Fix adding attributes to users over rest

Merge pull request #748 from stianst/Branch_1_0
Version bump
2014-10-08 12:11:28 +02:00 · 2014-10-08 11:11:37 +02:00 · 2014-10-08 09:30:30 +02:00 · 2014-10-03 14:12:10 +02:00 · 2014-10-03 14:11:27 +02:00 · 2014-10-03 13:24:45 +02:00
1533 changed files with 197120 additions and 45960 deletions
@@ -1,4 +1,35 @@
 keycloak
 ========

-SSO Service for web apps and REST services.
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.  
+
+Keycloak is an SSO Service for web apps and REST services.
+It can be used for social applications as well as enterprise applications.  It is based on OpenID Connect with SAML support in the works.
+Here's some of the features:
+
+* SSO and Single Log Out for browser applications
+* Social Broker.  Enable Google, Facebook, Yahoo, Twitter social login with no code required.
+* Optional LDAP/Active Directory integration
+* Optional User Registration
+* Password and TOTP support (via Google Authenticator).  Client cert auth coming soon.
+* User session management from both admin and user perspective
+* Customizable themes for user facing pages: login, grant pages, account management, emails, and admin console all customizable!
+* OAuth Bearer token auth for REST Services
+* Integrated Browser App to REST Service token propagation
+* Admin REST API
+* OAuth 2.0 Grant requests
+* CORS Support
+* CORS Web Origin management and validation
+* Completely centrally managed user and role mapping metadata.  Minimal configuration at the application side
+* Admin Console for managing users, roles, role mappings, applications, user sessions, allowed CORS web origins, and OAuth clients.
+* Deployable as a WAR, appliance, or an Openshift  cloud service (SaaS).
+* Supports JBoss AS7, EAP 6.x, and Wildfly applications.   Plans to support Node.js, RAILS, GRAILS, and other non-Java applications.
+* Javascript/HTML 5 adapter for pure Javascript apps
+* Session management from admin console
+* Revocation policies
+* Password policies
+* OpenID Connect Support
+
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-3</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui-styles</artifactId>
-	<name>Keycloak Admin UI Styles</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>
@@ -1,71 +0,0 @@
-/* http://meyerweb.com/eric/tools/css/reset/ 
-   v2.0 | 20110126
-   License: none (public domain)
-*/
-
-html, body, div, span, applet, object, iframe,
-h1, h2, h3, h4, h5, h6, p, blockquote, pre,
-a, abbr, acronym, address, big, cite, code,
-del, dfn, em, img, ins, kbd, q, s, samp,
-small, strike, strong, sub, sup, tt, var,
-b, u, i, center,
-dl, dt, dd, ol, ul, li,
-fieldset, form, label, legend,
-table, caption, tbody, tfoot, thead, tr, th, td,
-article, aside, canvas, details, embed, 
-figure, figcaption, footer, header, hgroup, 
-menu, nav, output, ruby, section, summary,
-time, mark, audio, video {
-	margin: 0;
-	padding: 0;
-	border: 0;
-	font-size: 100%;
-	font: inherit;
-	vertical-align: baseline;
-}
-/* HTML5 display-role reset for older browsers */
-article, aside, details, figcaption, figure, 
-footer, header, hgroup, menu, nav, section {
-	display: block;
-}
-body {
-	line-height: 1;
-}
-ol, ul {
-	list-style: none;
-}
-blockquote, q {
-	quotes: none;
-}
-blockquote:before, blockquote:after,
-q:before, q:after {
-	content: '';
-	content: none;
-}
-table {
-	border-collapse: collapse;
-	border-spacing: 0;
-}
-
-/* Clearfix */
-
-.clearfix:after {
-	content: ".";
-	display: block;
-	clear: both;
-	visibility: hidden;
-	line-height: 0;
-	height: 0;
-}
- 
-.clearfix {
-	display: inline-block;
-}
- 
-html[xmlns] .clearfix {
-	display: block;
-}
- 
-* html .clearfix {
-	height: 1%;
-}
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="23px" height="14px" viewBox="0 0 23 14" enable-background="new 0 0 23 14" xml:space="preserve">
-<polyline fill="none" stroke="#009AD8" stroke-miterlimit="10" points="1,13 7,7 1,1 "/>
-</svg>
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="22px" height="52px" viewBox="0 0 22 52" enable-background="new 0 0 22 52" xml:space="preserve">
-<polygon fill="#828487" points="11,16 6.818,11.818 7.525,11.111 11,14.586 14.475,11.111 15.182,11.818 "/>
-<polygon fill="#DBDADA" points="11,42 6.818,37.818 7.525,37.111 11,40.586 14.475,37.111 15.182,37.818 "/>
-</svg>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>
@@ -1,31 +0,0 @@
-<?xml version="1.0"?>
-<project>
-	<parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-		<version>1.0-alpha-3</version>
-		<relativePath>../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-admin-ui</artifactId>
-	<name>Keycloak Admin UI</name>
-	<description />
-
-	<dependencies>
-	</dependencies>
-
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-		</plugins>
-	</build>
-
-</project>
@@ -1,192 +0,0 @@
-<!doctype html>
-<html lang="en">
-
-<head>
-    <style>
-        .mock_view {
-            padding: 2em 2em;
-        }
-
-    </style>
-
-    <meta charset="utf-8">
-    <title>Keycloak Admin Console</title>
-
-    <link rel="icon" href="/auth/admin-ui/img/favicon.ico">
-
-    <!-- Frameworks -->
-    <!--link rel="stylesheet" href="/auth/admin-ui/bootstrap/css/bootstrap.css"-->
-    <link rel="stylesheet" href="/auth/admin-ui/patternfly/css/patternfly.css">
-
-    <!-- Page styles -->
-    <link rel="stylesheet" href="/auth/admin-ui/css/admin-console.css">
-    <link href="lib/select2-3.4.1/select2.css" rel="stylesheet">
-
-    <script src="lib/jquery/jquery-1.10.2.js" type="text/javascript"></script>
-    <script src="lib/select2-3.4.1/select2.js" type="text/javascript"></script>
-
-    <script src="lib/angular/angular.js"></script>
-    <script src="lib/angular/angular-resource.js"></script>
-    <script src="lib/angular/ui-bootstrap-tpls-0.4.0.js"></script>
-
-    <script src="lib/jquery/jquery.idletimer.js" type="text/javascript"></script>
-    <script src="lib/jquery/jquery.idletimeout.js" type="text/javascript"></script>
-    <script src="lib/angular/select2.js" type="text/javascript"></script>
-    <script src="lib/fileupload/angular-file-upload.min.js"></script>     <!--
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/dropdown.js"></script>
-    <script src="/auth/admin-ui/bootstrap-3.0.0-wip/js/tooltip.js"></script>
-    -->
-    <script src="/auth/admin-ui/js/bootstrap-tokenfield.js"></script>
-
-    <script src="/auth/admin-ui/bootstrap/js/bootstrap.js"></script>
-
-    <script src="js/app.js"></script>
-    <script src="js/controllers/realm.js"></script>
-    <script src="js/controllers/applications.js"></script>
-    <script src="js/controllers/oauth-clients.js"></script>
-    <script src="js/controllers/users.js"></script>
-    <script src="js/loaders.js"></script>
-    <script src="js/services.js"></script>
-
-    <style>
-        [ng\:cloak], [ng-cloak], .ng-cloak {
-            display: none !important;
-        }
-    </style>
-</head>
-
-<body class="admin-console" data-ng-controller="GlobalCtrl" ng-cloak>
-<div id="idletimeout">
-    You will be logged off in <strong><span></span> seconds</strong> due to inactivity.
-    <a id="idletimeout-resume" href="#">Click here to continue using this web page</a>.
-</div>
-
-
-<div class="feedback-aligner" data-ng-show="notification" data-ng-click="notification = null">
-    <div class="alert alert-{{notification.type}}"><strong>{{notification.header}}</strong> {{notification.message}}</div>
-</div>
-
-<header class="navbar navbar-default navbar-pf navbar-main header">
-    <nav id="kc-navigation" class="navbar" role="navigation">
-        <div class="navbar-header">
-	        	<div class="container">
-		            <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse-1">
-		                <span class="sr-only">Toggle navigation</span>
-		                <span class="icon-bar"></span>
-		                <span class="icon-bar"></span>
-		                <span class="icon-bar"></span>
-		            </button>
-		            <h1 class="navbar-title"><Strong>KeyCloak</Strong> Central Login</h1>
-	        	</div>
-        </div>
-        <div class="collapse navbar-collapse navbar-collapse-1">
-        		<div class="container">
-		            <ul class="nav navbar-nav navbar-utility" data-ng-show="auth.loggedIn">
-		                <li class="dropdown">
-		                    <a data-toggle="dropdown" class="dropdown-toggle" href="#">
-		                        <span class="pficon pficon-user"></span>
-		                        {{auth.user.displayName}}<b class="caret"></b>
-		                    </a>
-		                    <ul class="dropdown-menu">
-		                        <li><a href="/auth/rest/realms/keycloak-admin/account?referrer=admin-console">Manage Account</a></li>
-		                        <li class="separator"><a href="/auth/rest/admin/logout">Sign Out</a></li>
-		                    </ul>
-		                </li>
-		            </ul>
-		            <ul class="nav navbar-nav navbar-primary persistent-secondary" data-ng-controller="RealmDropdownCtrl">
-		                <li class="dropdown context" data-ng-show="showNav()">
-		                    <a href="#" class="dropdown-toggle" data-toggle="dropdown">
-		                        Realm: {{current.realm.id}}
-		                        <b class="caret"></b>
-		                    </a>
-		                    <ul class="dropdown-menu">
-		                        <li data-ng-repeat="realm in current.realms">
-		                            <a href="" ng-click="changeRealm(realm.id)" >{{realm.id}}</a>
-		                        </li>
-		                    </ul>
-		                </li>
-		
-		
-		                <!--------------------------------------->
-		                <li class="active">
-		                    <a href="#">Settings</a>
-		                    <ul class="nav navbar-nav navbar-persistent">
-		                        <li class="active">
-		                            <a href="#">General</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Roles</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Default Roles</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Credentials</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Token</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Keys</a>
-		                        </li>
-		                        <li>
-		                            <a href="#">Email</a>
-		                        </li>
-		                    </ul>
-		                </li>
-		                <li>
-		                    <a href="#">User</a>
-		                </li>
-		                <li>
-		                    <a href="#">Applications</a>
-		                </li>
-		                <li>
-		                    <a href="#">OAuth Clients</a>
-		                </li>
-		                <!--------------------------------------->
-		
-		
-		                <li class="active pull-right" data-ng-show="auth.loggedIn">
-		                    <a class="button primary" href="#/create/realm" data-ng-class="path[0] == 'create' && path[1] == 'realm' && 'active'"
-		                       data-ng-show="auth.loggedIn">Add Realm</a>
-		                </li>
-		            </ul>
-        		</div>
-        </div>
-    </nav>
-</header>
-
-<div class="container">
-    <div class="mock_view" data-ng-view id="view"></div>
-    <div id="loading" class="loading-backdrop">
-        <div class="loading">
-            <span>Loading...</span>
-        </div>
-    </div>
-</div>
-
-<script type="text/javascript">
-    $.idleTimeout('#idletimeout', '#idletimeout a', {
-        idleAfter: 300,
-        pollingInterval: 60,
-        keepAliveURL: '/auth/rest/admin/keepalive',
-        serverResponseEquals: '',
-        failedRequests: 1,
-        onTimeout: function(){
-            $(this).slideUp();
-            window.location = "/auth/rest/admin/logout";
-        },
-        onIdle: function(){
-            $(this).slideDown(); // show the warning bar
-        },
-        onCountdown: function( counter ){
-            $(this).find("span").html( counter ); // update the counter
-        },
-        onResume: function(){
-            $(this).slideUp(); // hide the warning bar
-        }
-    });
-</script>
-
-</body>
-</html>
@@ -1,350 +0,0 @@
-module.controller('OAuthClientClaimsCtrl', function($scope, realm, oauth, claims,
-                                                    OAuthClientClaims,
-                                                    $location, Dialog, Notifications) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-    $scope.claims = angular.copy(claims);
-
-    $scope.changed = false;
-
-    $scope.$watch('claims', function () {
-        if (!angular.equals($scope.claims, claims)) {
-            $scope.changed = true;
-        }
-    }, true);
-
-
-    $scope.save = function () {
-        OAuthClientClaims.update({
-            realm: realm.realm,
-            oauth: oauth.id
-        }, $scope.claims, function () {
-            $scope.changed = false;
-            claims = angular.copy($scope.claims);
-
-            Notifications.success("Your claim changes have been saved.");
-        });
-    };
-
-    $scope.reset = function () {
-        $location.url("/realms/" + realm.realm + "/oauth-clients/" + oauth.id + "/claims");
-    };
-
-});
-
-module.controller('OAuthClientCredentialsCtrl', function($scope, $location, realm, oauth, OAuthClientCredentials, Notifications) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-
-    var secret = OAuthClientCredentials.get({ realm : realm.realm, oauth : oauth.id },
-        function() {
-            $scope.secret = secret.value;
-        }
-    );
-
-    $scope.changePassword = function() {
-        var secret = OAuthClientCredentials.update({ realm : realm.realm,  oauth : oauth.id  },
-            function() {
-                Notifications.success('The secret has been changed.');
-                $scope.secret = secret.value;
-            },
-            function() {
-                Notifications.error("The secret was not changed due to a problem.");
-                $scope.secret = "error";
-            }
-        );
-    };
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-
-});
-
-module.controller('OAuthClientListCtrl', function($scope, realm, oauthClients, OAuthClient, $location) {
-    $scope.realm = realm;
-    $scope.oauthClients = oauthClients;
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-});
-
-module.controller('OAuthClientDetailCtrl', function($scope, realm, oauth, OAuthClient, $location, Dialog, Notifications) {
-    $scope.realm = realm;
-    $scope.create = !oauth.id;
-
-    $scope.clientTypes = [
-        "confidential",
-        "public"
-    ];
-
-    $scope.changeClientType = function() {
-        console.log('Client Type: ' + $scope.clientType);
-        if ($scope.clientType == "confidential") {
-            $scope.oauth.publicClient = false;
-        } else if ($scope.clientType == "public") {
-            $scope.oauth.publicClient = true;
-        }
-    };
-
-
-    if (!$scope.create) {
-        $scope.oauth= angular.copy(oauth);
-        $scope.clientType = $scope.clientTypes[0];
-        if (oauth.publicClient) {
-            $scope.clientType = $scope.clientTypes[1];
-        }
-    } else {
-        $scope.oauth = { enabled: true };
-        $scope.oauth.webOrigins = [];
-        $scope.oauth.redirectUris = [];
-        $scope.clientType = $scope.clientTypes[0];
-    }
-
-    $scope.$watch(function() {
-        return $location.path();
-    }, function() {
-        $scope.path = $location.path().substring(1).split("/");
-    });
-
-    $scope.$watch('oauth', function() {
-        if (!angular.equals($scope.oauth, oauth)) {
-            $scope.changed = true;
-        }
-    }, true);
-
-    $scope.deleteWebOrigin = function(index) {
-        $scope.oauth.webOrigins.splice(index, 1);
-    }
-    $scope.addWebOrigin = function() {
-        $scope.oauth.webOrigins.push($scope.newWebOrigin);
-        $scope.newWebOrigin = "";
-    }
-    $scope.deleteRedirectUri = function(index) {
-        $scope.oauth.redirectUris.splice(index, 1);
-    }
-    $scope.addRedirectUri = function() {
-        $scope.oauth.redirectUris.push($scope.newRedirectUri);
-        $scope.newRedirectUri = "";
-    }
-
-    $scope.save = function() {
-        if ($scope.create) {
-            OAuthClient.save({
-                realm: realm.realm
-            }, $scope.oauth, function (data, headers) {
-                $scope.changed = false;
-                var l = headers().location;
-                var id = l.substring(l.lastIndexOf("/") + 1);
-                $location.url("/realms/" + realm.realm + "/oauth-clients/" + id);
-                Notifications.success("The oauth client has been created.");
-            });
-        } else {
-            OAuthClient.update({
-                realm : realm.realm,
-                id : oauth.id
-            }, $scope.oauth, function() {
-                $scope.changed = false;
-                oauth = angular.copy($scope.oauth);
-                Notifications.success("Your changes have been saved to the oauth client.");
-            });
-        }
-    };
-
-    $scope.reset = function() {
-        $scope.oauth = angular.copy(oauth);
-        $scope.changed = false;
-    };
-
-    $scope.cancel = function() {
-        $location.url("/realms/" + realm.realm + "/oauth-clients");
-    };
-
-    $scope.remove = function() {
-        Dialog.confirmDelete($scope.oauth.name, 'oauth', function() {
-            $scope.oauth.$remove({
-                realm : realm.realm,
-                id : $scope.oauth.id
-            }, function() {
-                $location.url("/realms/" + realm.realm + "/oauth-clients");
-                Notifications.success("The oauth client has been deleted.");
-            });
-        });
-    };
-
-
-});
-
-module.controller('OAuthClientScopeMappingCtrl', function($scope, $http, realm, oauth, roles, applications, OAuthClientRealmScopeMapping, OAuthClientApplicationScopeMapping, ApplicationRole) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-    $scope.realmRoles = angular.copy(roles);
-    $scope.selectedRealmRoles = [];
-    $scope.selectedRealmMappings = [];
-    $scope.realmMappings = [];
-    $scope.applications = applications;
-    $scope.applicationRoles = [];
-    $scope.selectedApplicationRoles = [];
-    $scope.selectedApplicationMappings = [];
-    $scope.applicationMappings = [];
-
-
-
-    $scope.realmMappings = OAuthClientRealmScopeMapping.query({realm : realm.realm, oauth : oauth.id}, function(){
-        for (var i = 0; i < $scope.realmMappings.length; i++) {
-            var role = $scope.realmMappings[i];
-            for (var j = 0; j < $scope.realmRoles.length; j++) {
-                var realmRole = $scope.realmRoles[j];
-                if (realmRole.id == role.id) {
-                    var idx = $scope.realmRoles.indexOf(realmRole);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        break;
-                    }
-                }
-            }
-        }
-    });
-
-    $scope.addRealmRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id + '/scope-mappings/realm',
-                $scope.selectedRealmRoles).success(function() {
-                for (var i = 0; i < $scope.selectedRealmRoles.length; i++) {
-                    var role = $scope.selectedRealmRoles[i];
-                    var idx = $scope.realmRoles.indexOf($scope.selectedRealmRoles[i]);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        $scope.realmMappings.push(role);
-                    }
-                }
-                $scope.selectRealmRoles = [];
-            });
-    };
-
-    $scope.deleteRealmRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/realm',
-            {data : $scope.selectedRealmMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedRealmMappings.length; i++) {
-                    var role = $scope.selectedRealmMappings[i];
-                    var idx = $scope.realmMappings.indexOf($scope.selectedRealmMappings[i]);
-                    if (idx != -1) {
-                        $scope.realmMappings.splice(idx, 1);
-                        $scope.realmRoles.push(role);
-                    }
-                }
-                $scope.selectedRealmMappings = [];
-            });
-    };
-
-    $scope.addApplicationRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/applications/' + $scope.targetApp.name,
-                $scope.selectedApplicationRoles).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationRoles.length; i++) {
-                    var role = $scope.selectedApplicationRoles[i];
-                    var idx = $scope.applicationRoles.indexOf($scope.selectedApplicationRoles[i]);
-                    if (idx != -1) {
-                        $scope.applicationRoles.splice(idx, 1);
-                        $scope.applicationMappings.push(role);
-                    }
-                }
-                $scope.selectedApplicationRoles = [];
-            });
-    };
-
-    $scope.deleteApplicationRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/oauth-clients/' + oauth.id +  '/scope-mappings/applications/' + $scope.targetApp.name,
-            {data : $scope.selectedApplicationMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationMappings.length; i++) {
-                    var role = $scope.selectedApplicationMappings[i];
-                    var idx = $scope.applicationMappings.indexOf($scope.selectedApplicationMappings[i]);
-                    if (idx != -1) {
-                        $scope.applicationMappings.splice(idx, 1);
-                        $scope.applicationRoles.push(role);
-                    }
-                }
-                $scope.selectedApplicationMappings = [];
-            });
-    };
-
-
-    $scope.changeApplication = function() {
-        if ($scope.targetApp) {
-            $scope.applicationRoles = ApplicationRole.query({realm : realm.realm, application : $scope.targetApp.name}, function() {
-                    $scope.applicationMappings = OAuthClientApplicationScopeMapping.query({realm : realm.realm, oauth : oauth.id, targetApp : $scope.targetApp.name}, function(){
-                        for (var i = 0; i < $scope.applicationMappings.length; i++) {
-                            var role = $scope.applicationMappings[i];
-                            for (var j = 0; j < $scope.applicationRoles.length; j++) {
-                                var realmRole = $scope.applicationRoles[j];
-                                if (realmRole.id == role.id) {
-                                    var idx = $scope.applicationRoles.indexOf(realmRole);
-                                    if (idx != -1) {
-                                        $scope.applicationRoles.splice(idx, 1);
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                    });
-
-                }
-            );
-        } else {
-            $scope.targetApp = null;
-        }
-    };
-
-
-
-});
-
-
-module.controller('OAuthClientInstallationCtrl', function($scope, realm, installation, oauth, OAuthClientInstallation, $routeParams) {
-    $scope.realm = realm;
-    $scope.oauth = oauth;
-    $scope.installation = installation;
-    $scope.download = OAuthClientInstallation.url({ realm: $routeParams.realm, oauth: $routeParams.oauth });
-});
-
-module.controller('OAuthClientRevocationCtrl', function($scope, realm, oauth, OAuthClient, $location, Dialog, Notifications) {
-    $scope.oauth = oauth;
-    $scope.realm = realm;
-    var setNotBefore = function() {
-        if ($scope.oauth.notBefore == 0) {
-            $scope.notBefore = "None";
-        } else {
-            $scope.notBefore = new Date($scope.oauth.notBefore * 1000);
-        }
-    };
-
-    setNotBefore();
-
-    var refresh = function() {
-        OAuthClient.get({ realm : realm.realm, id: $scope.oauth.id }, function(updated) {
-            $scope.oauth = updated;
-            setNotBefore();
-        })
-
-    };
-
-    $scope.clear = function() {
-        $scope.oauth.notBefore = 0;
-        OAuthClient.update({ realm : realm.realm, id: $scope.oauth.id}, $scope.oauth, function () {
-            $scope.notBefore = "None";
-            Notifications.success('Not Before cleared for application.');
-            refresh();
-        });
-    }
-    $scope.setNotBeforeNow = function() {
-        $scope.oauth.notBefore = new Date().getTime()/1000;
-        OAuthClient.update({ realm : realm.realm, id: $scope.oauth.id}, $scope.oauth, function () {
-            Notifications.success('Not Before cleared for application.');
-            refresh();
-        });
-    }
-});
-
-
@@ -1,375 +0,0 @@
-module.controller('UserRoleMappingCtrl', function($scope, $http, realm, user, roles, applications, RealmRoleMapping, ApplicationRoleMapping, ApplicationRole) {
-    $scope.realm = realm;
-    $scope.user = user;
-    $scope.realmRoles = angular.copy(roles);
-    $scope.selectedRealmRoles = [];
-    $scope.selectedRealmMappings = [];
-    $scope.realmMappings = [];
-    $scope.applications = applications;
-    $scope.applicationRoles = [];
-    $scope.selectedApplicationRoles = [];
-    $scope.selectedApplicationMappings = [];
-    $scope.applicationMappings = [];
-
-    $scope.realmMappings = RealmRoleMapping.query({realm : realm.realm, userId : user.username}, function(){
-        for (var i = 0; i < $scope.realmMappings.length; i++) {
-            var role = $scope.realmMappings[i];
-            for (var j = 0; j < $scope.realmRoles.length; j++) {
-                var realmRole = $scope.realmRoles[j];
-                if (realmRole.id == role.id) {
-                    var idx = $scope.realmRoles.indexOf(realmRole);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        break;
-                    }
-                }
-            }
-        }
-    });
-
-    $scope.addRealmRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/users/' + user.username + '/role-mappings/realm',
-                $scope.selectedRealmRoles).success(function() {
-                for (var i = 0; i < $scope.selectedRealmRoles.length; i++) {
-                    var role = $scope.selectedRealmRoles[i];
-                    var idx = $scope.realmRoles.indexOf($scope.selectedRealmRoles[i]);
-                    if (idx != -1) {
-                        $scope.realmRoles.splice(idx, 1);
-                        $scope.realmMappings.push(role);
-                    }
-                }
-                $scope.selectRealmRoles = [];
-            });
-    };
-
-    $scope.deleteRealmRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/users/' + user.username + '/role-mappings/realm',
-            {data : $scope.selectedRealmMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedRealmMappings.length; i++) {
-                    var role = $scope.selectedRealmMappings[i];
-                    var idx = $scope.realmMappings.indexOf($scope.selectedRealmMappings[i]);
-                    if (idx != -1) {
-                        $scope.realmMappings.splice(idx, 1);
-                        $scope.realmRoles.push(role);
-                    }
-                }
-                $scope.selectedRealmMappings = [];
-            });
-    };
-
-    $scope.addApplicationRole = function() {
-        $http.post('/auth/rest/admin/realms/' + realm.realm + '/users/' + user.username + '/role-mappings/applications/' + $scope.application.name,
-                $scope.selectedApplicationRoles).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationRoles.length; i++) {
-                    var role = $scope.selectedApplicationRoles[i];
-                    var idx = $scope.applicationRoles.indexOf($scope.selectedApplicationRoles[i]);
-                    if (idx != -1) {
-                        $scope.applicationRoles.splice(idx, 1);
-                        $scope.applicationMappings.push(role);
-                    }
-                }
-                $scope.selectedApplicationRoles = [];
-            });
-    };
-
-    $scope.deleteApplicationRole = function() {
-        $http.delete('/auth/rest/admin/realms/' + realm.realm + '/users/' + user.username + '/role-mappings/applications/' + $scope.application.name,
-            {data : $scope.selectedApplicationMappings, headers : {"content-type" : "application/json"}}).success(function() {
-                for (var i = 0; i < $scope.selectedApplicationMappings.length; i++) {
-                    var role = $scope.selectedApplicationMappings[i];
-                    var idx = $scope.applicationMappings.indexOf($scope.selectedApplicationMappings[i]);
-                    if (idx != -1) {
-                        $scope.applicationMappings.splice(idx, 1);
-                        $scope.applicationRoles.push(role);
-                    }
-                }
-                $scope.selectedApplicationMappings = [];
-            });
-    };
-
-
-    $scope.changeApplication = function() {
-        if ($scope.application) {
-            $scope.applicationRoles = ApplicationRole.query({realm : realm.realm, userId : user.username, application : $scope.application.name}, function() {
-                    $scope.applicationMappings = ApplicationRoleMapping.query({realm : realm.realm, userId : user.username, application : $scope.application.name}, function(){
-                        for (var i = 0; i < $scope.applicationMappings.length; i++) {
-                            var role = $scope.applicationMappings[i];
-                            for (var j = 0; j < $scope.applicationRoles.length; j++) {
-                                var realmRole = $scope.applicationRoles[j];
-                                if (realmRole.id == role.id) {
-                                    var idx = $scope.applicationRoles.indexOf(realmRole);
-                                    if (idx != -1) {
-                                        $scope.applicationRoles.splice(idx, 1);
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                    });
-
-                }
-            );
-        } else {
-            $scope.applicationRoles = null;
-        }
-    };
-
-
-
-});
-
-module.controller('UserSessionsCtrl', function($scope, realm, user, stats, UserLogout, ApplicationLogoutUser, UserSessionStats, Notifications) {
-    $scope.realm = realm;
-    $scope.user = user;
-    $scope.stats = stats;
-
-    $scope.logoutAll = function() {
-        UserLogout.save({realm : realm.realm, user: user.username}, function () {
-            Notifications.success('Logged out user in all applications');
-            UserSessionStats.get({realm: realm.realm, user: user.username}, function(updated) {
-                $scope.stats = updated;
-            })
-        });
-    };
-
-    $scope.logoutApplication = function(app) {
-        console.log('log user out of app: ' + app);
-        ApplicationLogoutUser.save({realm : realm.realm, application: app, user: user.username}, function () {
-            Notifications.success('Logged out user from application');
-            UserSessionStats.get({realm: realm.realm, user: user.username}, function(updated) {
-                $scope.stats = updated;
-            })
-        });
-    };
-
-
-
-});
-
-
-module.controller('UserListCtrl', function($scope, realm, User) {
-    $scope.realm = realm;
-    $scope.searchQuery = function() {
-        $scope.searchLoaded = false;
-        $scope.currentSearch = $scope.search;
-
-        var params = { realm: realm.realm };
-        if ($scope.search) {
-            params.search = $scope.search;
-        }
-
-        $scope.users = User.query(params, function() {
-            $scope.searchLoaded = true;
-            $scope.lastSearch = params.search;
-        });
-    };
-});
-
-
-
-module.controller('UserDetailCtrl', function($scope, realm, user, User, $location, Dialog, Notifications) {
-    $scope.realm = realm;
-    $scope.user = angular.copy(user);
-    $scope.create = !user.username;
-
-    if ($scope.create) {
-        $scope.user.enabled = true;
-    }
-
-    $scope.changed = false; // $scope.create;
-
-    // ID - Name map for required actions. IDs are enum names.
-    $scope.userReqActionList = [
-        {id: "VERIFY_EMAIL", text: "Verify Email"},
-        {id: "UPDATE_PROFILE", text: "Update Profile"},
-        {id: "CONFIGURE_TOTP", text: "Configure Totp"},
-        {id: "UPDATE_PASSWORD", text: "Update Password"}
-    ];
-
-    $scope.$watch('user', function() {
-        if (!angular.equals($scope.user, user)) {
-            $scope.changed = true;
-        }
-    }, true);
-
-    $scope.save = function() {
-        if ($scope.create) {
-            User.save({
-                realm: realm.realm
-            }, $scope.user, function () {
-                $scope.changed = false;
-                user = angular.copy($scope.user);
-
-                $location.url("/realms/" + realm.realm + "/users/" + $scope.user.username);
-                Notifications.success("The user has been created.");
-            });
-        } else {
-            User.update({
-                realm: realm.realm,
-                userId: $scope.user.username
-            }, $scope.user, function () {
-                $scope.changed = false;
-                user = angular.copy($scope.user);
-                Notifications.success("Your changes have been saved to the user.");
-            });
-        }
-    };
-
-    $scope.reset = function() {
-        $scope.user = angular.copy(user);
-        $scope.changed = false;
-    };
-
-    $scope.cancel = function() {
-        $location.url("/realms/" + realm.realm + "/users");
-    };
-
-    $scope.remove = function() {
-        Dialog.confirmDelete($scope.user.username, 'user', function() {
-            $scope.user.$remove({
-                realm : realm.realm,
-                userId : $scope.user.username
-            }, function() {
-                $location.url("/realms/" + realm.realm + "/users");
-                Notifications.success("The user has been deleted.");
-            });
-        });
-    };
-});
-
-module.controller('UserCredentialsCtrl', function($scope, realm, user, User, UserCredentials, Notifications, Dialog) {
-    console.log('UserCredentialsCtrl');
-
-    $scope.realm = realm;
-    $scope.user = angular.copy(user);
-
-    $scope.isTotp = false;
-    if(!!user.totp){
-        $scope.isTotp = user.totp;
-    }
-
-    $scope.resetPassword = function() {
-        if ($scope.pwdChange) {
-            if ($scope.password != $scope.confirmPassword) {
-                Notifications.error("Password and confirmation does not match.");
-                return;
-            }
-        }
-
-        Dialog.confirm('Reset password', 'Are you sure you want to reset the users password?', function() {
-            UserCredentials.resetPassword({ realm: realm.realm, userId: user.username }, { type : "password", value : $scope.password }, function() {
-                Notifications.success("The password has been reset");
-                $scope.password = null;
-                $scope.confirmPassword = null;
-            }, function() {
-                Notifications.error("Failed to reset user password");
-            });
-        }, function() {
-            $scope.password = null;
-            $scope.confirmPassword = null;
-        });
-    };
-
-    $scope.removeTotp = function() {
-        Dialog.confirm('Remove totp', 'Are you sure you want to remove the users totp configuration?', function() {
-            UserCredentials.removeTotp({ realm: realm.realm, userId: user.username }, { }, function() {
-                Notifications.success("The users totp configuration has been removed");
-                $scope.user.totp = false;
-            }, function() {
-                Notifications.error("Failed to remove the users totp configuration");
-            });
-        });
-    };
-
-    $scope.resetPasswordEmail = function() {
-        Dialog.confirm('Reset password email', 'Are you sure you want to send password reset email to user?', function() {
-            UserCredentials.resetPasswordEmail({ realm: realm.realm, userId: user.username }, { }, function() {
-                Notifications.success("Password reset email sent to user");
-            }, function() {
-                Notifications.error("Failed to send password reset mail to user");
-            });
-        });
-    };
-
-    $scope.$watch('user', function() {
-        if (!angular.equals($scope.user, user)) {
-            $scope.userChange = true;
-        } else {
-            $scope.userChange = false;
-        }
-    }, true);
-
-    $scope.$watch('password', function() {
-        if (!!$scope.password){
-            $scope.pwdChange = true;
-        } else {
-            $scope.pwdChange = false;
-        }
-    }, true);
-
-    $scope.reset = function() {
-        $scope.password = "";
-        $scope.confirmPassword = "";
-
-        $scope.user = angular.copy(user);
-
-        $scope.isTotp = false;
-        if(!!user.totp){
-            $scope.isTotp = user.totp;
-        }
-
-        $scope.pwdChange = false;
-        $scope.userChange = false;
-    };
-});
-
-module.controller('RoleMappingCtrl', function($scope, realm, User, users, role, RoleMapping, Notifications) {
-    $scope.realm = realm;
-    $scope.realmId = realm.realm || realm.realm;
-    $scope.allUsers = User.query({ realm : $scope.realmId });
-    $scope.users = users;
-    $scope.role = role;
-
-    $scope.addUser = function() {
-        var user = $scope.newUser;
-        $scope.newUser = null;
-
-        for ( var i = 0; i < $scope.allUsers.length; i++) {
-            if ($scope.allUsers[i].userId == user) {
-                user = $scope.allUsers[i];
-                RoleMapping.save({
-                    realm : $scope.realmId,
-                    role : role
-                }, user, function() {
-                    $scope.users = RoleMapping.query({
-                        realm : $scope.realmId,
-                        role : role
-                    });
-                    Notifications.success("The role mapping has been added for the user.");
-                });
-            }
-        }
-    }
-
-    $scope.removeUser = function(userId) {
-        for (var i = 0; i < $scope.users.length; i++) {
-            var user = $scope.users[i];
-            if ($scope.users[i].userId == userId) {
-                RoleMapping.delete({
-                    realm : $scope.realmId,
-                    role : role
-                }, user, function() {
-                    $scope.users = RoleMapping.query({
-                        realm : $scope.realmId,
-                        role : role
-                    });
-
-                    Notifications.success("The role mapping has been removed for the user.");
-                });
-            }
-        }
-    }
-});
-
-
-
@@ -1,185 +0,0 @@
-/*
- * jQuery Idle Timeout 1.1
- * Copyright (c) 2011 Eric Hynds
- *
- * http://www.erichynds.com/jquery/a-new-and-improved-jquery-idle-timeout-plugin/
- *
- * Depends:
- *  - jQuery 1.4.2+
- *  - jQuery Idle Timer (by Paul Irish, http://paulirish.com/2009/jquery-idletimer-plugin/)
- *
- * Dual licensed under the MIT and GPL licenses:
- *   http://www.opensource.org/licenses/mit-license.php
- *   http://www.gnu.org/licenses/gpl.html
- *
- */
-
-(function($, win){
-
-    var idleTimeout = {
-        init: function( element, resume, options ){
-            var self = this, elem;
-
-            this.warning = elem = $(element);
-            this.resume = $(resume);
-            this.options = options;
-            this.countdownOpen = false;
-            this.failedRequests = options.failedRequests;
-            this._startTimer();
-
-            // expose obj to data cache so peeps can call internal methods
-            $.data( elem[0], 'idletimout', this );
-
-            // start the idle timer
-            $.idleTimer(options.idleAfter * 1000);
-
-            // once the user becomes idle
-            $(document).bind("idle.idleTimer", function(){
-
-                // if the user is idle and a countdown isn't already running
-                if( $.data(document, 'idleTimer') === 'idle' && !self.countdownOpen ){
-                    self._stopTimer();
-                    self.countdownOpen = true;
-                    self._idle();
-                }
-            });
-
-            // bind continue link
-            this.resume.bind("click", function(e){
-                e.preventDefault();
-
-                win.clearInterval(self.countdown); // stop the countdown
-                self.countdownOpen = false; // stop countdown
-                self._startTimer(); // start up the timer again
-                self._keepAlive( false ); // ping server
-                options.onResume.call( self.warning ); // call the resume callback
-            });
-        },
-
-        _idle: function(){
-            var self = this,
-                options = this.options,
-                warning = this.warning[0],
-                counter = options.warningLength;
-
-            // fire the onIdle function
-            options.onIdle.call(warning);
-
-            // set inital value in the countdown placeholder
-            options.onCountdown.call(warning, counter);
-
-            // create a timer that runs every second
-            this.countdown = win.setInterval(function(){
-                if(--counter === 0){
-                    window.clearInterval(self.countdown);
-                    options.onTimeout.call(warning);
-                } else {
-                    options.onCountdown.call(warning, counter);
-                }
-            }, 1000);
-        },
-
-        _startTimer: function(){
-            var self = this;
-
-            if (this.options.pollingInterval > 0) {
-                this.timer = win.setTimeout(function () {
-                    self._keepAlive();
-                }, this.options.pollingInterval * 1000);
-            }
-        },
-
-        _stopTimer: function(){
-            // reset the failed requests counter
-            this.failedRequests = this.options.failedRequests;
-            win.clearTimeout(this.timer);
-        },
-
-        _keepAlive: function( recurse ){
-            var self = this,
-                options = this.options;
-
-            if( typeof recurse === "undefined" ){
-                recurse = true;
-            }
-
-            // if too many requests failed, abort
-            if( !this.failedRequests ){
-                console.log('aborting...');
-                this._stopTimer();
-                options.onAbort.call( this.warning[0] );
-                return;
-            }
-
-            $.ajax({
-                timeout: options.AJAXTimeout,
-                url: options.keepAliveURL,
-                error: function(){
-                    console.log('failure for keepalive');
-                    self.failedRequests--;
-                },
-                success: function(response){
-                    console.log('success for keepalive');
-/*                    if($.trim(response) !== options.serverResponseEquals){
-                        self.failedRequests--;
-                    }*/
-                },
-                complete: function(){
-                    if( recurse ){
-                        self._startTimer();
-                    }
-                }
-            });
-        }
-    };
-
-    // expose
-    $.idleTimeout = function(element, resume, options){
-        idleTimeout.init( element, resume, $.extend($.idleTimeout.options, options) );
-        return this;
-    };
-
-    // options
-    $.idleTimeout.options = {
-        // number of seconds after user is idle to show the warning
-        warningLength: 30,
-
-        // url to call to keep the session alive while the user is active
-        keepAliveURL: "",
-
-        // the response from keepAliveURL must equal this text:
-        serverResponseEquals: "OK",
-
-        // user is considered idle after this many seconds.  10 minutes default
-        idleAfter: 600,
-
-        // a polling request will be sent to the server every X seconds
-        pollingInterval: 60,
-
-        // number of failed polling requests until we abort this script
-        failedRequests: 5,
-
-        // the $.ajax timeout in MILLISECONDS!
-        AJAXTimeout: 250,
-
-        /*
-         Callbacks
-         "this" refers to the element found by the first selector passed to $.idleTimeout.
-         */
-        // callback to fire when the session times out
-        onTimeout: $.noop,
-
-        // fires when the user becomes idle
-        onIdle: $.noop,
-
-        // fires during each second of warningLength
-        onCountdown: $.noop,
-
-        // fires when the user resumes the session
-        onResume: $.noop,
-
-        // callback to fire when the script is aborted due to too many failed requests
-        onAbort: $.noop
-    };
-
-})(jQuery, window);
@@ -1,116 +0,0 @@
-(function($){
-
-    $.idleTimer = function f(newTimeout){
-
-        //$.idleTimer.tId = -1     //timeout ID
-
-        var idle    = false,        //indicates if the user is idle
-            enabled = true,        //indicates if the idle timer is enabled
-            timeout = 30000,        //the amount of time (ms) before the user is considered idle
-            events  = 'mousemove keydown DOMMouseScroll mousewheel mousedown', // activity is one of these events
-        //f.olddate = undefined, // olddate used for getElapsedTime. stored on the function
-
-        /* (intentionally not documented)
-         * Toggles the idle state and fires an appropriate event.
-         * @return {void}
-         */
-            toggleIdleState = function(){
-
-                //toggle the state
-                idle = !idle;
-
-                // reset timeout counter
-                f.olddate = +new Date;
-
-                //fire appropriate event
-                $(document).trigger(  $.data(document,'idleTimer', idle ? "idle" : "active" )  + '.idleTimer');
-            },
-
-            /**
-             * Stops the idle timer. This removes appropriate event handlers
-             * and cancels any pending timeouts.
-             * @return {void}
-             * @method stop
-             * @static
-             */
-                stop = function(){
-
-                //set to disabled
-                enabled = false;
-
-                //clear any pending timeouts
-                clearTimeout($.idleTimer.tId);
-
-                //detach the event handlers
-                $(document).unbind('.idleTimer');
-            },
-
-
-        /* (intentionally not documented)
-         * Handles a user event indicating that the user isn't idle.
-         * @param {Event} event A DOM2-normalized event object.
-         * @return {void}
-         */
-            handleUserEvent = function(){
-
-                //clear any existing timeout
-                clearTimeout($.idleTimer.tId);
-
-
-
-                //if the idle timer is enabled
-                if (enabled){
-
-
-                    //if it's idle, that means the user is no longer idle
-                    if (idle){
-                        toggleIdleState();
-                    }
-
-                    //set a new timeout
-                    $.idleTimer.tId = setTimeout(toggleIdleState, timeout);
-
-                }
-            };
-
-
-        /**
-         * Starts the idle timer. This adds appropriate event handlers
-         * and starts the first timeout.
-         * @param {int} newTimeout (Optional) A new value for the timeout period in ms.
-         * @return {void}
-         * @method $.idleTimer
-         * @static
-         */
-
-
-        f.olddate = f.olddate || +new Date;
-
-        //assign a new timeout if necessary
-        if (typeof newTimeout == "number"){
-            timeout = newTimeout;
-        } else if (newTimeout === 'destroy') {
-            stop();
-            return this;
-        } else if (newTimeout === 'getElapsedTime'){
-            return (+new Date) - f.olddate;
-        }
-
-        //assign appropriate event handlers
-        $(document).bind($.trim((events+' ').split(' ').join('.idleTimer ')),handleUserEvent);
-
-
-        //set a timeout to toggle state
-        $.idleTimer.tId = setTimeout(toggleIdleState, timeout);
-
-        // assume the user is active for the first x seconds.
-        $.data(document,'idleTimer',"active");
-
-
-
-
-    }; // end of $.idleTimer()
-
-
-
-})(jQuery);
@@ -1,29 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-    </ul>
-    <div id="content">
-        <ol class="breadcrumb" data-ng-hide="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
-            <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">{{application.name}}</a></li>
-            <li class="active">Claims</li>
-        </ol>
-        <h2 data-ng-hide="create"><span>{{application.name}}</span> Allowed Claims</h2>
-        <form class="form-horizontal" name="claimForm">
-            <div data-ng-include data-src="'partials/claims.html'"></div>
-            <div class="pull-right form-actions" data-ng-show="access.manageApplications">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,136 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-    </ul>
-    <div id="content">
-        <ol class="breadcrumb" data-ng-show="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
-            <li class="active">Add Application</li>
-        </ol>
-        <h2 data-ng-show="create"><span>{{realm.realm}}</span> Add Application</h2>
-        <p class="subtitle" data-ng-show="create"><span class="required">*</span> Required fields</p>
-        <ol class="breadcrumb" data-ng-hide="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
-            <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">{{application.name}}</a></li>
-            <li class="active">Settings</li>
-        </ol>
-        <h2 data-ng-hide="create"><span>{{application.name}}</span> Settings</h2>
-        <form class="form-horizontal" name="applicationForm" novalidate kc-read-only="!access.manageApplications">
-            <fieldset class="border-top">
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="create">*</span></label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="name" name="name" data-ng-model="application.name" autofocus required>
-                    </div>
-                </div>
-                <div class="form-group clearfix block">
-                    <label class="col-sm-2 control-label" for="enabled">Enabled</label>
-                    <div class="col-sm-4">
-                        <input ng-model="application.enabled" name="enabled" id="enabled" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="clientType">Client Type</label>
-                    <div class="col-sm-4">
-                        <div class="select-kc">
-                            <select id="clientType"
-                                    ng-change="changeClientType()"
-                                    ng-model="clientType"
-                                    ng-options="cType for cType in clientTypes">
-                            </select>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group" data-ng-show="!application.bearerOnly">
-                    <label class="col-sm-2 control-label" for="newRedirectUri">Redirect URI <span class="required" data-ng-show="create">*</span></label>
-                    <div class="col-sm-6">
-                        <div ng-repeat="redirectUri in application.redirectUris" class="row kc-item-deletable">
-                            <div class="col-sm-8">
-                                <input class="form-control" type="text" data-ng-class="{'input-below':!$first}"
-                                       name="redirectUri" id="redirectUri" data-ng-model="redirectUri" readonly />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-danger" type="button" data-ng-click="deleteRedirectUri($index)">
-                                    Delete</button>
-                            </div>
-                        </div>
-
-                        <div class="row">
-                            <div class="col-sm-8">
-                                <input class="form-control" type="text" name="newRedirectUri" id="newRedirectUri"
-                                       placeholder="New Redirect URI..." data-ng-model="newRedirectUri"
-                                       data-ng-class="{'input-below':application.redirectUris.length}" />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-primary" data-ng-click="addRedirectUri()" ng-show="newRedirectUri.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="baseUrl">Base URL</label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" name="baseUrl" id="baseUrl"
-                               data-ng-model="application.baseUrl">
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="adminUrl">Admin URL</label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" name="adminUrl" id="adminUrl"
-                               data-ng-model="application.adminUrl">
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="newWebOrigin">Web Origin</label>
-                    <div class="col-sm-6">
-                        <div ng-repeat="webOrigin in application.webOrigins" class="row kc-item-deletable">
-                                <div class="col-sm-8">
-                                    <input class="form-control kc-button-control"
-                                           type="text" data-ng-class="{'input-below':!$first}"
-                                           name="webOrigin" id="webOrigin"
-                                           data-ng-model="webOrigin" readonly/>
-                                </div>
-                                <div class="col-sm-2">
-                                    <button class="btn btn-danger"
-                                            type="button" data-ng-click="deleteWebOrigin($index)">Delete</button>
-                                </div>
-                        </div>
-                        <div class="row">
-                            <div class="col-sm-8">
-                                <input class="form-control kc-button-control"
-                                       type="text" name="newWebOrigin" id="newWebOrigin"
-                                       placeholder="New Web Origin..." data-ng-model="newWebOrigin"
-                                       data-ng-class="{'input-below':application.webOrigins.length}"/>
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-primary"
-                                        data-ng-click="addWebOrigin()" ng-show="newWebOrigin.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </fieldset>
-
-            <div class="pull-right form-actions" data-ng-show="create && access.manageApplications">
-                <button kc-cancel data-ng-click="cancel()">Cancel</button>
-                <button kc-save data-ng-show="changed">Save</button>
-            </div>
-            <div class="pull-right form-actions" data-ng-show="!create && access.manageApplications">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-                <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,60 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-    </ul>
-    <div id="content">
-        <ol class="breadcrumb">
-            <li><a href="#/realms/{{realm.realm}}">{{application.name}}</a></li>
-            <li class="active">Application Sessions</li>
-        </ol>
-        <h2><span>{{application.name}}</span> Sessions</h2>
-        <form class="form-horizontal" name="sessionStats">
-            <fieldset class="border-top">
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="activeSessions">Active Sessions</label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="activeSessions" name="activeSessions" data-ng-model="stats.activeSessions" ng-disabled="true">
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="activeUsers">Active Users</label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="activeUsers" name="activeUsers" data-ng-model="stats.activeUsers" ng-disabled="true">
-                    </div>
-                </div>
-            </fieldset>
-        </form>
-        <table class="table" data-ng-show="stats.activeSessions > 0">
-            <thead>
-            <tr>
-                <th class="kc-table-actions" colspan="3">
-                    <div class="pull-right">
-                        <a class="btn btn-primary" ng-click="logoutAll()">Invalidate All Sessions</a>
-                        <a class="btn btn-primary" ng-click="loadUsers()">Show Users</a>
-                    </div>
-                </th>
-            </tr>
-            <tr>
-                <th>User</th>
-                <th>Login Time</th>
-                <th></th>
-            </tr>
-            </thead>
-            <tbody>
-            <tr data-ng-repeat="(user, data) in users">
-                <td><a href="#/realms/{{realm.realm}}/users/{{user}}">{{user}}</a></td>
-                <td>{{data.whenLoggedIn | date:'medium'}}</td>
-                <td><a ng-click="logoutUser(user)">invalidate session</a> </td>
-            </tr>
-            </tbody>
-        </table>
-    </div>
-</div>
@@ -1,21 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/credentials">Credentials</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/revocation">Revocation</a></li>
-    </ul>
-    <div id="content">
-        <h2 data-ng-hide="create"><span>{{oauth.name}}</span> Allowed Claims</h2>
-        <form class="form-horizontal" name="claimForm">
-            <div data-ng-include data-src="'partials/claims.html'"></div>
-            <div class="pull-right form-actions" data-ng-show="access.manageClients">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,118 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create">
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/revocation">Revocation</a></li>
-    </ul>
-    <div id="content">
-        <ol class="breadcrumb" data-ng-show="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-            <li class="active">Add OAuth Client</li>
-        </ol>
-        <h2 data-ng-show="create"><span>{{realm.realm}}</span> Add OAuth Client</h2>
-        <p class="subtitle" data-ng-show="create"><span class="required">*</span> Required fields</p>
-        <ol class="breadcrumb" data-ng-hide="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">{{oauth.name}}</a></li>
-            <li class="active">Settings</li>
-        </ol>
-        <h2 data-ng-hide="create"><span>{{oauth.name}}</span> Settings</h2>
-        <form class="form-horizontal" name="oauthForm" novalidate kc-read-only="!access.manageClients">
-            <fieldset class="border-top">
-
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="name">Name <span class="required" data-ng-show="create">*</span></label>
-                    <div class="col-sm-4">
-                        <input class="form-control" type="text" id="name" name="name" data-ng-model="oauth.name" autofocus
-                               required>
-                    </div>
-                </div>
-
-                <div class="form-group clearfix block">
-                    <label class="col-sm-2 control-label" for="enabled">Enabled</label>
-                    <div class="col-sm-4">
-                        <input ng-model="oauth.enabled" name="enabled" id="enabled" onoffswitch />
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="clientType">Client Type</label>
-                    <div class="col-sm-4">
-                        <div class="select-kc">
-                            <select id="clientType"
-                                    ng-change="changeClientType()"
-                                    ng-model="clientType"
-                                    ng-options="cType for cType in clientTypes">
-                            </select>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="newRedirectUri">Redirect URI <span class="required" data-ng-show="create">*</span></label>
-                    <div class="col-sm-6">
-                        <div ng-repeat="redirectUri in oauth.redirectUris" class="kc-item-deletable row">
-                            <div class="col-sm-8">
-                                <input  class="form-control" type="text" data-ng-class="{'input-below':!$first}"
-                                        name="redirectUri" id="redirectUri" data-ng-model="redirectUri" readonly />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-danger" type="button" data-ng-click="deleteRedirectUri($index)">
-                                    Delete</button>
-                            </div>
-                        </div>
-                        <div class="row">
-                            <div class="col-sm-8">
-                                <input  class="form-control" type="text" name="newRedirectUri" id="newRedirectUri"
-                                        placeholder="New Redirect URI..." data-ng-model="newRedirectUri"
-                                        data-ng-class="{'input-below':oauth.redirectUris.length}" />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-primary" data-ng-click="addRedirectUri()" ng-show="newRedirectUri.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="newWebOrigin">Web Origin</label>
-                    <div class="col-sm-6">
-                        <div ng-repeat="webOrigin in oauth.webOrigins" class="kc-item-deletable row">
-                            <div class="col-sm-8">
-                                <input  class="form-control" type="text" data-ng-class="{'input-below':!$first}"
-                                        name="webOrigin" id="webOrigin" data-ng-model="webOrigin" readonly />
-                            </div>
-                            <div class="col-sm-2">
-                                <button class="btn btn-danger" type="button" data-ng-click="deleteWebOrigin($index)">
-                                    Delete</button>
-                            </div>
-                        </div>
-                        <div class="row">
-                            <div class="col-sm-8">
-                                <input  class="form-control" type="text" name="newWebOrigin" id="newWebOrigin"
-                                        placeholder="New Web Origin..." data-ng-model="newWebOrigin"
-                                        data-ng-class="{'input-below':oauth.webOrigins.length}" />
-                            </div>
-                            <div class="col-sm-2">
-                                <button  class="btn btn-primary" data-ng-click="addWebOrigin()" ng-show="newWebOrigin.length > 0">Add</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </fieldset>
-
-            <div class="pull-right form-actions" data-ng-show="create && access.manageClients">
-                <button kc-cancel data-ng-click="cancel()">Cancel</button>
-                <button kc-save data-ng-show="changed">Save</button>
-            </div>
-            <div class="pull-right form-actions" data-ng-show="!create && access.manageClients">
-                <button kc-reset data-ng-show="changed">Clear changes</button>
-                <button kc-save  data-ng-show="changed">Save</button>
-                <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
-            </div>
-        </form>
-    </div>
-</div>
@@ -1,28 +0,0 @@
-<div class="bs-sidebar col-sm-3" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/scope-mappings">Scope</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/revocation">Revocation</a></li>
-    </ul>
-    <div id="content">
-        <h2>OAuth Client Installation</h2>
-        <form class="form-horizontal" name="realmForm" novalidate>
-            <fieldset>
-                <div class="form-group">
-                    <div class="col-sm-12">
-                        <textarea class="form-control" rows="20" kc-select-action="click">{{installation | json}}</textarea>
-                    </div>
-                </div>
-            </fieldset>
-        </form>
-
-        <div class="pull-right form-actions">
-            <a class="btn btn-primary btn-lg" href="{{download}}" download="keycloak.json" type="submit">Download</a>
-        </div>
-
-    </div>
-</div>
@@ -1,100 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/claims">Claims</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/installation">Installation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}/revocation">Revocation</a></li>
-    </ul>
-
-    <div id="content">
-        <ol class="breadcrumb" data-ng-hide="create">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-            <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.id}}">{{oauth.name}}</a></li>
-            <li class="active">Scope</li>
-        </ol>
-        <h2><span>{{oauth.name}}</span> Scope Mappings</h2>
-        <p class="subtitle"></p>
-        <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageClients">
-            <fieldset>
-                <legend><span class="text">Realm Roles</span></legend>
-                <div class="form-group col-sm-10">
-                    <div class="controls changing-selectors">
-                        <div class="select-title">
-                            <label class="control-label" for="available">Available Roles</label>
-                            <select id="available" class="form-control" multiple size="5"
-                                    ng-multiple="true"
-                                    ng-model="selectedRealmRoles"
-                                    ng-options="r.name for r in realmRoles">
-                            </select>
-                        </div>
-                        <div class="middle-buttons kc-vertical">
-                            <button class="kc-button" type="submit" ng-click="addRealmRole()" tooltip="Move right" tooltip-placement="right">
-                                <span class="kc-icon-arrow-right">Move right</span>
-                            </button>
-                            <button class="kc-button" type="submit" ng-click="deleteRealmRole()" tooltip="Move left" tooltip-placement="right">
-                                <span class="kc-icon-arrow-left">Move left</span>
-                            </button>
-                        </div>
-                        <div class="select-title">
-                            <label class="control-label" for="assigned">Assigned Roles</label>
-                            <select id="assigned" class="form-control" multiple size=5
-                                    ng-multiple="true"
-                                    ng-model="selectedRealmMappings"
-                                    ng-options="r.name for r in realmMappings">
-                            </select>
-                        </div>
-                    </div>
-                </div>
-            </fieldset>
-
-            <fieldset ng-show="applications.length > 0">
-                <legend><span class="text">Application Roles</span> </legend>
-                <div class="form-group input-select">
-                    <label class="col-sm-2 control-label" for="applications">Application</label>
-                    <div class="col-sm-4">
-                        <div class="input-group">
-                            <div class="select-kc">
-                                <select id="applications" name="applications" ng-change="changeApplication()" ng-model="targetApp" ng-options="a.name for a in (applications)" ng-disabled="false">
-                                    <option value="" selected> Select an Application </option>
-                                </select>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="form-group" data-ng-show="targetApp">
-                    <div class="controls changing-selectors col-sm-10">
-                        <div class="select-title">
-                            <label class="control-label" for="app-available">Available Roles</label>
-                            <select id="app-available" class="form-control" multiple size="5"
-                                    ng-multiple="true"
-                                    ng-model="selectedApplicationRoles"
-                                    ng-options="r.name for r in applicationRoles">
-                            </select>
-                        </div>
-                        <div class="middle-buttons kc-vertical">
-                            <button class="kc-button" type="submit" ng-click="addApplicationRole()" tooltip="Move right" tooltip-placement="right">
-                                <span class="kc-icon-arrow-right">Move right</span>
-                            </button>
-                            <button class="kc-button" type="submit" ng-click="deleteApplicationRole()" tooltip="Move left" tooltip-placement="right">
-                                <span class="kc-icon-arrow-left">Move left</span>
-                            </button>
-                        </div>
-                        <div class="select-title">
-                            <label class="control-label" for="app-assigned">Assigned Roles</label>
-                            <select id="app-assigned" class="form-control" multiple size=5
-                                    ng-multiple="true"
-                                    ng-model="selectedApplicationMappings"
-                                    ng-options="r.name for r in applicationMappings">
-                            </select>
-                        </div>
-                    </div>
-                </div>
-            </fieldset>
-        </form>
-    </div>
-</div>
@@ -1,10 +0,0 @@
-<ul data-ng-hide="createRealm">
-    <li data-ng-show="access.viewRealm" data-ng-class="((!path[2] || path[1] == 'role' || path[2] == 'roles' || path[2] == 'token-settings' ||
-    path[2] == 'social-settings' || path[2] == 'required-credentials' || path[2] == 'default-roles' || path[2] == 'registration-settings' ||
-    path[2] == 'keys-settings' || path[2] == 'smtp-settings') && path[3] != 'applications') && 'active'"><a href="#/realms/{{realm.realm}}">Settings</a></li>
-    <li data-ng-show="access.viewUsers" data-ng-class="(path[2] == 'users' || path[1] == 'user') && 'active'"><a href="#/realms/{{realm.realm}}/users">Users</a>
-    </li>
-    <li data-ng-show="access.viewApplications" data-ng-class="(path[2] == 'applications' || path[1] == 'application' || path[3] == 'applications') && 'active'"><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
-    <li data-ng-show="access.viewClients" data-ng-class="(path[2] == 'oauth-clients' || path[1] == 'oauth-client') && 'active'"><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
-    <li data-ng-show="access.viewRealm" data-ng-class="(path[2] == 'sessions') && 'active'"><a href="#/realms/{{realm.realm}}/sessions/revocation">Sessions</a></li>
-</ul>
@@ -1,47 +0,0 @@
-<div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
-<div id="content-area" class="col-md-9" role="main">
-
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}">Attributes</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/users/{{user.username}}/user-credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/role-mappings">Role Mappings</a></li>
-        <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}/sessions">Sessions</a></li>
-    </ul>
-
-    <div id="content">
-        <ol class="breadcrumb">
-            <li><a href="#/realms/{{realm.realm}}">{{realm.realm}}</a></li>
-            <li class="active">Users</li>
-        </ol>
-        <h2><span>{{user.username}}'s</span> Credentials</h2>
-
-        <form class="form-horizontal" name="userForm" novalidate>
-            <fieldset class="border-top">
-                <legend><span class="text">Credential Management</span></legend>
-                <div class="form-group">
-                    <label class="col-sm-2 control-label" for="password">Reset password</label>
-                    <div class="col-sm-4 kc-multiline">
-                        <input class="form-control" type="password" id="password" name="password" data-ng-model="password" placeholder="Temporary password" required>
-                        <input class="form-control" type="password" id="confirmPassword" name="confirmPassword" data-ng-model="confirmPassword" placeholder="Password confirmation" required>
-                        <button class="btn btn-danger" type="submit" data-ng-click="resetPassword()" data-ng-show="password">Reset Password</button>
-                    </div>
-                </div>
-
-                <div class="form-group" data-ng-show="user.email">
-                    <label class="col-sm-2 control-label" for="password">Reset password email</label>
-                    <div class="col-sm-4">
-                        <button class="btn btn-danger" type="submit" data-ng-click="resetPasswordEmail()" >Send Email</button>
-                    </div>
-                </div>
-
-                <div class="form-group" data-ng-show="user.totp">
-                    <label class="col-sm-2 control-label" for="password">Remove totp</label>
-                    <div class="col-sm-4" data-ng-show="user.totp">
-                        <button class="btn btn-danger"  type="submit" data-ng-click="removeTotp()">Remove TOTP</button>
-                    </div>
-                </div>
-            </fieldset>
-        </form>
-
-    </div>
-</div>
@@ -1,14 +0,0 @@
-<div class="modal-dialog" tabindex="-1" role="dialog">
-    <div class="modal-content">
-        <div class="modal-header">
-            <button type="button" class="close" data-dismiss="modal" aria-hidden="true">
-                <span class="pficon pficon-close"></span>
-            </button>
-            <h4 class="modal-title" id="myModalLabel">{{ title }}</h4>
-        </div>
-        <div class="modal-body"><p ng-bind-html-unsafe="message"></p></div>
-        <div class="modal-footer">
-            <button ng-repeat="btn in buttons" ng-click="close(btn.result)" class="" ng-class="btn.cssClass">{{ btn.label }}</button>
-        </div>
-    </div>
-</div>
@@ -1,10 +0,0 @@
-<ul class="nav nav-tabs nav-tabs-pf">
-    <li ng-class="{active: !path[2]}"><a href="#/realms/{{realm.realm}}">General</a></li>
-    <li ng-class="{active: path[2] == 'social'}" data-ng-show="realm.social && access.viewRealm"><a href="#/realms/{{realm.realm}}/social-settings">Social</a></li>
-    <li ng-class="{active: path[2] == 'roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/roles">Roles</a></li>
-    <li ng-class="{active: path[2] == 'default-roles'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/default-roles">Default Roles</a></li>
-    <li ng-class="{active: path[2] == 'required-credentials'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/required-credentials">Credentials</a></li>
-    <li ng-class="{active: path[2] == 'token-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/token-settings">Token</a></li>
-    <li ng-class="{active: path[2] == 'keys-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/keys-settings">Keys</a></li>
-    <li ng-class="{active: path[2] == 'smtp-settings'}" data-ng-show="access.viewRealm"><a href="#/realms/{{realm.realm}}/smtp-settings">Email</a></li>
-</ul>
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<web-fragment version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
-              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-fragment_3_0.xsd ">
-</web-fragment>
@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.2.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-jpa</artifactId>
+    <name>Keycloak Connections JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>
@@ -0,0 +1,26 @@
+package org.keycloak.connections.jpa;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProvider implements JpaConnectionProvider {
+
+    private final EntityManager em;
+
+    public DefaultJpaConnectionProvider(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public EntityManager getEntityManager() {
+        return em;
+    }
+
+    @Override
+    public void close() {
+        em.close();
+    }
+
+}
@@ -0,0 +1,101 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.ejb.AvailableSettings;
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProviderFactory implements JpaConnectionProviderFactory {
+
+    private volatile EntityManagerFactory emf;
+
+    private Config.Scope config;
+
+    @Override
+    public JpaConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        EntityManager em = emf.createEntityManager();
+        em = PersistenceExceptionConverter.create(em);
+        session.getTransaction().enlist(new JpaKeycloakTransaction(em));
+        return new DefaultJpaConnectionProvider(em);
+    }
+
+    @Override
+    public void close() {
+        if (emf != null) {
+            emf.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (emf == null) {
+            synchronized (this) {
+                if (emf == null) {
+                    String unitName = config.get("unitName");
+                    Map<String, Object> properties = new HashMap<String, Object>();
+
+                    // Only load config from keycloak-server.json if unitName is not specified
+                    if (unitName == null) {
+                        unitName = "keycloak-default";
+
+                        String dataSource = config.get("dataSource");
+                        if (dataSource != null) {
+                            if (config.getBoolean("jta", false)) {
+                                properties.put(AvailableSettings.JTA_DATASOURCE, dataSource);
+                            } else {
+                                properties.put(AvailableSettings.NON_JTA_DATASOURCE, dataSource);
+                            }
+                        } else {
+                            properties.put(AvailableSettings.JDBC_URL, config.get("url"));
+                            properties.put(AvailableSettings.JDBC_DRIVER, config.get("driver"));
+
+                            String user = config.get("user");
+                            if (user != null) {
+                                properties.put(AvailableSettings.JDBC_USER, user);
+                            }
+                            String password = config.get("password");
+                            if (password != null) {
+                                properties.put(AvailableSettings.JDBC_PASSWORD, password);
+                            }
+                        }
+
+                        String driverDialect = config.get("driverDialect");
+                        if (driverDialect != null && driverDialect.length() > 0) {
+                            properties.put("hibernate.dialect", driverDialect);
+                        }
+
+                        String databaseSchema = config.get("databaseSchema", "validate");
+                        if (databaseSchema != null) {
+                            properties.put("hibernate.hbm2ddl.auto", databaseSchema);
+                        }
+
+                        properties.put("hibernate.show_sql", config.getBoolean("showSql", false));
+                        properties.put("hibernate.format_sql", config.getBoolean("formatSql", true));
+                    }
+
+                    emf = Persistence.createEntityManagerFactory(unitName, properties);
+                }
+            }
+        }
+    }
+
+}
@@ -0,0 +1,14 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProvider extends Provider {
+
+    EntityManager getEntityManager();
+
+}
@@ -0,0 +1,9 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProviderFactory extends ProviderFactory<JpaConnectionProvider> {
+}
@@ -0,0 +1,27 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsJpa";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return JpaConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return JpaConnectionProviderFactory.class;
+    }
+
+}
@@ -0,0 +1,53 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}
@@ -0,0 +1,48 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}
@@ -2,24 +2,35 @@
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
    version="1.0">
-    <persistence-unit name="jpa-keycloak-identity-store" transaction-type="RESOURCE_LOCAL">
-        <jta-data-source>java:jboss/datasources/ExampleDS</jta-data-source>
+    <persistence-unit name="keycloak-default" transaction-type="RESOURCE_LOCAL">
        <class>org.keycloak.models.jpa.entities.ApplicationEntity</class>
        <class>org.keycloak.models.jpa.entities.CredentialEntity</class>
        <class>org.keycloak.models.jpa.entities.OAuthClientEntity</class>
        <class>org.keycloak.models.jpa.entities.RealmEntity</class>
+        <class>org.keycloak.models.jpa.entities.RealmAttributeEntity</class>
        <class>org.keycloak.models.jpa.entities.RequiredCredentialEntity</class>
-        <class>org.keycloak.models.jpa.entities.ApplicationRoleEntity</class>
-        <class>org.keycloak.models.jpa.entities.RealmRoleEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserFederationProviderEntity</class>
+        <class>org.keycloak.models.jpa.entities.RoleEntity</class>
        <class>org.keycloak.models.jpa.entities.SocialLinkEntity</class>
        <class>org.keycloak.models.jpa.entities.UserEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserRequiredActionEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserAttributeEntity</class>
        <class>org.keycloak.models.jpa.entities.UserRoleMappingEntity</class>
        <class>org.keycloak.models.jpa.entities.ScopeMappingEntity</class>

-        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+        <!-- JpaUserSessionProvider -->
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionRoleEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UserSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UsernameLoginFailureEntity</class>

+        <!-- JpaAuditProvider -->
+        <class>org.keycloak.events.jpa.EventEntity</class>
+
+        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+        
        <properties>
-            <property name="hibernate.hbm2ddl.auto" value="update" />
+            <property name="jboss.as.jpa.managed" value="false"/>
        </properties>
    </persistence-unit>
 </persistence>
@@ -0,0 +1 @@
+org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.connections.jpa.JpaConnectionSpi
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.2.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-mongo</artifactId>
+    <name>Keycloak Connections Mongo</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+</project>
@@ -0,0 +1,111 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.connections.mongo.impl.context.TransactionMongoStoreInvocationContext;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Collections;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionFactoryProvider implements MongoConnectionProviderFactory {
+
+    // TODO Make configurable
+    private String[] entities = new String[]{
+            "org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoUserEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity",
+            "org.keycloak.models.entities.RequiredCredentialEntity",
+            "org.keycloak.models.entities.CredentialEntity",
+            "org.keycloak.models.entities.SocialLinkEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUsernameLoginFailureEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUserSessionEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoClientSessionEntity",
+            "org.keycloak.models.entities.UserFederationProviderEntity"
+    };
+
+    private static final Logger logger = Logger.getLogger(DefaultMongoConnectionFactoryProvider.class);
+
+    private volatile MongoClient client;
+
+    private MongoStore mongoStore;
+    private DB db;
+    private Config.Scope config;
+
+    @Override
+    public MongoConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        TransactionMongoStoreInvocationContext invocationContext = new TransactionMongoStoreInvocationContext(mongoStore);
+        session.getTransaction().enlist(new MongoKeycloakTransaction(invocationContext));
+        return new DefaultMongoConnectionProvider(db, mongoStore, invocationContext);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (client == null) {
+            synchronized (this) {
+                if (client == null) {
+                    try {
+                        String host = config.get("host", ServerAddress.defaultHost());
+                        int port = config.getInt("port", ServerAddress.defaultPort());
+                        String dbName = config.get("db", "keycloak");
+                        boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
+
+                        String user = config.get("user");
+                        String password = config.get("password");
+                        if (user != null && password != null) {
+                            MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                            client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
+                        } else {
+                            client = new MongoClient(host, port);
+                        }
+
+                        this.db = client.getDB(dbName);
+
+                        this.mongoStore = new MongoStoreImpl(db, clearOnStartup, getManagedEntities());
+
+                        logger.infof("Initialized mongo model. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                }
+            }
+        }
+    }
+
+    private Class[] getManagedEntities() throws ClassNotFoundException {
+       Class[] entityClasses = new Class[entities.length];
+        for (int i = 0; i < entities.length; i++) {
+            entityClasses[i] = Thread.currentThread().getContextClassLoader().loadClass(entities[i]);
+        }
+        return entityClasses;
+    }
+
+    @Override
+    public void close() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+}
@@ -0,0 +1,41 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionProvider implements MongoConnectionProvider {
+
+    private DB db;
+    private MongoStore mongoStore;
+    private MongoStoreInvocationContext invocationContext;
+
+    public DefaultMongoConnectionProvider(DB db, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.db = db;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public DB getDB() {
+        return db;
+    }
+
+    @Override
+    public MongoStore getMongoStore() {
+        return mongoStore;
+    }
+
+    @Override
+    public MongoStoreInvocationContext getInvocationContext() {
+        return invocationContext;
+    }
+
+    @Override
+    public void close() {
+    }
+
+}
@@ -0,0 +1,19 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProvider extends Provider {
+
+    DB getDB();
+
+    MongoStore getMongoStore();
+
+    MongoStoreInvocationContext getInvocationContext();
+
+}
@@ -0,0 +1,9 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProviderFactory extends ProviderFactory<MongoConnectionProvider> {
+}
@@ -0,0 +1,27 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsMongo";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MongoConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MongoConnectionProviderFactory.class;
+    }
+
+}
@@ -1,7 +1,9 @@
-package org.keycloak.models.mongo.keycloak.adapters;
+package org.keycloak.connections.mongo;

+import com.mongodb.MongoException;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
 import org.keycloak.models.KeycloakTransaction;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;

 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -35,12 +37,18 @@ public class MongoKeycloakTransaction implements KeycloakTransaction {
            throw new IllegalStateException("Can't commit as transaction marked for rollback");
        }

-        invocationContext.commit();
+        try {
+            invocationContext.commit();
+        } catch (MongoException e) {
+            throw MongoStoreImpl.convertException(e);
+        }
+        started = false;
    }

    @Override
    public void rollback() {
        invocationContext.rollback();
+        started = false;
    }

    @Override
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;

 import java.lang.annotation.Documented;
 import java.lang.annotation.Inherited;
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;

 /**
 * Base interface for object, which is persisted in Mongo
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;

 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
@@ -1,6 +1,6 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;

-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;

 /**
 * Entity with Id
@@ -0,0 +1,26 @@
+package org.keycloak.connections.mongo.api;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import static java.lang.annotation.ElementType.TYPE;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Target({TYPE})
+@Documented
+@Retention(RUNTIME)
+@Inherited
+public @interface MongoIndex {
+
+    String[] fields();
+
+    boolean unique() default false;
+
+    boolean sparse() default false;
+
+}
@@ -0,0 +1,22 @@
+package org.keycloak.connections.mongo.api;
+
+import java.lang.annotation.Documented;
+import java.lang.annotation.Inherited;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import static java.lang.annotation.ElementType.TYPE;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Target({TYPE})
+@Documented
+@Retention(RUNTIME)
+@Inherited
+public @interface MongoIndexes {
+
+    MongoIndex[] value();
+
+}
@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;

 import com.mongodb.DBObject;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;

 import java.util.List;

@@ -31,6 +31,10 @@ public interface MongoStore {

    <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);

+    <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context);
+
+    <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);
+
    boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context);

    boolean removeEntity(Class<? extends MongoIdentifiableEntity> type, String id, MongoStoreInvocationContext context);
@@ -40,4 +44,5 @@ public interface MongoStore {
    <S> boolean pushItemToList(MongoIdentifiableEntity entity, String listPropertyName, S itemToPush, boolean skipIfAlreadyPresent, MongoStoreInvocationContext context);

    <S> boolean pullItemFromList(MongoIdentifiableEntity entity, String listPropertyName, S itemToPull, MongoStoreInvocationContext context);
+
 }
@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;

-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;

 /**
 * Context, which provides callback methods to be invoked by MongoStore
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;

 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;

 /**
 * SPI object to convert object from application type to database type and vice versa. Shouldn't be directly used by application.
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;

 import java.util.List;

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;

 import java.util.HashMap;
 import java.util.Map;
@@ -0,0 +1,40 @@
+package org.keycloak.connections.mongo.impl;
+
+import org.keycloak.models.utils.reflection.Property;
+
+import java.util.Collection;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class EntityInfo {
+
+    private final Class<?> entityClass;
+
+    private final String dbCollectionName;
+
+    private final Map<String, Property<Object>> properties;
+
+    public EntityInfo(Class<?> entityClass, String dbCollectionName, Map<String, Property<Object>> properties) {
+        this.entityClass = entityClass;
+        this.dbCollectionName = dbCollectionName;
+        this.properties = properties;
+    }
+
+    public Class<?> getEntityClass() {
+        return entityClass;
+    }
+
+    public String getDbCollectionName() {
+        return dbCollectionName;
+    }
+
+    public Collection<Property<Object>> getProperties() {
+        return properties.values();
+    }
+
+    public Property<Object> getPropertyByName(String propertyName) {
+        return properties.get(propertyName);
+    }
+}
@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.impl;
+package org.keycloak.connections.mongo.impl;

 import com.mongodb.BasicDBList;
 import com.mongodb.BasicDBObject;
@@ -6,30 +6,33 @@ import com.mongodb.DB;
 import com.mongodb.DBCollection;
 import com.mongodb.DBCursor;
 import com.mongodb.DBObject;
+import com.mongodb.MongoException;
 import org.jboss.logging.Logger;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoField;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.types.BasicDBListMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectToMapMapper;
-import org.keycloak.models.mongo.impl.types.EnumToStringMapper;
-import org.keycloak.models.mongo.impl.types.ListMapper;
-import org.keycloak.models.mongo.impl.types.MapMapper;
-import org.keycloak.models.mongo.impl.types.MongoEntityMapper;
-import org.keycloak.models.mongo.impl.types.SimpleMapper;
-import org.keycloak.models.mongo.impl.types.StringToEnumMapper;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoEntity;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.MongoIndexes;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.types.BasicDBListMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectToMapMapper;
+import org.keycloak.connections.mongo.impl.types.EnumToStringMapper;
+import org.keycloak.connections.mongo.impl.types.ListMapper;
+import org.keycloak.connections.mongo.impl.types.MapMapper;
+import org.keycloak.connections.mongo.impl.types.MongoEntityMapper;
+import org.keycloak.connections.mongo.impl.types.SimpleMapper;
+import org.keycloak.connections.mongo.impl.types.StringToEnumMapper;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.picketlink.common.properties.Property;
-import org.picketlink.common.properties.query.AnnotatedPropertyCriteria;
-import org.picketlink.common.properties.query.PropertyQueries;
+import org.keycloak.models.utils.reflection.Property;
+import org.keycloak.models.utils.reflection.PropertyQueries;

 import java.util.ArrayList;
 import java.util.Date;
@@ -50,22 +53,22 @@ public class MongoStoreImpl implements MongoStore {
    private static final Logger logger = Logger.getLogger(MongoStoreImpl.class);

    private final MapperRegistry mapperRegistry;
-    private ConcurrentMap<Class<? extends MongoEntity>, EntityInfo> entityInfoCache =
-            new ConcurrentHashMap<Class<? extends MongoEntity>, EntityInfo>();
+    private ConcurrentMap<Class<?>, EntityInfo> entityInfoCache =
+            new ConcurrentHashMap<Class<?>, EntityInfo>();


-    public MongoStoreImpl(DB database, boolean clearCollectionsOnStartup, Class<? extends MongoEntity>[] managedEntityTypes) {
+    public MongoStoreImpl(DB database, boolean clearCollectionsOnStartup, Class<?>[] managedEntityTypes) {
        this.database = database;

        mapperRegistry = new MapperRegistry();

-        for (Class<?> simpleConverterClass : SIMPLE_TYPES) {
-            SimpleMapper converter = new SimpleMapper(simpleConverterClass);
-            mapperRegistry.addAppObjectMapper(converter);
-            mapperRegistry.addDBObjectMapper(converter);
+        for (Class<?> simpleMapperClass : SIMPLE_TYPES) {
+            SimpleMapper mapper = new SimpleMapper(simpleMapperClass);
+            mapperRegistry.addAppObjectMapper(mapper);
+            mapperRegistry.addDBObjectMapper(mapper);
        }

-        // Specific converter for ArrayList is added just for performance purposes to avoid recursive converter lookup (most of list impl will be ArrayList)
+        // Specific converter for ArrayList is added just for performance purposes to avoid recursive converter lookup (most of list idm will be ArrayList)
        mapperRegistry.addAppObjectMapper(new ListMapper(mapperRegistry, ArrayList.class));
        mapperRegistry.addAppObjectMapper(new ListMapper(mapperRegistry, List.class));
        mapperRegistry.addDBObjectMapper(new BasicDBListMapper(mapperRegistry));
@@ -78,7 +81,7 @@ public class MongoStoreImpl implements MongoStore {
        mapperRegistry.addAppObjectMapper(new EnumToStringMapper());
        mapperRegistry.addDBObjectMapper(new StringToEnumMapper());

-        for (Class<? extends MongoEntity> type : managedEntityTypes) {
+        for (Class<?> type : managedEntityTypes) {
            getEntityInfo(type);
            mapperRegistry.addAppObjectMapper(new MongoEntityMapper(this, mapperRegistry, type));
            mapperRegistry.addDBObjectMapper(new BasicDBObjectMapper(this, mapperRegistry, type));
@@ -88,6 +91,8 @@ public class MongoStoreImpl implements MongoStore {
            // dropDatabase();
            clearManagedCollections(managedEntityTypes);
        }
+
+        initManagedCollections(managedEntityTypes);
    }

    protected void dropDatabase() {
@@ -95,9 +100,9 @@ public class MongoStoreImpl implements MongoStore {
        logger.info("Database " + this.database.getName() + " dropped in MongoDB");
    }

-    // Don't drop database, but just clear all data in managed collections (useful for development)
-    protected void clearManagedCollections(Class<? extends MongoEntity>[] managedEntityTypes) {
-        for (Class<? extends MongoEntity> clazz : managedEntityTypes) {
+    // Don't drop database, but just clear all data in managed collections (useful for export/import or during development)
+    protected void clearManagedCollections(Class<?>[] managedEntityTypes) {
+        for (Class<?> clazz : managedEntityTypes) {
            DBCollection dbCollection = getDBCollectionForType(clazz);
            if (dbCollection != null) {
                dbCollection.remove(new BasicDBObject());
@@ -106,6 +111,52 @@ public class MongoStoreImpl implements MongoStore {
        }
    }

+    protected void initManagedCollections(Class<?>[] managedEntityTypes) {
+        for (Class<?> clazz : managedEntityTypes) {
+            EntityInfo entityInfo = getEntityInfo(clazz);
+            String dbCollectionName = entityInfo.getDbCollectionName();
+            if (dbCollectionName != null && !database.collectionExists(dbCollectionName)) {
+                DBCollection dbCollection = database.getCollection(dbCollectionName);
+
+                logger.debug("Created collection " + dbCollection.getName() + " in " + this.database.getName());
+
+                MongoIndex index = clazz.getAnnotation(MongoIndex.class);
+                if (index != null) {
+                    createIndex(dbCollection, index);
+                }
+
+                MongoIndexes indexes = clazz.getAnnotation(MongoIndexes.class);
+                if (indexes != null) {
+                    for (MongoIndex i : indexes.value()) {
+                        createIndex(dbCollection, i);
+                    }
+                }
+            }
+        }
+    }
+
+    protected void createIndex(DBCollection dbCollection, MongoIndex index) {
+        BasicDBObject fields = new BasicDBObject();
+        for (String f : index.fields()) {
+            fields.put(f, 1);
+        }
+
+        boolean unique = index.unique();
+        boolean sparse = index.sparse();
+
+        BasicDBObject options = new BasicDBObject();
+        if (unique) {
+            options.put("unique", unique);
+        }
+        if (sparse) {
+            options.put("sparse", sparse);
+        }
+
+        dbCollection.ensureIndex(fields, options);
+
+        logger.debug("Created index " + fields + "(options: " + options + ") on " + dbCollection.getName() + " in " + this.database.getName());
+    }
+
    @Override
    public void insertEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
        Class<? extends MongoEntity> clazz = entity.getClass();
@@ -129,12 +180,24 @@ public class MongoStoreImpl implements MongoStore {
        // Adding "_id"
        dbObject.put("_id", currentId);

-        dbCollection.insert(dbObject);
+        try {
+            dbCollection.insert(dbObject);
+        } catch (MongoException e) {
+            throw convertException(e);
+        }

        // Treat object as created in this transaction (It is already submited to transaction)
        context.addCreatedEntity(entity);
    }

+    public static ModelException convertException(MongoException e) {
+        if (e instanceof MongoException.DuplicateKey) {
+            return new ModelDuplicateException(e);
+        } else {
+            return new ModelException(e);
+        }
+    }
+
    @Override
    public void updateEntity(final MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
        MongoTask fullUpdateTask = new MongoTask() {
@@ -171,7 +234,7 @@ public class MongoStoreImpl implements MongoStore {
    public <T extends MongoIdentifiableEntity> T loadEntity(Class<T> type, String id, MongoStoreInvocationContext context) {
        // First look if we already read the object with this oid and type during this transaction. If yes, use it instead of DB lookup
        T cached = context.getLoadedEntity(type, id);
-        if (cached != null) return cached;
+        if (cached != null && type.isAssignableFrom(cached.getClass())) return cached;

        DBCollection dbCollection = getDBCollectionForType(type);

@@ -217,6 +280,35 @@ public class MongoStoreImpl implements MongoStore {
        return convertCursor(type, cursor, context);
    }

+    @Override
+    public <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context) {
+        // First we should execute all pending tasks before searching DB
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        DBCursor cursor = dbCollection.find(query);
+        if (firstResult != -1) {
+            cursor.skip(firstResult);
+        }
+        if (maxResults != -1) {
+            cursor.limit(maxResults);
+        }
+        if (sort != null) {
+            cursor.sort(sort);
+        }
+
+        return convertCursor(type, cursor, context);
+    }
+
+    public <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context) {
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        Long count = dbCollection.count(query);
+
+        // For now, assume that int is sufficient
+        return count.intValue();
+    }

    @Override
    public boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
@@ -360,10 +452,10 @@ public class MongoStoreImpl implements MongoStore {
        mapperRegistry.addDBObjectMapper(mapper);
    }

-    public EntityInfo getEntityInfo(Class<? extends MongoEntity> entityClass) {
+    public EntityInfo getEntityInfo(Class<?> entityClass) {
        EntityInfo entityInfo = entityInfoCache.get(entityClass);
        if (entityInfo == null) {
-            List<Property<Object>> properties = PropertyQueries.createQuery(entityClass).addCriteria(new AnnotatedPropertyCriteria(MongoField.class)).getResultList();
+            Map<String, Property<Object>> properties = PropertyQueries.createQuery(entityClass).getWritableResultList();

            MongoCollection classAnnotation = entityClass.getAnnotation(MongoCollection.class);

@@ -408,7 +500,7 @@ public class MongoStoreImpl implements MongoStore {
        return object;
    }

-    protected DBCollection getDBCollectionForType(Class<? extends MongoEntity> type) {
+    protected DBCollection getDBCollectionForType(Class<?> type) {
        EntityInfo entityInfo = getEntityInfo(type);
        String dbCollectionName = entityInfo.getDbCollectionName();
        return dbCollectionName==null ? null : database.getCollection(dbCollectionName);
@@ -1,10 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;

-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;

 /**
 * Context, which is not doing any postponing of tasks and does not cache anything
@@ -1,4 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;
+
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;

 import java.util.HashMap;
 import java.util.HashSet;
@@ -6,11 +11,6 @@ import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;

-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-
 /**
 * Invocation context, which has some very basic support for transactions, and is able to cache loaded objects.
 * It always execute all pending update tasks before start searching for other objects
@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;

 import java.util.ArrayList;
 import java.util.List;
@@ -1,26 +1,25 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.models.utils.reflection.Property;
+import org.keycloak.models.utils.reflection.Types;

 import java.lang.reflect.ParameterizedType;
 import java.lang.reflect.Type;
 import java.util.ArrayList;
 import java.util.List;

-import com.mongodb.BasicDBObject;
-import org.jboss.logging.Logger;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
-import org.picketlink.common.properties.Property;
-import org.picketlink.common.reflection.Types;
-
 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
 */
-public class BasicDBObjectMapper<S extends MongoEntity> implements Mapper<BasicDBObject, S> {
+public class BasicDBObjectMapper<S> implements Mapper<BasicDBObject, S> {

    private static final Logger logger = Logger.getLogger(BasicDBObjectMapper.class);

@@ -73,7 +72,7 @@ public class BasicDBObjectMapper<S extends MongoEntity> implements Mapper<BasicD
        return entity;
    }

-    private void setPropertyValue(MongoEntity entity, Object valueFromDB, Property property) {
+    private void setPropertyValue(Object entity, Object valueFromDB, Property property) {
        if (valueFromDB == null) {
            property.setValue(entity, null);
            return;
@@ -1,12 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;

 import java.util.HashMap;
 import java.util.Map;

-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
 * For now, there is support just for convert to Map<String, String>
 *
@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;

 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;

 import java.util.List;

@@ -1,12 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;

 import java.util.Map;
 import java.util.Set;

-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
 * For now, we support just convert from Map<String, String>
 *
@@ -1,20 +1,20 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

 import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
-import org.picketlink.common.properties.Property;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.models.utils.reflection.Property;

 import java.util.Collection;

 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
 */
-public class MongoEntityMapper<T extends MongoEntity> implements Mapper<T, BasicDBObject> {
+public class MongoEntityMapper<T> implements Mapper<T, BasicDBObject> {

    private final MongoStoreImpl mongoStoreImpl;
    private final MapperRegistry mapperRegistry;
@@ -37,10 +37,15 @@ public class MongoEntityMapper<T extends MongoEntity> implements Mapper<T, Basic
        Collection<Property<Object>> props = entityInfo.getProperties();
        for (Property<Object> property : props) {
            String propName = property.getName();
-            Object propValue = property.getValue(applicationObject);

-            Object dbValue = propValue == null ? null : mapperRegistry.convertApplicationObjectToDBObject(propValue, Object.class);
-            dbObject.put(propName, dbValue);
+            // Ignore "id" property
+            if (!"id".equals(propName) || !(applicationObject instanceof MongoIdentifiableEntity)) {
+                Object propValue = property.getValue(applicationObject);
+                if (propValue != null) {
+                    Object dbValue = propValue == null ? null : mapperRegistry.convertApplicationObjectToDBObject(propValue, Object.class);
+                    dbObject.put(propName, dbValue);
+                }
+            }
        }

        return dbObject;
@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;

 /**
 * Just returns input
@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;

-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;

 /**
 * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -0,0 +1 @@
+org.keycloak.connections.mongo.DefaultMongoConnectionFactoryProvider
@@ -0,0 +1 @@
+org.keycloak.connections.mongo.MongoConnectionSpi
@@ -0,0 +1,31 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.2.Final</version>
+    </parent>
+    <name>Connections Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-pom</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>jpa</module>
+        <module>mongo</module>
+    </modules>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-3</version>
+        <version>1.0.2.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -18,11 +19,6 @@
            <artifactId>resteasy-jaxrs</artifactId>
            <scope>provided</scope>
        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-client</artifactId>
-            <scope>provided</scope>
-        </dependency>
        <dependency>
            <groupId>org.keycloak</groupId>
            <artifactId>keycloak-core</artifactId>
@@ -61,8 +57,8 @@
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                </configuration>
            </plugin>
        </plugins>
@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
-<project>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-alpha-3</version>
+        <version>1.0.2.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -12,6 +13,10 @@
    <name>Keycloak Core</name>
    <description/>

+    <properties>
+        <timestamp>${maven.build.timestamp}</timestamp>
+        <maven.build.timestamp.format>yyyy-MM-dd HH:mm</maven.build.timestamp.format>
+    </properties>
    <dependencies>
        <dependency>
            <groupId>org.bouncycastle</groupId>
@@ -40,13 +45,19 @@
        </dependency>
    </dependencies>
    <build>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+                <filtering>true</filtering>
+            </resource>
+        </resources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
                </configuration>
            </plugin>
        </plugins>
@@ -2,7 +2,6 @@ package org.keycloak;

 import org.keycloak.util.KeycloakUriBuilder;

-import java.security.KeyStore;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicLong;
@@ -12,19 +11,20 @@ import java.util.concurrent.atomic.AtomicLong;
 * @version $Revision: 1 $
 */
 public class AbstractOAuthClient {
-    public static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private static final String OAUTH_TOKEN_REQUEST_STATE = "OAuth_Token_Request_State";
+    private final AtomicLong counter = new AtomicLong();
+
    protected String clientId;
    protected Map<String, String> credentials;
    protected String authUrl;
    protected String codeUrl;
    protected String refreshUrl;
+    protected boolean relativeUrls;
    protected String scope;
    protected String stateCookieName = OAUTH_TOKEN_REQUEST_STATE;
    protected String stateCookiePath;
    protected boolean isSecure;
    protected boolean publicClient;
-    protected final AtomicLong counter = new AtomicLong();
-
    protected String getStateCode() {
        return counter.getAndIncrement() + "/" + UUID.randomUUID().toString();
    }
@@ -101,10 +101,18 @@ public class AbstractOAuthClient {
        this.publicClient = publicClient;
    }

+    public boolean isRelativeUrls() {
+        return relativeUrls;
+    }
+
+    public void setRelativeUrls(boolean relativeUrls) {
+        this.relativeUrls = relativeUrls;
+    }
+
    protected String stripOauthParametersFromRedirect(String uri) {
        KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
-                .replaceQueryParam("code", null)
-                .replaceQueryParam("state", null);
+                .replaceQueryParam(OAuth2Constants.CODE, null)
+                .replaceQueryParam(OAuth2Constants.STATE, null);
        return builder.build().toString();
    }

@@ -0,0 +1,13 @@
+package org.keycloak;
+
+/**
+ * Information about the client connection
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface ClientConnection {
+    String getRemoteAddr();
+    String getRemoteHost();
+    int getReportPort();
+}
@@ -0,0 +1,150 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Config {
+
+    private static ConfigProvider configProvider = new SystemPropertiesConfigProvider();
+
+    public static void init(ConfigProvider configProvider) {
+        Config.configProvider = configProvider;
+    }
+
+    public static String getAdminRealm() {
+        return configProvider.scope("admin").get("realm", "master");
+    }
+
+    public static String getProvider(String spi) {
+        String provider = configProvider.getProvider(spi);
+        if (provider == null || provider.trim().equals("")) {
+            return null;
+        } else {
+            return provider;
+        }
+    }
+
+    public static Scope scope(String... scope) {
+         return configProvider.scope(scope);
+    }
+
+    public static interface ConfigProvider {
+
+        String getProvider(String spi);
+
+        Scope scope(String... scope);
+
+    }
+
+    public static class SystemPropertiesConfigProvider implements ConfigProvider {
+
+        @Override
+        public String getProvider(String spi) {
+            return System.getProperties().getProperty("keycloak." + spi + ".provider");
+        }
+
+        @Override
+        public Scope scope(String... scope) {
+            StringBuilder sb = new StringBuilder();
+            sb.append("keycloak.");
+            for (String s : scope) {
+                sb.append(s);
+                sb.append(".");
+            }
+            return new SystemPropertiesScope(sb.toString());
+        }
+
+    }
+
+    public static class SystemPropertiesScope implements Scope {
+
+        private String prefix;
+
+        public SystemPropertiesScope(String prefix) {
+            this.prefix = prefix;
+        }
+
+        @Override
+        public String get(String key) {
+            return get(key, null);
+        }
+
+        @Override
+        public String get(String key, String defaultValue) {
+            return System.getProperty(prefix + key, defaultValue);
+        }
+
+        @Override
+        public String[] getArray(String key) {
+            String value = get(key);
+            if (value != null) {
+                String[] a = value.split(",");
+                for (int i = 0; i < a.length; i++) {
+                    a[i] = a[i].trim();
+                }
+                return a;
+            } else {
+                return null;
+            }
+        }
+
+        @Override
+        public Integer getInt(String key) {
+            return getInt(key, null);
+        }
+
+        @Override
+        public Integer getInt(String key, Integer defaultValue) {
+            String v = get(key, null);
+            return v != null ? Integer.parseInt(v) : defaultValue;
+        }
+
+        @Override
+        public Long getLong(String key) {
+            return getLong(key, null);
+        }
+
+        @Override
+        public Long getLong(String key, Long defaultValue) {
+            String v = get(key, null);
+            return v != null ? Long.parseLong(v) : defaultValue;
+        }
+
+        @Override
+        public Boolean getBoolean(String key) {
+            return getBoolean(key, null);
+        }
+
+        @Override
+        public Boolean getBoolean(String key, Boolean defaultValue) {
+            String v = get(key, null);
+            return v != null ? Boolean.parseBoolean(v) : defaultValue;
+        }
+
+    }
+
+    /**
+     * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+     */
+    public static interface Scope {
+
+        String get(String key);
+
+        String get(String key, String defaultValue);
+
+        String[] getArray(String key);
+
+        Integer getInt(String key);
+
+        Integer getInt(String key, Integer defaultValue);
+
+        Long getLong(String key);
+
+        Long getLong(String key, Long defaultValue);
+
+        Boolean getBoolean(String key);
+
+        Boolean getBoolean(String key, Boolean defaultValue);
+
+    }
+}
@@ -8,12 +8,16 @@ import java.security.Principal;
 * @version $Revision: 1 $
 */
 public class KeycloakPrincipal implements Principal, Serializable {
-    protected String name;
-    protected String surrogate;
+    protected final String name;
+    protected final KeycloakSecurityContext context;

-    public KeycloakPrincipal(String name, String surrogate) {
+    public KeycloakPrincipal(String name, KeycloakSecurityContext context) {
        this.name = name;
-        this.surrogate = surrogate;
+        this.context = context;
+    }
+
+    public KeycloakSecurityContext getKeycloakSecurityContext() {
+        return context;
    }

    @Override
@@ -21,10 +25,6 @@ public class KeycloakPrincipal implements Principal, Serializable {
        return name;
    }

-    public String getSurrogate() {
-        return surrogate;
-    }
-
    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
@@ -33,16 +33,13 @@ public class KeycloakPrincipal implements Principal, Serializable {
        KeycloakPrincipal that = (KeycloakPrincipal) o;

        if (!name.equals(that.name)) return false;
-        if (surrogate != null ? !surrogate.equals(that.surrogate) : that.surrogate != null) return false;

        return true;
    }

    @Override
    public int hashCode() {
-        int result = name.hashCode();
-        result = 31 * result + (surrogate != null ? surrogate.hashCode() : 0);
-        return result;
+        return name.hashCode();
    }

    @Override
@@ -0,0 +1,30 @@
+package org.keycloak;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface OAuth2Constants {
+
+    String CODE = "code";
+
+    String CLIENT_ID = "client_id";
+
+    String ERROR = "error";
+
+    String ERROR_DESCRIPTION = "error_description";
+
+    String REDIRECT_URI = "redirect_uri";
+
+    String SCOPE = "scope";
+
+    String STATE = "state";
+
+    String GRANT_TYPE = "grant_type";
+
+    String RESPONSE_TYPE = "response_type";
+
+    String REFRESH_TOKEN = "refresh_token";
+
+}
+
+
@@ -19,6 +19,8 @@ public class OAuthErrorException extends Exception {
    }
    public OAuthErrorException(String error, String description, String message) {
        super(message);
+        this.error = error;
+        this.description = description;
    }
    public OAuthErrorException(String error, String description) {
        super(description);
@@ -16,29 +16,27 @@ public class RSATokenVerifier {
        return verifyToken(tokenString, realmKey, realm, true);
    }

-
    public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
-        JWSInput input = new JWSInput(tokenString);
-        boolean verified = false;
+        JWSInput input = null;
        try {
-            verified = RSAProvider.verify(input, realmKey);
-        } catch (Exception ignore) {
-
+            input = new JWSInput(tokenString);
+        } catch (Exception e) {
+            throw new VerificationException("Couldn't parse token", e);
        }
-        if (!verified) throw new VerificationException("Token signature not validated");
+        if (!isPublicKeyValid(input, realmKey)) throw new VerificationException("Invalid token signature.");

-        AccessToken token = null;
+        AccessToken token;
        try {
            token = input.readJsonContent(AccessToken.class);
        } catch (IOException e) {
-            throw new VerificationException(e);
+            throw new VerificationException("Couldn't parse token signature", e);
        }
        String user = token.getSubject();
        if (user == null) {
-            throw new VerificationException("Token user was null");
+            throw new VerificationException("Token user was null.");
        }
        if (!realm.equals(token.getAudience())) {
-            throw new VerificationException("Token audience doesn't match domain");
+            throw new VerificationException("Token audience doesn't match domain.");

        }
        if (checkActive && !token.isActive()) {
@@ -47,4 +45,12 @@ public class RSATokenVerifier {

        return token;
    }
+
+    private static boolean isPublicKeyValid(JWSInput input, PublicKey realmKey) throws VerificationException {
+        try {
+            return RSAProvider.verify(input, realmKey);
+        } catch (Exception e) {
+            throw new VerificationException("Token signature not validated.", e);
+        }
+    }
 }
@@ -6,7 +6,12 @@ package org.keycloak;
 */
 public interface ServiceUrlConstants {

-    public static final String TOKEN_SERVICE_LOGIN_PATH = "/rest/realms/{realm-name}/tokens/login";
-    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/rest/realms/{realm-name}/tokens/access/codes";
-    public static final String TOKEN_SERVICE_REFRESH_PATH = "/rest/realms/{realm-name}/tokens/refresh";
+    public static final String TOKEN_SERVICE_LOGIN_PATH = "/realms/{realm-name}/tokens/login";
+    public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/realms/{realm-name}/tokens/access/codes";
+    public static final String TOKEN_SERVICE_REFRESH_PATH = "/realms/{realm-name}/tokens/refresh";
+    public static final String TOKEN_SERVICE_LOGOUT_PATH = "/realms/{realm-name}/tokens/logout";
+    public static final String TOKEN_SERVICE_DIRECT_GRANT_PATH = "/realms/{realm-name}/tokens/grants/access";
+    public static final String ACCOUNT_SERVICE_PATH = "/realms/{realm-name}/account";
+    public static final String REALM_INFO_PATH = "/realms/{realm-name}";
+
 }
@@ -0,0 +1,46 @@
+package org.keycloak;
+
+import org.codehaus.jackson.annotate.JsonProperty;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Version {
+    public static String VERSION;
+    public static String BUILD_TIME;
+    public static final String UNKNOWN = "UNKNOWN";
+    public static final Version SINGLETON;
+
+    private final String version = VERSION;
+    private final String buildTime = BUILD_TIME;
+
+    static {
+        Properties props = new Properties();
+        InputStream is = Version.class.getResourceAsStream("/keycloak-version.properties");
+        try {
+            props.load(is);
+            VERSION = props.getProperty("version");
+            BUILD_TIME = props.getProperty("build-time");
+        } catch (IOException e) {
+            VERSION=UNKNOWN;
+            BUILD_TIME=UNKNOWN;
+        }
+
+        SINGLETON = new Version();
+    }
+
+    @JsonProperty("version")
+    public String getVersion() {
+        return version;
+    }
+
+    @JsonProperty("build-time")
+    public String getBuildTime() {
+        return buildTime;
+    }
+}
@@ -8,6 +8,7 @@ public interface AdapterConstants {

    // URL endpoints
    public static final String K_LOGOUT = "k_logout";
+    public static final String K_VERSION = "k_version";
    public static final String K_PUSH_NOT_BEFORE = "k_push_not_before";
    public static final String K_GET_USER_STATS = "k_get_user_stats";
    public static final String K_GET_SESSION_STATS = "k_get_session_stats";
@@ -0,0 +1,43 @@
+package org.keycloak.enums;
+
+import org.keycloak.ClientConnection;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public enum SslRequired {
+
+    ALL,
+    EXTERNAL,
+    NONE;
+
+    public boolean isRequired(ClientConnection connection) {
+        return isRequired(connection.getRemoteAddr());
+    }
+
+    public boolean isRequired(String address) {
+        switch (this) {
+            case ALL:
+                return true;
+            case NONE:
+                return false;
+            case EXTERNAL:
+                return !isLocal(address);
+            default:
+                return true;
+        }
+    }
+
+    private boolean isLocal(String remoteAddress) {
+        try {
+            InetAddress inetAddress = InetAddress.getByName(remoteAddress);
+            return inetAddress.isAnyLocalAddress() || inetAddress.isLoopbackAddress() || inetAddress.isSiteLocalAddress();
+        } catch (UnknownHostException e) {
+            return false;
+        }
+    }
+
+}
@@ -1,6 +1,5 @@
 package org.keycloak.jose.jws;

-import org.codehaus.jackson.annotate.JsonIgnore;
 import org.codehaus.jackson.annotate.JsonProperty;
 import org.codehaus.jackson.map.ObjectMapper;
 import org.codehaus.jackson.map.annotate.JsonSerialize;
@@ -15,7 +15,7 @@ import java.security.NoSuchAlgorithmException;
 * @version $Revision: 1 $
 */
 public class HMACProvider {
-    public static String getJavaAlgorithm(Algorithm alg) {
+    private static String getJavaAlgorithm(Algorithm alg) {
        switch (alg) {
            case HS256:
                return "HMACSHA256";
@@ -28,7 +28,7 @@ public class HMACProvider {
        }
    }

-    public static Mac getMAC(final Algorithm alg) {
+    private static Mac getMAC(final Algorithm alg) {

        try {
            return Mac.getInstance(getJavaAlgorithm(alg));
@@ -128,12 +128,12 @@ public class AccessToken extends IDToken {
    }

    @Override
-    public AccessToken expiration(long expiration) {
+    public AccessToken expiration(int expiration) {
        return (AccessToken) super.expiration(expiration);
    }

    @Override
-    public AccessToken notBefore(long notBefore) {
+    public AccessToken notBefore(int notBefore) {
        return (AccessToken) super.notBefore(notBefore);
    }

@@ -27,6 +27,9 @@ public class AccessTokenResponse {
    @JsonProperty("not-before-policy")
    protected int notBeforePolicy;

+    @JsonProperty("session-state")
+    protected String sessionState;
+
    public String getToken() {
        return token;
    }
@@ -74,4 +77,12 @@ public class AccessTokenResponse {
    public void setNotBeforePolicy(int notBeforePolicy) {
        this.notBeforePolicy = notBeforePolicy;
    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
 }
@@ -88,6 +88,9 @@ public class IDToken extends JsonWebToken {
    @JsonProperty("claims_locales")
    protected String claimsLocales;

+    @JsonProperty("session_state")
+    protected String sessionState;
+
    public String getNonce() {
        return nonce;
    }
@@ -303,4 +306,12 @@ public class IDToken extends JsonWebToken {
    public void setClaimsLocales(String claimsLocales) {
        this.claimsLocales = claimsLocales;
    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
 }
@@ -2,6 +2,7 @@ package org.keycloak.representations;

 import org.codehaus.jackson.annotate.JsonIgnore;
 import org.codehaus.jackson.annotate.JsonProperty;
+import org.keycloak.util.Time;

 import java.io.Serializable;

@@ -13,9 +14,9 @@ public class JsonWebToken implements Serializable {
    @JsonProperty("jti")
    protected String id;
    @JsonProperty("exp")
-    protected long expiration;
+    protected int expiration;
    @JsonProperty("nbf")
-    protected long notBefore;
+    protected int notBefore;
    @JsonProperty("iat")
    protected int issuedAt;
    @JsonProperty("iss")
@@ -39,26 +40,25 @@ public class JsonWebToken implements Serializable {
    }


-    public long getExpiration() {
+    public int getExpiration() {
        return expiration;
    }

-    public JsonWebToken expiration(long expiration) {
+    public JsonWebToken expiration(int expiration) {
        this.expiration = expiration;
        return this;
    }

    @JsonIgnore
    public boolean isExpired() {
-        long time = System.currentTimeMillis() / 1000;
-        return time > expiration;
+        return Time.currentTime() > expiration;
    }

-    public long getNotBefore() {
+    public int getNotBefore() {
        return notBefore;
    }

-    public JsonWebToken notBefore(long notBefore) {
+    public JsonWebToken notBefore(int notBefore) {
        this.notBefore = notBefore;
        return this;
    }
@@ -66,7 +66,7 @@ public class JsonWebToken implements Serializable {

    @JsonIgnore
    public boolean isNotBefore() {
-        return (System.currentTimeMillis() / 1000) >= notBefore;
+        return Time.currentTime() >= notBefore;

    }

@@ -89,7 +89,7 @@ public class JsonWebToken implements Serializable {
     */
    @JsonIgnore
    public JsonWebToken issuedNow() {
-        issuedAt = (int)(System.currentTimeMillis() / 1000);
+        issuedAt = Time.currentTime();
        return this;
    }

@@ -0,0 +1,47 @@
+package org.keycloak.representations;
+
+import org.keycloak.util.Time;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PasswordToken {
+
+    private String realm;
+    private String user;
+    private int timestamp;
+
+    public PasswordToken() {
+    }
+
+    public PasswordToken(String realm, String user) {
+        this.realm = realm;
+        this.user = user;
+        this.timestamp = Time.currentTime();
+    }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
+
+    public String getUser() {
+        return user;
+    }
+
+    public void setUser(String user) {
+        this.user = user;
+    }
+
+    public int getTimestamp() {
+        return timestamp;
+    }
+
+    public void setTimestamp(int timestamp) {
+        this.timestamp = timestamp;
+    }
+
+}
@@ -13,7 +13,7 @@ public class RefreshToken extends AccessToken {
    }

    /**
-     * Deep copies issuer, subject, issuedFor, realmAccess, and resourceAccess
+     * Deep copies issuer, subject, issuedFor, sessionState, realmAccess, and resourceAccess
     * from AccessToken.
     *
     * @param token
@@ -23,6 +23,7 @@ public class RefreshToken extends AccessToken {
        this.issuer = token.issuer;
        this.subject = token.subject;
        this.issuedFor = token.issuedFor;
+        this.sessionState = token.sessionState;
        if (token.realmAccess != null) {
            realmAccess = token.realmAccess.clone();
        }
@@ -1,6 +1,7 @@
 package org.keycloak.representations.adapters.action;

 import org.codehaus.jackson.annotate.JsonIgnore;
+import org.keycloak.util.Time;

 /**
 * Posted to managed client from admin server.
@@ -34,8 +35,7 @@ public abstract class AdminAction {

    @JsonIgnore
    public boolean isExpired() {
-        long time = System.currentTimeMillis() / 1000;
-        return time > expiration;
+        return Time.currentTime() > expiration;
    }

    /**
@@ -7,14 +7,17 @@ package org.keycloak.representations.adapters.action;
 public class LogoutAction extends AdminAction {
    public static final String LOGOUT = "LOGOUT";
    protected String user;
+    private String session;
    protected int notBefore;

    public LogoutAction() {
    }

-    public LogoutAction(String id, int expiration, String resource, String user, int notBefore) {
+    public LogoutAction(String id, int expiration, String resource, String user, String session, int notBefore) {
        super(id, expiration, resource, LOGOUT);
        this.user = user;
+        this.session = session;
+        this.notBefore = notBefore;
    }

    public String getUser() {
@@ -25,6 +28,14 @@ public class LogoutAction extends AdminAction {
        this.user = user;
    }

+    public String getSession() {
+        return session;
+    }
+
+    public void setSession(String session) {
+        this.session = session;
+    }
+
    public int getNotBefore() {
        return notBefore;
    }
@@ -1,8 +1,6 @@
 package org.keycloak.representations.adapters.action;

-import java.util.List;
 import java.util.Map;
-import java.util.Set;

 /**
 * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -9,7 +9,7 @@ import org.codehaus.jackson.annotate.JsonPropertyOrder;
 * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
 * @version $Revision: 1 $
 */
-@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-not-required",
+@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-required",
        "resource", "credentials",
        "use-resource-role-mappings",
        "enable-cors", "cors-max-age", "cors-allowed-methods",
				`@@ -0,0 +1 @@`
				`org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory`
				`@@ -0,0 +1 @@`
				`org.keycloak.connections.jpa.JpaConnectionSpi`
				`@@ -0,0 +1 @@`
				`org.keycloak.connections.mongo.DefaultMongoConnectionFactoryProvider`
				`@@ -0,0 +1 @@`
				`org.keycloak.connections.mongo.MongoConnectionSpi`