jpa/pom.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-jpa</artifactId>
+    <name>Keycloak Audit JPA Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-tests</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+</project>

audit/jpa/src/main/java/org/keycloak/audit/jpa/EventEntity.java

@@ -0,0 +1,115 @@
+package org.keycloak.audit.jpa;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Entity
+public class EventEntity {
+
+    @Id
+    private String id;
+
+    private long time;
+
+    private String event;
+
+    private String realmId;
+
+    private String clientId;
+
+    private String userId;
+
+    private String sessionId;
+
+    private String ipAddress;
+
+    private String error;
+
+    @Column(length = 2550)
+    private String detailsJson;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public long getTime() {
+        return time;
+    }
+
+    public void setTime(long time) {
+        this.time = time;
+    }
+
+    public String getEvent() {
+        return event;
+    }
+
+    public void setEvent(String event) {
+        this.event = event;
+    }
+
+    public String getRealmId() {
+        return realmId;
+    }
+
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getUserId() {
+        return userId;
+    }
+
+    public void setUserId(String userId) {
+        this.userId = userId;
+    }
+
+    public String getSessionId() {
+        return sessionId;
+    }
+
+    public void setSessionId(String sessionId) {
+        this.sessionId = sessionId;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public void setIpAddress(String ipAddress) {
+        this.ipAddress = ipAddress;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public String getDetailsJson() {
+        return detailsJson;
+    }
+
+    public void setDetailsJson(String detailsJson) {
+        this.detailsJson = detailsJson;
+    }
+
+}

audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProvider.java

@@ -0,0 +1,122 @@
+package org.keycloak.audit.jpa;
+
+import org.codehaus.jackson.map.ObjectMapper;
+import org.codehaus.jackson.type.TypeReference;
+import org.jboss.logging.Logger;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import javax.persistence.EntityManager;
+import javax.persistence.EntityTransaction;
+import java.io.IOException;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProvider implements AuditProvider {
+
+    private static final ObjectMapper mapper = new ObjectMapper();
+    private static final TypeReference<Map<String, String>> mapType = new TypeReference<Map<String, String>>() {
+    };
+    private static final Logger logger = Logger.getLogger(JpaAuditProvider.class);
+
+    private EntityManager em;
+    private EntityTransaction tx;
+    private Set<EventType> includedEvents;
+
+    public JpaAuditProvider(EntityManager em, Set<EventType> includedEvents) {
+        this.em = em;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public EventQuery createQuery() {
+        return new JpaEventQuery(em);
+    }
+
+    @Override
+    public void clear() {
+        beginTx();
+        em.createQuery("delete from EventEntity").executeUpdate();
+    }
+
+    @Override
+    public void clear(String realmId) {
+        beginTx();
+        em.createQuery("delete from EventEntity where realmId = :realmId").setParameter("realmId", realmId).executeUpdate();
+    }
+
+    @Override
+    public void clear(String realmId, long olderThan) {
+        beginTx();
+        em.createQuery("delete from EventEntity where realmId = :realmId and time < :time").setParameter("realmId", realmId).setParameter("time", olderThan).executeUpdate();
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            beginTx();
+            em.persist(convert(event));
+        }
+    }
+
+    @Override
+    public void close() {
+        if (tx != null) {
+            tx.commit();
+        }
+
+        em.close();
+    }
+
+    private void beginTx() {
+        if (tx == null) {
+            tx = em.getTransaction();
+            tx.begin();
+        }
+    }
+
+    static EventEntity convert(Event o) {
+        EventEntity e = new EventEntity();
+        e.setId(UUID.randomUUID().toString());
+        e.setTime(o.getTime());
+        e.setEvent(o.getEvent().toString());
+        e.setRealmId(o.getRealmId());
+        e.setClientId(o.getClientId());
+        e.setUserId(o.getUserId());
+        e.setSessionId(o.getSessionId());
+        e.setIpAddress(o.getIpAddress());
+        e.setError(o.getError());
+        try {
+            e.setDetailsJson(mapper.writeValueAsString(o.getDetails()));
+        } catch (IOException ex) {
+            logger.error("Failed to write log details", ex);
+        }
+        return e;
+    }
+
+    static Event convert(EventEntity o) {
+        Event e = new Event();
+        e.setTime(o.getTime());
+        e.setEvent(EventType.valueOf(o.getEvent()));
+        e.setRealmId(o.getRealmId());
+        e.setClientId(o.getClientId());
+        e.setUserId(o.getUserId());
+        e.setSessionId(o.getSessionId());
+        e.setIpAddress(o.getIpAddress());
+        e.setError(o.getError());
+        try {
+            Map<String, String> details = mapper.readValue(o.getDetailsJson(), mapType);
+            e.setDetails(details);
+        } catch (IOException ex) {
+            logger.error("Failed to read log details", ex);
+        }
+        return e;
+    }
+
+}

audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java

@@ -0,0 +1,63 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderSession;
+import org.keycloak.util.JpaUtils;
+
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProviderFactory implements AuditProviderFactory {
+
+    public static final String ID = "jpa";
+    private EntityManagerFactory emf;
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditProvider create(ProviderSession providerSession) {
+        return new JpaAuditProvider(emf.createEntityManager(), includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        emf = Persistence.createEntityManagerFactory("jpa-keycloak-audit-store", JpaUtils.getHibernateProperties());
+
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            for (EventType i : EventType.values()) {
+                includedEvents.add(i);
+            }
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+        emf.close();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}

audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaEventQuery.java

@@ -0,0 +1,111 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import javax.persistence.criteria.CriteriaBuilder;
+import javax.persistence.criteria.CriteriaQuery;
+import javax.persistence.criteria.Predicate;
+import javax.persistence.criteria.Root;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaEventQuery implements EventQuery {
+
+    private final EntityManager em;
+    private final CriteriaBuilder cb;
+    private final CriteriaQuery<EventEntity> cq;
+    private final Root<EventEntity> root;
+    private final ArrayList<Predicate> predicates;
+    private Integer firstResult;
+    private Integer maxResults;
+
+    public JpaEventQuery(EntityManager em) {
+        this.em = em;
+
+        cb = em.getCriteriaBuilder();
+        cq = cb.createQuery(EventEntity.class);
+        root = cq.from(EventEntity.class);
+        predicates = new ArrayList<Predicate>(4);
+    }
+
+    @Override
+    public EventQuery event(EventType... events) {
+        List<String> eventStrings = new LinkedList<String>();
+        for (EventType e : events) {
+            eventStrings.add(e.toString());
+        }
+        predicates.add(root.get("event").in(eventStrings));
+        return this;
+    }
+
+    @Override
+    public EventQuery realm(String realmId) {
+        predicates.add(cb.equal(root.get("realmId"), realmId));
+        return this;
+    }
+
+    @Override
+    public EventQuery client(String clientId) {
+        predicates.add(cb.equal(root.get("clientId"), clientId));
+        return this;
+    }
+
+    @Override
+    public EventQuery user(String userId) {
+        predicates.add(cb.equal(root.get("userId"), userId));
+        return this;
+    }
+
+    @Override
+    public EventQuery ipAddress(String ipAddress) {
+        predicates.add(cb.equal(root.get("ipAddress"), ipAddress));
+        return this;
+    }
+
+    @Override
+    public EventQuery firstResult(int firstResult) {
+        this.firstResult = firstResult;
+        return this;
+    }
+
+    @Override
+    public EventQuery maxResults(int maxResults) {
+        this.maxResults = maxResults;
+        return this;
+    }
+
+    @Override
+    public List<Event> getResultList() {
+        if (!predicates.isEmpty()) {
+            cq.where(cb.and(predicates.toArray(new Predicate[predicates.size()])));
+        }
+
+        cq.orderBy(cb.desc(root.get("time")));
+
+        TypedQuery<EventEntity> query = em.createQuery(cq);
+
+        if (firstResult != null) {
+            query.setFirstResult(firstResult);
+        }
+
+        if (maxResults != null) {
+            query.setMaxResults(maxResults);
+        }
+
+        List<Event> events = new LinkedList<Event>();
+        for (EventEntity e : query.getResultList()) {
+            events.add(JpaAuditProvider.convert(e));
+        }
+
+        return events;
+    }
+
+}

audit/jpa/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -0,0 +1 @@
+org.keycloak.audit.jpa.JpaAuditProviderFactory

audit/jpa/src/test/java/org/keycloak/audit/jpa/JpaAuditProviderTest.java

@@ -0,0 +1,15 @@
+package org.keycloak.audit.jpa;
+
+import org.keycloak.audit.tests.AbstractAuditProviderTest;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaAuditProviderTest extends AbstractAuditProviderTest {
+
+    @Override
+    protected String getProviderId() {
+        return JpaAuditProviderFactory.ID;
+    }
+
+}

audit/jpa/src/test/resources/META-INF/persistence.xml

@@ -0,0 +1,22 @@
+<persistence xmlns="http://java.sun.com/xml/ns/persistence"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
+    version="1.0">
+    <persistence-unit name="jpa-keycloak-audit-store" transaction-type="RESOURCE_LOCAL">
+        <provider>org.hibernate.ejb.HibernatePersistence</provider>
+
+        <class>org.keycloak.audit.jpa.EventEntity</class>
+
+        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+
+        <properties>
+            <property name="hibernate.connection.url" value="jdbc:h2:mem:test"/>
+            <property name="hibernate.connection.driver_class" value="org.h2.Driver"/>
+            <property name="hibernate.connection.username" value="sa"/>
+            <property name="hibernate.connection.password" value=""/>
+            <property name="hibernate.hbm2ddl.auto" value="create-drop" />
+            <property name="hibernate.show_sql" value="false" />
+            <property name="hibernate.format_sql" value="true" />
+        </properties>
+    </persistence-unit>
+</persistence>

audit/mongo/pom.xml

@@ -0,0 +1,130 @@
+<?xml version="1.0"?>
+<project>
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-mongo</artifactId>
+    <name>Keycloak Audit Mongo Provider</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-tests</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+   </dependencies>
+
+    <properties>
+        <keycloak.audit.mongo.host>localhost</keycloak.audit.mongo.host>
+        <keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
+        <keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
+        <keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
+        <keycloak.audit.mongo.bindIp>127.0.0.1</keycloak.audit.mongo.bindIp>
+    </properties>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>1.6</source>
+                    <target>1.6</target>
+                </configuration>
+            </plugin>
+
+            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>test</id>
+                        <phase>integration-test</phase>
+                        <goals>
+                            <goal>test</goal>
+                        </goals>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <keycloak.audit.mongo.host>${keycloak.audit.mongo.host}</keycloak.audit.mongo.host>
+                                <keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
+                                <keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
+                                <keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
+                                <keycloak.audit.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.audit.mongo.bindIp>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>default-test</id>
+                        <configuration>
+                            <skip>true</skip>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+
+            <!-- Embedded mongo -->
+            <plugin>
+                <groupId>com.github.joelittlejohn.embedmongo</groupId>
+                <artifactId>embedmongo-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>start-mongodb</id>
+                        <phase>pre-integration-test</phase>
+                        <goals>
+                            <goal>start</goal>
+                        </goals>
+                        <configuration>
+                            <port>${keycloak.audit.mongo.port}</port>
+                            <logging>file</logging>
+                            <logFile>${project.build.directory}/mongodb.log</logFile>
+                            <bindIp>${keycloak.audit.mongo.bindIp}</bindIp>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>stop-mongodb</id>
+                        <phase>post-integration-test</phase>
+                        <goals>
+                            <goal>stop</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+
+        </plugins>
+    </build>
+</project>

audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProvider.java

@@ -0,0 +1,107 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBCollection;
+import com.mongodb.DBObject;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProvider implements AuditProvider {
+
+    private DBCollection audit;
+    private Set<EventType> includedEvents;
+
+    public MongoAuditProvider(DBCollection audit, Set<EventType> includedEvents) {
+        this.audit = audit;
+        this.includedEvents = includedEvents;
+    }
+
+    @Override
+    public EventQuery createQuery() {
+        return new MongoEventQuery(audit);
+    }
+
+    @Override
+    public void clear() {
+        audit.remove(new BasicDBObject());
+    }
+
+    @Override
+    public void clear(String realmId) {
+        audit.remove(new BasicDBObject("realmId", realmId));
+    }
+
+    @Override
+    public void clear(String realmId, long olderThan) {
+        BasicDBObject q = new BasicDBObject();
+        q.put("realmId", realmId);
+        q.put("time", new BasicDBObject("$lt", olderThan));
+        audit.remove(q);
+    }
+
+    @Override
+    public void onEvent(Event event) {
+        if (includedEvents.contains(event.getEvent())) {
+            audit.insert(convert(event));
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    static DBObject convert(Event o) {
+        BasicDBObject e = new BasicDBObject();
+        e.put("time", o.getTime());
+        e.put("event", o.getEvent().toString());
+        e.put("realmId", o.getRealmId());
+        e.put("clientId", o.getClientId());
+        e.put("userId", o.getUserId());
+        e.put("sessionId", o.getSessionId());
+        e.put("ipAddress", o.getIpAddress());
+        e.put("error", o.getError());
+
+        BasicDBObject details = new BasicDBObject();
+        if (o.getDetails() != null) {
+            for (Map.Entry<String, String> entry : o.getDetails().entrySet()) {
+                details.put(entry.getKey(), entry.getValue());
+            }
+        }
+        e.put("details", details);
+
+        return e;
+    }
+
+    static Event convert(BasicDBObject o) {
+        Event e = new Event();
+        e.setTime(o.getLong("time"));
+        e.setEvent(EventType.valueOf(o.getString("event")));
+        e.setRealmId(o.getString("realmId"));
+        e.setClientId(o.getString("clientId"));
+        e.setUserId(o.getString("userId"));
+        e.setSessionId(o.getString("sessionId"));
+        e.setIpAddress(o.getString("ipAddress"));
+        e.setError(o.getString("error"));
+
+        BasicDBObject d = (BasicDBObject) o.get("details");
+        if (d != null) {
+            Map<String, String> details = new HashMap<String, String>();
+            for (Object k : d.keySet()) {
+                details.put((String) k, d.getString((String) k));
+            }
+            e.setDetails(details);
+        }
+
+        return e;
+    }
+
+}

audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java

@@ -0,0 +1,96 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import com.mongodb.WriteConcern;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderSession;
+
+import java.net.UnknownHostException;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProviderFactory implements AuditProviderFactory {
+
+    protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
+
+    public static final String ID = "mongo";
+    private MongoClient client;
+    private DB db;
+
+    private Set<EventType> includedEvents = new HashSet<EventType>();
+
+    @Override
+    public AuditProvider create(ProviderSession providerSession) {
+        return new MongoAuditProvider(db.getCollection("audit"), includedEvents);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        try {
+            String host = config.get("host", ServerAddress.defaultHost());
+            int port = config.getInt("port", ServerAddress.defaultPort());
+            String dbName = config.get("db", "keycloak-audit");
+            boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
+
+            String user = config.get("user");
+            String password = config.get("password");
+            if (user != null && password != null) {
+                MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
+            } else {
+                client = new MongoClient(host, port);
+            }
+
+            client.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
+            db = client.getDB(dbName);
+
+            if (clearOnStartup) {
+                db.getCollection("audit").drop();
+            }
+
+            logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
+        } catch (UnknownHostException e) {
+            throw new RuntimeException(e);
+        }
+
+        String[] include = config.getArray("include-events");
+        if (include != null) {
+            for (String i : include) {
+                includedEvents.add(EventType.valueOf(i.toUpperCase()));
+            }
+        } else {
+            for (EventType i : EventType.values()) {
+                includedEvents.add(i);
+            }
+        }
+
+        String[] exclude = config.getArray("exclude-events");
+        if (exclude != null) {
+            for (String e : exclude) {
+                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+        client.close();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}

audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoEventQuery.java

@@ -0,0 +1,93 @@
+package org.keycloak.audit.mongo;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBCollection;
+import com.mongodb.DBCursor;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventQuery;
+import org.keycloak.audit.EventType;
+
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoEventQuery implements EventQuery {
+
+    private Integer firstResult;
+    private Integer maxResults;
+    private DBCollection audit;
+    private final BasicDBObject query;
+
+    public MongoEventQuery(DBCollection audit) {
+        this.audit = audit;
+        query = new BasicDBObject();
+    }
+
+    @Override
+    public EventQuery event(EventType... events) {
+        List<String> eventStrings = new LinkedList<String>();
+        for (EventType e : events) {
+            eventStrings.add(e.toString());
+        }
+        query.put("event", new BasicDBObject("$in", eventStrings));
+        return this;
+    }
+
+    @Override
+    public EventQuery realm(String realmId) {
+        query.put("realmId", realmId);
+        return this;
+    }
+
+    @Override
+    public EventQuery client(String clientId) {
+        query.put("clientId", clientId);
+        return this;
+    }
+
+    @Override
+    public EventQuery user(String userId) {
+        query.put("userId", userId);
+        return this;
+    }
+
+    @Override
+    public EventQuery ipAddress(String ipAddress) {
+        query.put("ipAddress", ipAddress);
+        return this;
+    }
+
+    @Override
+    public EventQuery firstResult(int firstResult) {
+        this.firstResult = firstResult;
+        return this;
+    }
+
+    @Override
+    public EventQuery maxResults(int maxResults) {
+        this.maxResults = maxResults;
+        return this;
+    }
+
+    @Override
+    public List<Event> getResultList() {
+        DBCursor cur = audit.find(query).sort(new BasicDBObject("time", -1));
+        if (firstResult != null) {
+            cur.skip(firstResult);
+        }
+        if (maxResults != null) {
+            cur.limit(maxResults);
+        }
+
+        List<Event> events = new LinkedList<Event>();
+        while (cur.hasNext()) {
+            events.add(MongoAuditProvider.convert((BasicDBObject) cur.next()));
+        }
+
+        return events;
+    }
+
+}

audit/mongo/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -0,0 +1 @@
+org.keycloak.audit.mongo.MongoAuditProviderFactory

audit/mongo/src/test/java/org/keycloak/audit/mongo/MongoAuditProviderTest.java

@@ -0,0 +1,15 @@
+package org.keycloak.audit.mongo;
+
+import org.keycloak.audit.tests.AbstractAuditProviderTest;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoAuditProviderTest extends AbstractAuditProviderTest {
+
+    @Override
+    protected String getProviderId() {
+        return MongoAuditProviderFactory.ID;
+    }
+
+}

audit/pom.xml

@@ -0,0 +1,26 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+
+    <name>Audit Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.keycloak</groupId>
+    <artifactId>keycloak-audit-parent</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>api</module>
+        <module>email</module>
+        <module>jpa</module>
+        <module>jboss-logging</module>
+        <module>mongo</module>
+        <module>tests</module>
+    </modules>
+</project>

audit/tests/pom.xml

@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-audit-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-audit-tests</artifactId>
+    <name>Keycloak Audit Tests</name>
+    <description/>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

audit/tests/src/main/java/org/keycloak/audit/tests/AbstractAuditProviderTest.java

@@ -0,0 +1,139 @@
+package org.keycloak.audit.tests;
+
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.keycloak.Config;
+import org.keycloak.audit.AuditProvider;
+import org.keycloak.audit.AuditProviderFactory;
+import org.keycloak.audit.Event;
+import org.keycloak.audit.EventType;
+import org.keycloak.provider.ProviderFactory;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.ServiceLoader;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public abstract class AbstractAuditProviderTest {
+
+    private ProviderFactory<AuditProvider> factory;
+    private AuditProvider provider;
+
+    @Before
+    public void before() {
+        String providerId = getProviderId();
+        ServiceLoader<AuditProviderFactory> factories = ServiceLoader.load(AuditProviderFactory.class);
+        for (AuditProviderFactory f : factories) {
+            if (f.getId().equals(providerId)) {
+                factory = f;
+                factory.init(Config.scope("audit", providerId));
+            }
+        }
+
+        provider = factory.create(null);
+    }
+
+    protected abstract String getProviderId();
+
+    @After
+    public void after() {
+        provider.clear();
+        provider.close();
+        factory.close();
+    }
+
+    @Test
+    public void save() {
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+    }
+
+    @Test
+    public void query() {
+        long oldest = System.currentTimeMillis() - 30000;
+        long newest = System.currentTimeMillis() + 30000;
+
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
+        provider.onEvent(create(EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(oldest, EventType.LOGIN, "realmId", "clientId2", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        Assert.assertEquals(5, provider.createQuery().client("clientId").getResultList().size());
+        Assert.assertEquals(5, provider.createQuery().realm("realmId").getResultList().size());
+        Assert.assertEquals(4, provider.createQuery().event(EventType.LOGIN).getResultList().size());
+        Assert.assertEquals(6, provider.createQuery().event(EventType.LOGIN, EventType.REGISTER).getResultList().size());
+        Assert.assertEquals(4, provider.createQuery().user("userId").getResultList().size());
+
+        Assert.assertEquals(1, provider.createQuery().user("userId").event(EventType.REGISTER).getResultList().size());
+
+        Assert.assertEquals(2, provider.createQuery().maxResults(2).getResultList().size());
+        Assert.assertEquals(1, provider.createQuery().firstResult(5).getResultList().size());
+
+        Assert.assertEquals(newest, provider.createQuery().maxResults(1).getResultList().get(0).getTime());
+        Assert.assertEquals(oldest, provider.createQuery().firstResult(5).maxResults(1).getResultList().get(0).getTime());
+    }
+
+    @Test
+    public void clear() {
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        provider.clear("realmId");
+
+        Assert.assertEquals(1, provider.createQuery().getResultList().size());
+    }
+
+    @Test
+    public void clearOld() {
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
+        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
+
+        provider.close();
+        provider = factory.create(null);
+
+        provider.clear("realmId", System.currentTimeMillis() - 10000);
+
+        Assert.assertEquals(3, provider.createQuery().getResultList().size());
+    }
+
+    private Event create(EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
+        return create(System.currentTimeMillis(), event, realmId, clientId, userId, ipAddress, error);
+    }
+
+    private Event create(long time, EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
+        Event e = new Event();
+        e.setTime(time);
+        e.setEvent(event);
+        e.setRealmId(realmId);
+        e.setClientId(clientId);
+        e.setUserId(userId);
+        e.setIpAddress(ipAddress);
+        e.setError(error);
+
+        Map<String, String> details = new HashMap<String, String>();
+        details.put("key1", "value1");
+        details.put("key2", "value2");
+
+        e.setDetails(details);
+
+        return e;
+    }
+
+}

authentication/authentication-api/pom.xml

@@ -0,0 +1,48 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-api</artifactId>
+    <name>Keycloak Authentication SPI</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderConstants.java

@@ -0,0 +1,15 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthProviderConstants {
+
+    // Model is default provider. See AuthenticationProviderModel.DEFAULT_PROVIDER
+    public static final String PROVIDER_NAME_MODEL = "model";
+    public static final String PROVIDER_NAME_EXTERNAL_MODEL = "externalModel";
+    public static final String PROVIDER_NAME_PICKETLINK = "picketlink";
+
+    // Used in external-model provider
+    public static final String EXTERNAL_REALM_ID = "externalRealmId";
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderStatus.java

@@ -0,0 +1,12 @@
+package org.keycloak.authentication;
+
+/**
+ * Result of authentication by AuthenticationProvider
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public enum AuthProviderStatus {
+
+    SUCCESS, INVALID_CREDENTIALS, FAILED
+
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthUser.java

@@ -0,0 +1,83 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthUser {
+
+    private String id;
+    private String username;
+    private String firstName;
+    private String lastName;
+    private String email;
+
+    private String providerName;
+
+    public AuthUser(String id, String username, String providerName) {
+        this.id = id;
+        this.username = username;
+        this.providerName = providerName;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public AuthUser setId(String id) {
+        this.id = id;
+        return this;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public AuthUser setUsername(String username) {
+        this.username = username;
+        return this;
+    }
+
+    public String getFirstName() {
+        return firstName;
+    }
+
+    public AuthUser setName(String name) {
+        int i = name.lastIndexOf(' ');
+        if (i != -1) {
+            firstName  = name.substring(0, i);
+            lastName = name.substring(i + 1);
+        } else {
+            firstName = name;
+        }
+
+        return this;
+    }
+
+    public AuthUser setName(String firstName, String lastName) {
+        this.firstName = firstName;
+        this.lastName = lastName;
+        return this;
+    }
+
+    public String getLastName() {
+        return lastName;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public AuthUser setEmail(String email) {
+        this.email = email;
+        return this;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public AuthUser setProviderName(String providerName) {
+        this.providerName = providerName;
+        return this;
+    }
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProvider.java

@@ -0,0 +1,68 @@
+package org.keycloak.authentication;
+
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface AuthenticationProvider extends Provider {
+
+    String getName();
+
+    /**
+     * Get names of all available configuration options of current provider
+     *
+     * @return options or empty list if no options available
+     */
+    List<String> getAvailableOptions();
+
+    /**
+     * Get user by given username or email. Return user instance or null if user doesn't exists in this authentication provider
+     *
+     * @param realm
+     * @param configuration
+     * @param username or email
+     * @return found user or null if user with given username doesn't exists
+     * @throws AuthenticationProviderException
+     */
+    AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
+
+    /**
+     * Try to register user with this authentication provider
+     *
+     * @param realm
+     * @param configuration
+     * @param username
+     * @return ID of newly created user (For example ID from LDAP)
+     * @throws AuthenticationProviderException if user creation couldn't happen
+     */
+    String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
+
+    /**
+     * Standard Authentication flow
+     *
+     * @param username
+     * @param password
+     * @return result of authentication, which might eventually encapsulate info about authenticated user and provider which successfully authenticated
+     */
+    AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
+
+
+    /**
+     * Update credential
+     *
+     * @param realm
+     * @param configuration
+     * @param username
+     * @param password
+     * @return true if credential has been successfully updated
+     * @throws AuthenticationProviderException
+     */
+    boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
+
+
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderException.java

@@ -0,0 +1,24 @@
+package org.keycloak.authentication;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthenticationProviderException extends Exception {
+
+    private static final long serialVersionUID = 15L;
+
+    protected AuthenticationProviderException() {
+    }
+
+    public AuthenticationProviderException(String message) {
+        super(message);
+    }
+
+    public AuthenticationProviderException(Throwable cause) {
+        super(cause);
+    }
+
+    public AuthenticationProviderException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.authentication;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface AuthenticationProviderFactory extends ProviderFactory<AuthenticationProvider> {
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java

@@ -0,0 +1,219 @@
+package org.keycloak.authentication;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderSession;
+import org.keycloak.util.ProviderLoader;
+
+/**
+ * Access point to authentication SPI. It finds configured and available {@link AuthenticationProvider} instances for current realm
+ * and then delegates method call to them.
+ *
+ * Example of usage: AuthenticationProviderManager.getManager(realm).validateUser("joe", "password");
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthenticationProviderManager {
+
+    private static final Logger logger = Logger.getLogger(AuthenticationProviderManager.class);
+
+    private final RealmModel realm;
+    private final Map<String, AuthenticationProvider> delegates;
+
+    public static AuthenticationProviderManager getManager(RealmModel realm, ProviderSession providerSession) {
+        Iterable<AuthenticationProvider> providers = providerSession.getAllProviders(AuthenticationProvider.class);
+
+        Map<String, AuthenticationProvider> providersMap = new HashMap<String, AuthenticationProvider>();
+        for (AuthenticationProvider provider : providers) {
+            providersMap.put(provider.getName(), provider);
+        }
+
+        return new AuthenticationProviderManager(realm, providersMap);
+    }
+
+    public AuthenticationProviderManager(RealmModel realm, Map<String, AuthenticationProvider> delegates) {
+        this.realm = realm;
+        this.delegates = delegates;
+    }
+
+    public AuthUser getUser(String username) {
+        List<AuthenticationProviderModel> authProviderModels = getConfiguredProviderModels(realm);
+        for (AuthenticationProviderModel providerModel : authProviderModels) {
+            AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
+            if (delegate == null) {
+                continue;
+            }
+
+            try {
+                AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), username);
+                if (authUser != null) {
+                    logger.debugf("User '%s' found with provider '%s'", username, providerModel.getProviderName());
+                    return authUser;
+                }
+            } catch (AuthenticationProviderException ape) {
+                logger.warn(ape.getMessage(), ape);
+            }
+        }
+
+        logger.debugf("User '%s' not found with any provider", username);
+        return null;
+    }
+
+    public AuthProviderStatus validatePassword(UserModel user, String password) {
+        AuthenticationLinkModel authLink = user.getAuthenticationLink();
+        if (authLink == null) {
+            // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
+            AuthUser authUser = getUser(user.getLoginName());
+            authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
+            user.setAuthenticationLink(authLink);
+            logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
+        }
+
+        String providerName = authLink.getAuthProvider();
+
+        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
+        AuthenticationProvider delegate = getProvider(providerName);
+        if (delegate == null || providerModel == null) {
+            return AuthProviderStatus.FAILED;
+        }
+
+        try {
+            checkCorrectAuthLink(delegate, providerModel, authLink, user.getLoginName());
+
+            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getLoginName(), password);
+            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getLoginName());
+            return currentResult;
+        } catch (AuthenticationProviderException ape) {
+            logger.warn(ape.getMessage(), ape);
+            return AuthProviderStatus.FAILED;
+        }
+    }
+
+    public boolean updatePassword(UserModel user, String password) throws AuthenticationProviderException {
+        AuthenticationLinkModel authLink = user.getAuthenticationLink();
+        if (authLink == null) {
+            // Find provider with biggest priority where password update is supported. Then register user here and link him
+            List<AuthenticationProviderModel> configuredProviders = getConfiguredProviderModels(realm);
+            for (AuthenticationProviderModel providerModel : configuredProviders) {
+                if (providerModel.isPasswordUpdateSupported()) {
+                    AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
+                    if (delegate != null) {
+                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getLoginName());
+                        if (authUser != null) {
+                            // Linking existing user supported just for "model" provider. In other cases throw exception
+                            if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
+                                authLink = new AuthenticationLinkModel(providerModel.getProviderName(), authUser.getId());
+                                user.setAuthenticationLink(authLink);
+                                logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
+                            } else {
+                                throw new AuthenticationProviderException("User " + authUser.getUsername() + " exists in provider "
+                                        + authUser.getProviderName() + " but is not linked with model user");
+                            }
+                        } else {
+                            String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user.getLoginName());
+                            authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
+                            user.setAuthenticationLink(authLink);
+                            logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
+                        }
+                        break;
+                    }
+                }
+            }
+
+            if (authLink == null) {
+                logger.warnf("No providers found where password update is supported for user '%s'", user.getLoginName());
+                return false;
+            }
+        }
+
+        String providerName = authLink.getAuthProvider();
+
+        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
+        if (providerModel == null) {
+            return false;
+        }
+
+        String username = user.getLoginName();
+
+        // Update just those, which support password update
+        if (providerModel.isPasswordUpdateSupported()) {
+            try {
+                AuthenticationProvider delegate = getProvider(providerName);
+                if (delegate == null) {
+                    return false;
+                }
+
+                checkCorrectAuthLink(delegate, providerModel, authLink, username);
+
+                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getLoginName(), password)) {
+                    logger.debugf("Updated password in authentication provider '%s' for user '%s'", providerName, username);
+                    return true;
+                } else {
+                    logger.warnf("Password not updated in authentication provider '%s' for user '%s'", providerName, username);
+                    return false;
+                }
+            } catch (AuthenticationProviderException ape) {
+                // Rethrow it to upper layer
+                logger.warn("Failed to update password: " + ape.getMessage());
+                throw ape;
+            }
+        } else {
+            logger.warnf("Skip password update for authentication provider '%s' for user '%s'", providerName, username);
+            return false;
+        }
+    }
+
+    private AuthenticationProvider getProvider(String providerName) {
+        AuthenticationProvider delegate = delegates.get(providerName);
+        if (delegate == null) {
+            logger.warnf("Provider '%s' not available on classpath", providerName);
+        }
+        return delegate;
+    }
+
+    private static List<AuthenticationProviderModel> getConfiguredProviderModels(RealmModel realm) {
+        List<AuthenticationProviderModel> configuredProviders = realm.getAuthenticationProviders();
+
+        // Use model based authentication of current realm by default
+        if (configuredProviders == null || configuredProviders.isEmpty()) {
+            configuredProviders = Collections.EMPTY_LIST;
+            logger.warnf("No authentication providers found");
+        }
+
+        return configuredProviders;
+    }
+
+    public static AuthenticationProviderModel getConfiguredProviderModel(RealmModel realm, String providerName) {
+        List<AuthenticationProviderModel> providers = getConfiguredProviderModels(realm);
+        for (AuthenticationProviderModel provider : providers) {
+            if (providerName.equals(provider.getProviderName())) {
+                return provider;
+            }
+        }
+
+        logger.warnf("Provider '%s' not configured in realm", providerName);
+        return null;
+    }
+
+    // Check if ID of linked AuthUser is same as expected ID from authenticationLink . It should catch the case when for example user "john" was deleted in LDAP
+    // and then user "john" has been created again, but it's actually different user with different ID
+    private void checkCorrectAuthLink(AuthenticationProvider authProvider, AuthenticationProviderModel providerModel,
+                                      AuthenticationLinkModel authLinkModel, String username) throws AuthenticationProviderException {
+        AuthUser authUser = authProvider.getUser(realm, providerModel.getConfig(), username);
+        if (authUser == null) {
+            throw new AuthenticationProviderException("User " + username + " not found in authentication provider " + providerModel.getProviderName());
+        }
+        String userExternalId = authUser.getId();
+        if (!userExternalId.equals(authLinkModel.getAuthUserId())) {
+            throw new AuthenticationProviderException("ID did not match! ID from provider: " + userExternalId + ", ID from authentication link: " + authLinkModel.getAuthUserId());
+        }
+    }
+}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.authentication;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AuthenticationSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "authentication";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return AuthenticationProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return AuthenticationProviderFactory.class;
+    }
+
+}

authentication/authentication-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1 @@
+org.keycloak.authentication.AuthenticationSpi

authentication/authentication-model/pom.xml

@@ -0,0 +1,74 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-model</artifactId>
+    <name>Keycloak Authentication Model Based</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java

@@ -0,0 +1,84 @@
+package org.keycloak.authentication.model;
+
+import java.util.Map;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.authentication.AuthProviderStatus;
+import org.keycloak.authentication.AuthUser;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderException;
+
+/**
+ * Authentication provider, which delegates calling of all methods to specified realm
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public abstract class AbstractModelAuthenticationProvider implements AuthenticationProvider {
+
+    private static final Logger logger = Logger.getLogger(AbstractModelAuthenticationProvider.class);
+
+    @Override
+    public AuthUser getUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+        return user == null ? null : createAuthenticatedUserInstance(user);
+    }
+
+    @Override
+    public String registerUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = currentRealm.addUser(username);
+        user.setEnabled(true);
+        return user.getId();
+    }
+
+    @Override
+    public AuthProviderStatus validatePassword(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+
+        boolean result = realm.validatePassword(user, password);
+        return result ? AuthProviderStatus.SUCCESS : AuthProviderStatus.INVALID_CREDENTIALS;
+    }
+
+    @Override
+    public boolean updateCredential(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
+        RealmModel realm = getRealm(currentRealm, config);
+
+        // Validate password policy
+        String error = realm.getPasswordPolicy().validate(password);
+        if (error != null) {
+            throw new AuthenticationProviderException(error);
+        }
+
+        UserModel user = realm.getUser(username);
+        if (user == null) {
+            logger.warnf("User '%s' doesn't exists. Skip password update", username);
+            return false;
+        }
+
+        UserCredentialModel cred = new UserCredentialModel();
+        cred.setType(CredentialRepresentation.PASSWORD);
+        cred.setValue(password);
+
+        user.updateCredential(cred);
+        return true;
+    }
+
+    @Override
+    public void close() {
+    }
+
+    protected abstract RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) throws AuthenticationProviderException;
+
+    protected AuthUser createAuthenticatedUserInstance(UserModel user) {
+        return new AuthUser(user.getId(), user.getLoginName(), getName())
+                .setName(user.getFirstName(), user.getLastName())
+                .setEmail(user.getEmail());
+    }
+}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java

@@ -0,0 +1,53 @@
+package org.keycloak.authentication.model;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+import org.jboss.resteasy.spi.ResteasyProviderFactory;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProviderException;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * AbstractModelAuthenticationProvider, which delegates authentication operations to different (external) realm
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
+
+    public ExternalModelAuthenticationProvider(ProviderSession providerSession) {
+    }
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Arrays.asList(AuthProviderConstants.EXTERNAL_REALM_ID);
+    }
+
+    @Override
+    public RealmModel getRealm(RealmModel currentRealm, Map<String, String> configuration) throws AuthenticationProviderException {
+        String realmId = configuration.get(AuthProviderConstants.EXTERNAL_REALM_ID);
+        if (realmId == null) {
+            throw new AuthenticationProviderException("Option '" + AuthProviderConstants.EXTERNAL_REALM_ID + "' not specified in configuration");
+        }
+
+        // TODO: This won't be needed when KeycloakSession is available from ProviderSession
+        KeycloakSession session = ResteasyProviderFactory.getContextData(KeycloakSession.class);
+        if (session == null) {
+            throw new AuthenticationProviderException("KeycloakSession not available");
+        }
+
+        RealmModel realm = session.getRealm(realmId);
+        if (realm == null) {
+            throw new AuthenticationProviderException("Realm with id '" + realmId + "' doesn't exists");
+        }
+        return realm;
+    }
+}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java

@@ -0,0 +1,32 @@
+package org.keycloak.authentication.model;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExternalModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new ExternalModelAuthenticationProvider(providerSession);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
+    }
+
+}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java

@@ -0,0 +1,31 @@
+package org.keycloak.authentication.model;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.authentication.AuthProviderConstants;
+
+/**
+ * AbstractModelAuthenticationProvider, which uses current realm to call operations on
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_MODEL;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Collections.EMPTY_LIST;
+    }
+
+    @Override
+    protected RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) {
+        return currentRealm;
+    }
+}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java

@@ -0,0 +1,32 @@
+package org.keycloak.authentication.model;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new ModelAuthenticationProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_MODEL;
+    }
+
+}

authentication/authentication-model/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -0,0 +1,2 @@
+org.keycloak.authentication.model.ModelAuthenticationProviderFactory
+org.keycloak.authentication.model.ExternalModelAuthenticationProviderFactory

authentication/authentication-picketlink/pom.xml

@@ -0,0 +1,101 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-authentication-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authentication-picketlink</artifactId>
+    <name>Keycloak Authentication Picketlink Based</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-picketlink-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-common</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-impl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-simple-schema</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java

@@ -0,0 +1,134 @@
+package org.keycloak.authentication.picketlink;
+
+import org.jboss.logging.Logger;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthProviderStatus;
+import org.keycloak.authentication.AuthUser;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.picketlink.IdentityManagerProvider;
+import org.picketlink.idm.IdentityManagementException;
+import org.picketlink.idm.IdentityManager;
+import org.picketlink.idm.credential.Credentials;
+import org.picketlink.idm.credential.Password;
+import org.picketlink.idm.credential.UsernamePasswordCredentials;
+import org.picketlink.idm.model.basic.BasicModel;
+import org.picketlink.idm.model.basic.User;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * AuthenticationProvider, which delegates authentication to picketlink
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PicketlinkAuthenticationProvider implements AuthenticationProvider {
+
+    private static final Logger logger = Logger.getLogger(PicketlinkAuthenticationProvider.class);
+
+    private final IdentityManagerProvider identityManagerProvider;
+
+    public PicketlinkAuthenticationProvider(IdentityManagerProvider identityManagerProvider) {
+        this.identityManagerProvider = identityManagerProvider;
+    }
+
+    @Override
+    public String getName() {
+        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
+    }
+
+    @Override
+    public List<String> getAvailableOptions() {
+        return Collections.EMPTY_LIST;
+    }
+
+    @Override
+    public AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, username);
+            return picketlinkUser == null ? null : new AuthUser(picketlinkUser.getId(), picketlinkUser.getLoginName(), getName())
+                    .setName(picketlinkUser.getFirstName(), picketlinkUser.getLastName())
+                    .setEmail(picketlinkUser.getEmail())
+                    .setProviderName(getName());
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = new User(username);
+            identityManager.add(picketlinkUser);
+
+            // Hack needed due to ActiveDirectory bug in Picketlink TODO: Remove once https://issues.jboss.org/browse/PLINK-485 fixed and updated in keycloak master
+            picketlinkUser = BasicModel.getUser(identityManager, picketlinkUser.getLoginName());
+
+            return picketlinkUser.getId();
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            UsernamePasswordCredentials credential = new UsernamePasswordCredentials();
+            credential.setUsername(username);
+            credential.setPassword(new Password(password.toCharArray()));
+            identityManager.validateCredentials(credential);
+            if (credential.getStatus() == Credentials.Status.VALID) {
+                return AuthProviderStatus.SUCCESS;
+            } else {
+                return AuthProviderStatus.INVALID_CREDENTIALS;
+            }
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
+        IdentityManager identityManager = getIdentityManager(realm);
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, username);
+            if (picketlinkUser == null) {
+                logger.debugf("User '%s' doesn't exists. Skip password update", username);
+                return false;
+            }
+
+            identityManager.updateCredential(picketlinkUser, new Password(password.toCharArray()));
+            return true;
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public void close() {
+    }
+
+    public IdentityManager getIdentityManager(RealmModel realm) throws AuthenticationProviderException {
+        return identityManagerProvider.getIdentityManager(realm);
+    }
+
+    private AuthenticationProviderException convertIDMException(IdentityManagementException ie) {
+        Throwable realCause = ie;
+        while (realCause.getCause() != null) {
+            realCause = realCause.getCause();
+        }
+
+        // Use the message from the realCause
+        return new AuthenticationProviderException(realCause.getMessage(), ie);
+    }
+}

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProviderFactory.java

@@ -0,0 +1,33 @@
+package org.keycloak.authentication.picketlink;
+
+import org.keycloak.Config;
+import org.keycloak.authentication.AuthProviderConstants;
+import org.keycloak.authentication.AuthenticationProvider;
+import org.keycloak.authentication.AuthenticationProviderFactory;
+import org.keycloak.picketlink.IdentityManagerProvider;
+import org.keycloak.provider.ProviderSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PicketlinkAuthenticationProviderFactory implements AuthenticationProviderFactory {
+
+    @Override
+    public AuthenticationProvider create(ProviderSession providerSession) {
+        return new PicketlinkAuthenticationProvider(providerSession.getProvider(IdentityManagerProvider.class));
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
+    }
+
+}

authentication/authentication-picketlink/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -0,0 +1 @@
+org.keycloak.authentication.picketlink.PicketlinkAuthenticationProviderFactory

authentication/pom.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-3</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+    <packaging>pom</packaging>
+
+    <artifactId>keycloak-authentication-parent</artifactId>
+    <name>Keycloak Authentication</name>
+    <description />
+
+    <modules>
+        <module>authentication-api</module>
+        <module>authentication-model</module>
+        <module>authentication-picketlink</module>
+    </modules>
+
+</project>

core-jaxrs/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-3</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -18,11 +19,6 @@
             <artifactId>resteasy-jaxrs</artifactId>
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-client</artifactId>
-            <scope>provided</scope>
-        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-core</artifactId>
@@ -61,8 +57,8 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                 </configuration>
             </plugin>
         </plugins>

core/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-3</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -45,8 +46,8 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                 </configuration>
             </plugin>
         </plugins>

core/src/main/java/org/keycloak/AbstractOAuthClient.java

@@ -2,7 +2,6 @@ package org.keycloak;
 
 import org.keycloak.util.KeycloakUriBuilder;
 
-import java.security.KeyStore;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicLong;
@@ -12,7 +11,9 @@ import java.util.concurrent.atomic.AtomicLong;
  * @version $Revision: 1 $
  */
 public class AbstractOAuthClient {
-    public static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private final AtomicLong counter = new AtomicLong();
+
     protected String clientId;
     protected Map<String, String> credentials;
     protected String authUrl;
@@ -23,8 +24,6 @@ public class AbstractOAuthClient {
     protected String stateCookiePath;
     protected boolean isSecure;
     protected boolean publicClient;
-    protected final AtomicLong counter = new AtomicLong();
-
     protected String getStateCode() {
         return counter.getAndIncrement() + "/" + UUID.randomUUID().toString();
     }
@@ -103,8 +102,8 @@ public class AbstractOAuthClient {
 
     protected String stripOauthParametersFromRedirect(String uri) {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
-                .replaceQueryParam("code", null)
-                .replaceQueryParam("state", null);
+                .replaceQueryParam(OAuth2Constants.CODE, null)
+                .replaceQueryParam(OAuth2Constants.STATE, null);
         return builder.build().toString();
     }
 

core/src/main/java/org/keycloak/Config.java

@@ -0,0 +1,145 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Config {
+
+    private static ConfigProvider configProvider = new SystemPropertiesConfigProvider();
+
+    public static void init(ConfigProvider configProvider) {
+        Config.configProvider = configProvider;
+    }
+
+    public static String getAdminRealm() {
+        return configProvider.scope("admin").get("realm", "master");
+    }
+
+    public static String getProvider(String spi) {
+        return configProvider.getProvider(spi);
+    }
+
+    public static Scope scope(String... scope) {
+         return configProvider.scope(scope);
+    }
+
+    public static interface ConfigProvider {
+
+        String getProvider(String spi);
+
+        Scope scope(String... scope);
+
+    }
+
+    public static class SystemPropertiesConfigProvider implements ConfigProvider {
+
+        @Override
+        public String getProvider(String spi) {
+            return System.getProperties().getProperty("keycloak." + spi + ".provider");
+        }
+
+        @Override
+        public Scope scope(String... scope) {
+            StringBuilder sb = new StringBuilder();
+            sb.append("keycloak.");
+            for (String s : scope) {
+                sb.append(s);
+                sb.append(".");
+            }
+            return new SystemPropertiesScope(sb.toString());
+        }
+
+    }
+
+    public static class SystemPropertiesScope implements Scope {
+
+        private String prefix;
+
+        public SystemPropertiesScope(String prefix) {
+            this.prefix = prefix;
+        }
+
+        @Override
+        public String get(String key) {
+            return get(key, null);
+        }
+
+        @Override
+        public String get(String key, String defaultValue) {
+            return System.getProperty(prefix + key, defaultValue);
+        }
+
+        @Override
+        public String[] getArray(String key) {
+            String value = get(key);
+            if (value != null) {
+                String[] a = value.split(",");
+                for (int i = 0; i < a.length; i++) {
+                    a[i] = a[i].trim();
+                }
+                return a;
+            } else {
+                return null;
+            }
+        }
+
+        @Override
+        public Integer getInt(String key) {
+            return getInt(key, null);
+        }
+
+        @Override
+        public Integer getInt(String key, Integer defaultValue) {
+            String v = get(key, null);
+            return v != null ? Integer.parseInt(v) : defaultValue;
+        }
+
+        @Override
+        public Long getLong(String key) {
+            return getLong(key, null);
+        }
+
+        @Override
+        public Long getLong(String key, Long defaultValue) {
+            String v = get(key, null);
+            return v != null ? Long.parseLong(v) : defaultValue;
+        }
+
+        @Override
+        public Boolean getBoolean(String key) {
+            return getBoolean(key, null);
+        }
+
+        @Override
+        public Boolean getBoolean(String key, Boolean defaultValue) {
+            String v = get(key, null);
+            return v != null ? Boolean.parseBoolean(v) : defaultValue;
+        }
+
+    }
+
+    /**
+     * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+     */
+    public static interface Scope {
+
+        String get(String key);
+
+        String get(String key, String defaultValue);
+
+        String[] getArray(String key);
+
+        Integer getInt(String key);
+
+        Integer getInt(String key, Integer defaultValue);
+
+        Long getLong(String key);
+
+        Long getLong(String key, Long defaultValue);
+
+        Boolean getBoolean(String key);
+
+        Boolean getBoolean(String key, Boolean defaultValue);
+
+    }
+}

core/src/main/java/org/keycloak/KeycloakPrincipal.java

@@ -8,12 +8,16 @@ import java.security.Principal;
  * @version $Revision: 1 $
  */
 public class KeycloakPrincipal implements Principal, Serializable {
-    protected String name;
-    protected String surrogate;
+    protected final String name;
+    protected final KeycloakSecurityContext context;
 
-    public KeycloakPrincipal(String name, String surrogate) {
+    public KeycloakPrincipal(String name, KeycloakSecurityContext context) {
         this.name = name;
-        this.surrogate = surrogate;
+        this.context = context;
+    }
+
+    public KeycloakSecurityContext getKeycloakSecurityContext() {
+        return context;
     }
 
     @Override
@@ -21,10 +25,6 @@ public class KeycloakPrincipal implements Principal, Serializable {
         return name;
     }
 
-    public String getSurrogate() {
-        return surrogate;
-    }
-
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
@@ -33,16 +33,13 @@ public class KeycloakPrincipal implements Principal, Serializable {
         KeycloakPrincipal that = (KeycloakPrincipal) o;
 
         if (!name.equals(that.name)) return false;
-        if (surrogate != null ? !surrogate.equals(that.surrogate) : that.surrogate != null) return false;
 
         return true;
     }
 
     @Override
     public int hashCode() {
-        int result = name.hashCode();
-        result = 31 * result + (surrogate != null ? surrogate.hashCode() : 0);
-        return result;
+        return name.hashCode();
     }
 
     @Override

core/src/main/java/org/keycloak/OAuth2Constants.java

@@ -0,0 +1,30 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface OAuth2Constants {
+
+    String CODE = "code";
+
+    String CLIENT_ID = "client_id";
+
+    String ERROR = "error";
+
+    String ERROR_DESCRIPTION = "error_description";
+
+    String REDIRECT_URI = "redirect_uri";
+
+    String SCOPE = "scope";
+
+    String STATE = "state";
+
+    String GRANT_TYPE = "grant_type";
+
+    String RESPONSE_TYPE = "response_type";
+
+    String REFRESH_TOKEN = "refresh_token";
+
+}
+
+

core/src/main/java/org/keycloak/OAuthErrorException.java

@@ -19,6 +19,8 @@ public class OAuthErrorException extends Exception {
     }
     public OAuthErrorException(String error, String description, String message) {
         super(message);
+        this.error = error;
+        this.description = description;
     }
     public OAuthErrorException(String error, String description) {
         super(description);

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -16,29 +16,27 @@ public class RSATokenVerifier {
         return verifyToken(tokenString, realmKey, realm, true);
     }
 
-
     public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
-        JWSInput input = new JWSInput(tokenString);
-        boolean verified = false;
+        JWSInput input = null;
         try {
-            verified = RSAProvider.verify(input, realmKey);
-        } catch (Exception ignore) {
-
+            input = new JWSInput(tokenString);
+        } catch (Exception e) {
+            throw new VerificationException("Couldn't parse token", e);
         }
-        if (!verified) throw new VerificationException("Token signature not validated");
+        if (!isPublicKeyValid(input, realmKey)) throw new VerificationException("Invalid token signature.");
 
-        AccessToken token = null;
+        AccessToken token;
         try {
             token = input.readJsonContent(AccessToken.class);
         } catch (IOException e) {
-            throw new VerificationException(e);
+            throw new VerificationException("Couldn't parse token signature", e);
         }
         String user = token.getSubject();
         if (user == null) {
-            throw new VerificationException("Token user was null");
+            throw new VerificationException("Token user was null.");
         }
         if (!realm.equals(token.getAudience())) {
-            throw new VerificationException("Token audience doesn't match domain");
+            throw new VerificationException("Token audience doesn't match domain.");
 
         }
         if (checkActive && !token.isActive()) {
@@ -47,4 +45,12 @@ public class RSATokenVerifier {
 
         return token;
     }
+
+    private static boolean isPublicKeyValid(JWSInput input, PublicKey realmKey) throws VerificationException {
+        try {
+            return RSAProvider.verify(input, realmKey);
+        } catch (Exception e) {
+            throw new VerificationException("Token signature not validated.", e);
+        }
+    }
 }

core/src/main/java/org/keycloak/ServiceUrlConstants.java

@@ -6,7 +6,12 @@ package org.keycloak;
  */
 public interface ServiceUrlConstants {
 
-    public static final String TOKEN_SERVICE_LOGIN_PATH = "/rest/realms/{realm-name}/tokens/login";
-    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/rest/realms/{realm-name}/tokens/access/codes";
-    public static final String TOKEN_SERVICE_REFRESH_PATH = "/rest/realms/{realm-name}/tokens/refresh";
+    public static final String TOKEN_SERVICE_LOGIN_PATH = "/realms/{realm-name}/tokens/login";
+    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/realms/{realm-name}/tokens/access/codes";
+    public static final String TOKEN_SERVICE_REFRESH_PATH = "/realms/{realm-name}/tokens/refresh";
+    public static final String TOKEN_SERVICE_LOGOUT_PATH = "/realms/{realm-name}/tokens/logout";
+    public static final String TOKEN_SERVICE_DIRECT_GRANT_PATH = "/realms/{realm-name}/tokens/grants/access";
+    public static final String ACCOUNT_SERVICE_PATH = "/realms/{realm-name}/account";
+    public static final String REALM_INFO_PATH = "/realms/{realm-name}";
+
 }

core/src/main/java/org/keycloak/jose/jws/JWSHeader.java

@@ -1,6 +1,5 @@
 package org.keycloak.jose.jws;
 
-import org.codehaus.jackson.annotate.JsonIgnore;
 import org.codehaus.jackson.annotate.JsonProperty;
 import org.codehaus.jackson.map.ObjectMapper;
 import org.codehaus.jackson.map.annotate.JsonSerialize;

core/src/main/java/org/keycloak/jose/jws/crypto/HMACProvider.java

@@ -15,7 +15,7 @@ import java.security.NoSuchAlgorithmException;
  * @version $Revision: 1 $
  */
 public class HMACProvider {
-    public static String getJavaAlgorithm(Algorithm alg) {
+    private static String getJavaAlgorithm(Algorithm alg) {
         switch (alg) {
             case HS256:
                 return "HMACSHA256";
@@ -28,7 +28,7 @@ public class HMACProvider {
         }
     }
 
-    public static Mac getMAC(final Algorithm alg) {
+    private static Mac getMAC(final Algorithm alg) {
 
         try {
             return Mac.getInstance(getJavaAlgorithm(alg));

core/src/main/java/org/keycloak/provider/Provider.java

@@ -0,0 +1,10 @@
+package org.keycloak.provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Provider {
+
+    public void close();
+
+}

core/src/main/java/org/keycloak/provider/ProviderFactory.java

@@ -0,0 +1,18 @@
+package org.keycloak.provider;
+
+import org.keycloak.Config;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface ProviderFactory<T extends Provider> {
+
+    public T create(ProviderSession providerSession);
+
+    public void init(Config.Scope config);
+
+    public void close();
+
+    public String getId();
+
+}

core/src/main/java/org/keycloak/provider/ProviderSession.java

@@ -0,0 +1,20 @@
+package org.keycloak.provider;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface ProviderSession {
+
+    <T extends Provider> T getProvider(Class<T> clazz);
+
+    <T extends Provider> T getProvider(Class<T> clazz, String id);
+
+    <T extends Provider> Set<String> listProviderIds(Class<T> clazz);
+
+    <T extends Provider> Set<T> getAllProviders(Class<T> clazz);
+
+    void close();
+
+}

core/src/main/java/org/keycloak/provider/ProviderSessionFactory.java

@@ -0,0 +1,14 @@
+package org.keycloak.provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface ProviderSessionFactory {
+
+    ProviderSession createSession();
+
+    void close();
+
+    void init();
+
+}

core/src/main/java/org/keycloak/provider/Spi.java

@@ -0,0 +1,12 @@
+package org.keycloak.provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Spi {
+
+    public String getName();
+    public Class<? extends Provider> getProviderClass();
+    public Class<? extends ProviderFactory> getProviderFactoryClass();
+
+}

core/src/main/java/org/keycloak/representations/AccessToken.java

@@ -128,12 +128,12 @@ public class AccessToken extends IDToken {
     }
 
     @Override
-    public AccessToken expiration(long expiration) {
+    public AccessToken expiration(int expiration) {
         return (AccessToken) super.expiration(expiration);
     }
 
     @Override
-    public AccessToken notBefore(long notBefore) {
+    public AccessToken notBefore(int notBefore) {
         return (AccessToken) super.notBefore(notBefore);
     }
 

core/src/main/java/org/keycloak/representations/AccessTokenResponse.java

@@ -27,6 +27,9 @@ public class AccessTokenResponse {
     @JsonProperty("not-before-policy")
     protected int notBeforePolicy;
 
+    @JsonProperty("session-state")
+    protected String sessionState;
+
     public String getToken() {
         return token;
     }
@@ -74,4 +77,12 @@ public class AccessTokenResponse {
     public void setNotBeforePolicy(int notBeforePolicy) {
         this.notBeforePolicy = notBeforePolicy;
     }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
 }

core/src/main/java/org/keycloak/representations/IDToken.java

@@ -88,6 +88,9 @@ public class IDToken extends JsonWebToken {
     @JsonProperty("claims_locales")
     protected String claimsLocales;
 
+    @JsonProperty("session_state")
+    protected String sessionState;
+
     public String getNonce() {
         return nonce;
     }
@@ -303,4 +306,12 @@ public class IDToken extends JsonWebToken {
     public void setClaimsLocales(String claimsLocales) {
         this.claimsLocales = claimsLocales;
     }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
 }

core/src/main/java/org/keycloak/representations/JsonWebToken.java

@@ -2,6 +2,7 @@ package org.keycloak.representations;
 
 import org.codehaus.jackson.annotate.JsonIgnore;
 import org.codehaus.jackson.annotate.JsonProperty;
+import org.keycloak.util.Time;
 
 import java.io.Serializable;
 
@@ -13,9 +14,9 @@ public class JsonWebToken implements Serializable {
     @JsonProperty("jti")
     protected String id;
     @JsonProperty("exp")
-    protected long expiration;
+    protected int expiration;
     @JsonProperty("nbf")
-    protected long notBefore;
+    protected int notBefore;
     @JsonProperty("iat")
     protected int issuedAt;
     @JsonProperty("iss")
@@ -39,26 +40,25 @@ public class JsonWebToken implements Serializable {
     }
 
 
-    public long getExpiration() {
+    public int getExpiration() {
         return expiration;
     }
 
-    public JsonWebToken expiration(long expiration) {
+    public JsonWebToken expiration(int expiration) {
         this.expiration = expiration;
         return this;
     }
 
     @JsonIgnore
     public boolean isExpired() {
-        long time = System.currentTimeMillis() / 1000;
-        return time > expiration;
+        return Time.currentTime() > expiration;
     }
 
-    public long getNotBefore() {
+    public int getNotBefore() {
         return notBefore;
     }
 
-    public JsonWebToken notBefore(long notBefore) {
+    public JsonWebToken notBefore(int notBefore) {
         this.notBefore = notBefore;
         return this;
     }
@@ -66,7 +66,7 @@ public class JsonWebToken implements Serializable {
 
     @JsonIgnore
     public boolean isNotBefore() {
-        return (System.currentTimeMillis() / 1000) >= notBefore;
+        return Time.currentTime() >= notBefore;
 
     }
 
@@ -89,7 +89,7 @@ public class JsonWebToken implements Serializable {
      */
     @JsonIgnore
     public JsonWebToken issuedNow() {
-        issuedAt = (int)(System.currentTimeMillis() / 1000);
+        issuedAt = Time.currentTime();
         return this;
     }
 

core/src/main/java/org/keycloak/representations/RefreshToken.java

@@ -13,7 +13,7 @@ public class RefreshToken extends AccessToken {
     }
 
     /**
-     * Deep copies issuer, subject, issuedFor, realmAccess, and resourceAccess
+     * Deep copies issuer, subject, issuedFor, sessionState, realmAccess, and resourceAccess
      * from AccessToken.
      *
      * @param token
@@ -23,6 +23,7 @@ public class RefreshToken extends AccessToken {
         this.issuer = token.issuer;
         this.subject = token.subject;
         this.issuedFor = token.issuedFor;
+        this.sessionState = token.sessionState;
         if (token.realmAccess != null) {
             realmAccess = token.realmAccess.clone();
         }

core/src/main/java/org/keycloak/representations/adapters/action/AdminAction.java

@@ -1,6 +1,7 @@
 package org.keycloak.representations.adapters.action;
 
 import org.codehaus.jackson.annotate.JsonIgnore;
+import org.keycloak.util.Time;
 
 /**
  * Posted to managed client from admin server.
@@ -34,8 +35,7 @@ public abstract class AdminAction {
 
     @JsonIgnore
     public boolean isExpired() {
-        long time = System.currentTimeMillis() / 1000;
-        return time > expiration;
+        return Time.currentTime() > expiration;
     }
 
     /**

core/src/main/java/org/keycloak/representations/adapters/action/LogoutAction.java

@@ -7,14 +7,17 @@ package org.keycloak.representations.adapters.action;
 public class LogoutAction extends AdminAction {
     public static final String LOGOUT = "LOGOUT";
     protected String user;
+    private String session;
     protected int notBefore;
 
     public LogoutAction() {
     }
 
-    public LogoutAction(String id, int expiration, String resource, String user, int notBefore) {
+    public LogoutAction(String id, int expiration, String resource, String user, String session, int notBefore) {
         super(id, expiration, resource, LOGOUT);
         this.user = user;
+        this.session = session;
+        this.notBefore = notBefore;
     }
 
     public String getUser() {
@@ -25,6 +28,14 @@ public class LogoutAction extends AdminAction {
         this.user = user;
     }
 
+    public String getSession() {
+        return session;
+    }
+
+    public void setSession(String session) {
+        this.session = session;
+    }
+
     public int getNotBefore() {
         return notBefore;
     }

core/src/main/java/org/keycloak/representations/adapters/action/SessionStats.java

@@ -1,8 +1,6 @@
 package org.keycloak.representations.adapters.action;
 
-import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

core/src/main/java/org/keycloak/representations/idm/ApplicationRepresentation.java

@@ -1,6 +1,5 @@
 package org.keycloak.representations.idm;
 
-import java.util.ArrayList;
 import java.util.List;
 
 /**

core/src/main/java/org/keycloak/representations/idm/AuthenticationLinkRepresentation.java

@@ -0,0 +1,26 @@
+package org.keycloak.representations.idm;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AuthenticationLinkRepresentation {
+
+    private String authProvider;
+    private String authUserId;
+
+    public String getAuthProvider() {
+        return authProvider;
+    }
+
+    public void setAuthProvider(String authProvider) {
+        this.authProvider = authProvider;
+    }
+
+    public String getAuthUserId() {
+        return authUserId;
+    }
+
+    public void setAuthUserId(String authUserId) {
+        this.authUserId = authUserId;
+    }
+}