Merge pull request #814 from stianst/Branch_1_0

Version bump

README.md

@@ -1,4 +1,35 @@
 keycloak
 ========
 
-SSO Service for web apps and REST services.
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.  
+
+Keycloak is an SSO Service for web apps and REST services.
+It can be used for social applications as well as enterprise applications.  It is based on OpenID Connect with SAML support in the works.
+Here's some of the features:
+
+* SSO and Single Log Out for browser applications
+* Social Broker.  Enable Google, Facebook, Yahoo, Twitter social login with no code required.
+* Optional LDAP/Active Directory integration
+* Optional User Registration
+* Password and TOTP support (via Google Authenticator).  Client cert auth coming soon.
+* User session management from both admin and user perspective
+* Customizable themes for user facing pages: login, grant pages, account management, emails, and admin console all customizable!
+* OAuth Bearer token auth for REST Services
+* Integrated Browser App to REST Service token propagation
+* Admin REST API
+* OAuth 2.0 Grant requests
+* CORS Support
+* CORS Web Origin management and validation
+* Completely centrally managed user and role mapping metadata.  Minimal configuration at the application side
+* Admin Console for managing users, roles, role mappings, applications, user sessions, allowed CORS web origins, and OAuth clients.
+* Deployable as a WAR, appliance, or an Openshift  cloud service (SaaS).
+* Supports JBoss AS7, EAP 6.x, and Wildfly applications.   Plans to support Node.js, RAILS, GRAILS, and other non-Java applications.
+* Javascript/HTML 5 adapter for pure Javascript apps
+* Session management from admin console
+* Revocation policies
+* Password policies
+* OpenID Connect Support
+
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.

audit/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -1,2 +0,0 @@
-org.keycloak.audit.AuditProviderSpi
-org.keycloak.audit.AuditListenerSpi

audit/email/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -1 +0,0 @@
-org.keycloak.audit.email.EmailAuditListenerFactory

audit/jboss-logging/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -1 +0,0 @@
-org.keycloak.audit.log.JBossLoggingAuditListenerFactory

audit/jpa/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -1 +0,0 @@
-org.keycloak.audit.jpa.JpaAuditProviderFactory

audit/jpa/src/test/java/org/keycloak/audit/jpa/JpaAuditProviderTest.java

@@ -1,15 +0,0 @@
-package org.keycloak.audit.jpa;
-
-import org.keycloak.audit.tests.AbstractAuditProviderTest;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class JpaAuditProviderTest extends AbstractAuditProviderTest {
-
-    @Override
-    protected String getProviderId() {
-        return JpaAuditProviderFactory.ID;
-    }
-
-}

audit/jpa/src/test/resources/META-INF/persistence.xml

@@ -1,22 +0,0 @@
-<persistence xmlns="http://java.sun.com/xml/ns/persistence"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
-    version="1.0">
-    <persistence-unit name="jpa-keycloak-audit-store" transaction-type="RESOURCE_LOCAL">
-        <provider>org.hibernate.ejb.HibernatePersistence</provider>
-
-        <class>org.keycloak.audit.jpa.EventEntity</class>
-
-        <exclude-unlisted-classes>true</exclude-unlisted-classes>
-
-        <properties>
-            <property name="hibernate.connection.url" value="jdbc:h2:mem:test"/>
-            <property name="hibernate.connection.driver_class" value="org.h2.Driver"/>
-            <property name="hibernate.connection.username" value="sa"/>
-            <property name="hibernate.connection.password" value=""/>
-            <property name="hibernate.hbm2ddl.auto" value="create-drop" />
-            <property name="hibernate.show_sql" value="false" />
-            <property name="hibernate.format_sql" value="true" />
-        </properties>
-    </persistence-unit>
-</persistence>

audit/mongo/pom.xml

@@ -1,133 +0,0 @@
-<?xml version="1.0"?>
-<project>
-    <parent>
-        <artifactId>keycloak-audit-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>1.0-beta-1-20150523</version>
-    </parent>
-
-    <modelVersion>4.0.0</modelVersion>
-
-    <artifactId>keycloak-audit-mongo</artifactId>
-    <name>Keycloak Audit Mongo Provider</name>
-    <description/>
-
-    <dependencies>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <version>2.4</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-core</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-api</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-tests</artifactId>
-            <version>${project.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.logging</groupId>
-            <artifactId>jboss-logging</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.mongodb</groupId>
-            <artifactId>mongo-java-driver</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
-   </dependencies>
-
-    <properties>
-        <keycloak.audit.mongo.host>localhost</keycloak.audit.mongo.host>
-        <keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
-        <keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
-        <keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
-    </properties>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
-                </configuration>
-            </plugin>
-
-            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>test</id>
-                        <phase>integration-test</phase>
-                        <goals>
-                            <goal>test</goal>
-                        </goals>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <keycloak.audit.mongo.host>${keycloak.audit.mongo.host}</keycloak.audit.mongo.host>
-                                <keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
-                                <keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
-                                <keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
-                            </systemPropertyVariables>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>default-test</id>
-                        <configuration>
-                            <skip>true</skip>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
-            <!-- Embedded mongo -->
-            <plugin>
-                <groupId>com.github.joelittlejohn.embedmongo</groupId>
-                <artifactId>embedmongo-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>start-mongodb</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>start</goal>
-                        </goals>
-                        <configuration>
-                            <port>${keycloak.audit.mongo.port}</port>
-                            <logging>file</logging>
-                            <logFile>${project.build.directory}/mongodb.log</logFile>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>stop-mongodb</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>stop</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-        </plugins>
-    </build>
-</project>

audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java

@@ -1,96 +0,0 @@
-package org.keycloak.audit.mongo;
-
-import com.mongodb.DB;
-import com.mongodb.MongoClient;
-import com.mongodb.MongoCredential;
-import com.mongodb.ServerAddress;
-import com.mongodb.WriteConcern;
-import org.jboss.logging.Logger;
-import org.keycloak.Config;
-import org.keycloak.audit.AuditProvider;
-import org.keycloak.audit.AuditProviderFactory;
-import org.keycloak.audit.EventType;
-import org.keycloak.provider.ProviderSession;
-
-import java.net.UnknownHostException;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class MongoAuditProviderFactory implements AuditProviderFactory {
-
-    protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
-
-    public static final String ID = "mongo";
-    private MongoClient client;
-    private DB db;
-
-    private Set<EventType> includedEvents = new HashSet<EventType>();
-
-    @Override
-    public AuditProvider create(ProviderSession providerSession) {
-        return new MongoAuditProvider(db.getCollection("audit"), includedEvents);
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-        try {
-            String host = config.get("host", ServerAddress.defaultHost());
-            int port = config.getInt("port", ServerAddress.defaultPort());
-            String dbName = config.get("db", "keycloak-audit");
-            boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
-
-            String user = config.get("user");
-            String password = config.get("password");
-            if (user != null && password != null) {
-                MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
-                client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
-            } else {
-                client = new MongoClient(host, port);
-            }
-
-            client.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
-            db = client.getDB(dbName);
-
-            if (clearOnStartup) {
-                db.getCollection("audit").drop();
-            }
-
-            logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
-        } catch (UnknownHostException e) {
-            throw new RuntimeException(e);
-        }
-
-        String[] include = config.getArray("include-events");
-        if (include != null) {
-            for (String i : include) {
-                includedEvents.add(EventType.valueOf(i.toUpperCase()));
-            }
-        } else {
-            for (EventType i : EventType.values()) {
-                includedEvents.add(i);
-            }
-        }
-
-        String[] exclude = config.getArray("exclude-events");
-        if (exclude != null) {
-            for (String e : exclude) {
-                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
-            }
-        }
-    }
-
-    @Override
-    public void close() {
-        client.close();
-    }
-
-    @Override
-    public String getId() {
-        return ID;
-    }
-
-}

audit/mongo/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -1 +0,0 @@
-org.keycloak.audit.mongo.MongoAuditProviderFactory

audit/mongo/src/test/java/org/keycloak/audit/mongo/MongoAuditProviderTest.java

@@ -1,15 +0,0 @@
-package org.keycloak.audit.mongo;
-
-import org.keycloak.audit.tests.AbstractAuditProviderTest;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class MongoAuditProviderTest extends AbstractAuditProviderTest {
-
-    @Override
-    protected String getProviderId() {
-        return MongoAuditProviderFactory.ID;
-    }
-
-}

audit/tests/src/main/java/org/keycloak/audit/tests/AbstractAuditProviderTest.java

@@ -1,139 +0,0 @@
-package org.keycloak.audit.tests;
-
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.Config;
-import org.keycloak.audit.AuditProvider;
-import org.keycloak.audit.AuditProviderFactory;
-import org.keycloak.audit.Event;
-import org.keycloak.audit.EventType;
-import org.keycloak.provider.ProviderFactory;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.ServiceLoader;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public abstract class AbstractAuditProviderTest {
-
-    private ProviderFactory<AuditProvider> factory;
-    private AuditProvider provider;
-
-    @Before
-    public void before() {
-        String providerId = getProviderId();
-        ServiceLoader<AuditProviderFactory> factories = ServiceLoader.load(AuditProviderFactory.class);
-        for (AuditProviderFactory f : factories) {
-            if (f.getId().equals(providerId)) {
-                factory = f;
-                factory.init(Config.scope("audit", providerId));
-            }
-        }
-
-        provider = factory.create(null);
-    }
-
-    protected abstract String getProviderId();
-
-    @After
-    public void after() {
-        provider.clear();
-        provider.close();
-        factory.close();
-    }
-
-    @Test
-    public void save() {
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-    }
-
-    @Test
-    public void query() {
-        long oldest = System.currentTimeMillis() - 30000;
-        long newest = System.currentTimeMillis() + 30000;
-
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
-        provider.onEvent(create(EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(oldest, EventType.LOGIN, "realmId", "clientId2", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        Assert.assertEquals(5, provider.createQuery().client("clientId").getResultList().size());
-        Assert.assertEquals(5, provider.createQuery().realm("realmId").getResultList().size());
-        Assert.assertEquals(4, provider.createQuery().event(EventType.LOGIN).getResultList().size());
-        Assert.assertEquals(6, provider.createQuery().event(EventType.LOGIN, EventType.REGISTER).getResultList().size());
-        Assert.assertEquals(4, provider.createQuery().user("userId").getResultList().size());
-
-        Assert.assertEquals(1, provider.createQuery().user("userId").event(EventType.REGISTER).getResultList().size());
-
-        Assert.assertEquals(2, provider.createQuery().maxResults(2).getResultList().size());
-        Assert.assertEquals(1, provider.createQuery().firstResult(5).getResultList().size());
-
-        Assert.assertEquals(newest, provider.createQuery().maxResults(1).getResultList().get(0).getTime());
-        Assert.assertEquals(oldest, provider.createQuery().firstResult(5).maxResults(1).getResultList().get(0).getTime());
-    }
-
-    @Test
-    public void clear() {
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        provider.clear("realmId");
-
-        Assert.assertEquals(1, provider.createQuery().getResultList().size());
-    }
-
-    @Test
-    public void clearOld() {
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        provider.clear("realmId", System.currentTimeMillis() - 10000);
-
-        Assert.assertEquals(3, provider.createQuery().getResultList().size());
-    }
-
-    private Event create(EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
-        return create(System.currentTimeMillis(), event, realmId, clientId, userId, ipAddress, error);
-    }
-
-    private Event create(long time, EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
-        Event e = new Event();
-        e.setTime(time);
-        e.setEvent(event);
-        e.setRealmId(realmId);
-        e.setClientId(clientId);
-        e.setUserId(userId);
-        e.setIpAddress(ipAddress);
-        e.setError(error);
-
-        Map<String, String> details = new HashMap<String, String>();
-        details.put("key1", "value1");
-        details.put("key2", "value2");
-
-        e.setDetails(details);
-
-        return e;
-    }
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderConstants.java

@@ -1,15 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthProviderConstants {
-
-    // Model is default provider. See AuthenticationProviderModel.DEFAULT_PROVIDER
-    public static final String PROVIDER_NAME_MODEL = "model";
-    public static final String PROVIDER_NAME_EXTERNAL_MODEL = "externalModel";
-    public static final String PROVIDER_NAME_PICKETLINK = "picketlink";
-
-    // Used in external-model provider
-    public static final String EXTERNAL_REALM_ID = "externalRealmId";
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderStatus.java

@@ -1,12 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * Result of authentication by AuthenticationProvider
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public enum AuthProviderStatus {
-
-    SUCCESS, INVALID_CREDENTIALS, FAILED
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthUser.java

@@ -1,83 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthUser {
-
-    private String id;
-    private String username;
-    private String firstName;
-    private String lastName;
-    private String email;
-
-    private String providerName;
-
-    public AuthUser(String id, String username, String providerName) {
-        this.id = id;
-        this.username = username;
-        this.providerName = providerName;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public AuthUser setId(String id) {
-        this.id = id;
-        return this;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public AuthUser setUsername(String username) {
-        this.username = username;
-        return this;
-    }
-
-    public String getFirstName() {
-        return firstName;
-    }
-
-    public AuthUser setName(String name) {
-        int i = name.lastIndexOf(' ');
-        if (i != -1) {
-            firstName  = name.substring(0, i);
-            lastName = name.substring(i + 1);
-        } else {
-            firstName = name;
-        }
-
-        return this;
-    }
-
-    public AuthUser setName(String firstName, String lastName) {
-        this.firstName = firstName;
-        this.lastName = lastName;
-        return this;
-    }
-
-    public String getLastName() {
-        return lastName;
-    }
-
-    public String getEmail() {
-        return email;
-    }
-
-    public AuthUser setEmail(String email) {
-        this.email = email;
-        return this;
-    }
-
-    public String getProviderName() {
-        return providerName;
-    }
-
-    public AuthUser setProviderName(String providerName) {
-        this.providerName = providerName;
-        return this;
-    }
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProvider.java

@@ -1,68 +0,0 @@
-package org.keycloak.authentication;
-
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.models.RealmModel;
-import org.keycloak.provider.Provider;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface AuthenticationProvider extends Provider {
-
-    String getName();
-
-    /**
-     * Get names of all available configuration options of current provider
-     *
-     * @return options or empty list if no options available
-     */
-    List<String> getAvailableOptions();
-
-    /**
-     * Get user by given username or email. Return user instance or null if user doesn't exists in this authentication provider
-     *
-     * @param realm
-     * @param configuration
-     * @param username or email
-     * @return found user or null if user with given username doesn't exists
-     * @throws AuthenticationProviderException
-     */
-    AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
-
-    /**
-     * Try to register user with this authentication provider
-     *
-     * @param realm
-     * @param configuration
-     * @param username
-     * @return ID of newly created user (For example ID from LDAP)
-     * @throws AuthenticationProviderException if user creation couldn't happen
-     */
-    String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
-
-    /**
-     * Standard Authentication flow
-     *
-     * @param username
-     * @param password
-     * @return result of authentication, which might eventually encapsulate info about authenticated user and provider which successfully authenticated
-     */
-    AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
-
-
-    /**
-     * Update credential
-     *
-     * @param realm
-     * @param configuration
-     * @param username
-     * @param password
-     * @return true if credential has been successfully updated
-     * @throws AuthenticationProviderException
-     */
-    boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
-
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderException.java

@@ -1,24 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationProviderException extends Exception {
-
-    private static final long serialVersionUID = 15L;
-
-    protected AuthenticationProviderException() {
-    }
-
-    public AuthenticationProviderException(String message) {
-        super(message);
-    }
-
-    public AuthenticationProviderException(Throwable cause) {
-        super(cause);
-    }
-
-    public AuthenticationProviderException(String message, Throwable cause) {
-        super(message, cause);
-    }
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderFactory.java

@@ -1,9 +0,0 @@
-package org.keycloak.authentication;
-
-import org.keycloak.provider.ProviderFactory;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface AuthenticationProviderFactory extends ProviderFactory<AuthenticationProvider> {
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java

@@ -1,219 +0,0 @@
-package org.keycloak.authentication;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.jboss.logging.Logger;
-import org.keycloak.models.AuthenticationLinkModel;
-import org.keycloak.models.AuthenticationProviderModel;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.provider.ProviderSession;
-import org.keycloak.util.ProviderLoader;
-
-/**
- * Access point to authentication SPI. It finds configured and available {@link AuthenticationProvider} instances for current realm
- * and then delegates method call to them.
- *
- * Example of usage: AuthenticationProviderManager.getManager(realm).validateUser("joe", "password");
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationProviderManager {
-
-    private static final Logger logger = Logger.getLogger(AuthenticationProviderManager.class);
-
-    private final RealmModel realm;
-    private final Map<String, AuthenticationProvider> delegates;
-
-    public static AuthenticationProviderManager getManager(RealmModel realm, ProviderSession providerSession) {
-        Iterable<AuthenticationProvider> providers = providerSession.getAllProviders(AuthenticationProvider.class);
-
-        Map<String, AuthenticationProvider> providersMap = new HashMap<String, AuthenticationProvider>();
-        for (AuthenticationProvider provider : providers) {
-            providersMap.put(provider.getName(), provider);
-        }
-
-        return new AuthenticationProviderManager(realm, providersMap);
-    }
-
-    public AuthenticationProviderManager(RealmModel realm, Map<String, AuthenticationProvider> delegates) {
-        this.realm = realm;
-        this.delegates = delegates;
-    }
-
-    public AuthUser getUser(String username) {
-        List<AuthenticationProviderModel> authProviderModels = getConfiguredProviderModels(realm);
-        for (AuthenticationProviderModel providerModel : authProviderModels) {
-            AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
-            if (delegate == null) {
-                continue;
-            }
-
-            try {
-                AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), username);
-                if (authUser != null) {
-                    logger.debugf("User '%s' found with provider '%s'", username, providerModel.getProviderName());
-                    return authUser;
-                }
-            } catch (AuthenticationProviderException ape) {
-                logger.warn(ape.getMessage(), ape);
-            }
-        }
-
-        logger.debugf("User '%s' not found with any provider", username);
-        return null;
-    }
-
-    public AuthProviderStatus validatePassword(UserModel user, String password) {
-        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
-        if (authLink == null) {
-            // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
-            AuthUser authUser = getUser(user.getLoginName());
-            authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
-            realm.setAuthenticationLink(user, authLink);
-            logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
-        }
-
-        String providerName = authLink.getAuthProvider();
-
-        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
-        AuthenticationProvider delegate = getProvider(providerName);
-        if (delegate == null || providerModel == null) {
-            return AuthProviderStatus.FAILED;
-        }
-
-        try {
-            checkCorrectAuthLink(delegate, providerModel, authLink, user.getLoginName());
-
-            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getLoginName(), password);
-            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getLoginName());
-            return currentResult;
-        } catch (AuthenticationProviderException ape) {
-            logger.warn(ape.getMessage(), ape);
-            return AuthProviderStatus.FAILED;
-        }
-    }
-
-    public boolean updatePassword(UserModel user, String password) throws AuthenticationProviderException {
-        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
-        if (authLink == null) {
-            // Find provider with biggest priority where password update is supported. Then register user here and link him
-            List<AuthenticationProviderModel> configuredProviders = getConfiguredProviderModels(realm);
-            for (AuthenticationProviderModel providerModel : configuredProviders) {
-                if (providerModel.isPasswordUpdateSupported()) {
-                    AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
-                    if (delegate != null) {
-                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getLoginName());
-                        if (authUser != null) {
-                            // Linking existing user supported just for "model" provider. In other cases throw exception
-                            if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
-                                authLink = new AuthenticationLinkModel(providerModel.getProviderName(), authUser.getId());
-                                realm.setAuthenticationLink(user, authLink);
-                                logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
-                            } else {
-                                throw new AuthenticationProviderException("User " + authUser.getUsername() + " exists in provider "
-                                        + authUser.getProviderName() + " but is not linked with model user");
-                            }
-                        } else {
-                            String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user.getLoginName());
-                            authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
-                            realm.setAuthenticationLink(user, authLink);
-                            logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
-                        }
-                        break;
-                    }
-                }
-            }
-
-            if (authLink == null) {
-                logger.warnf("No providers found where password update is supported for user '%s'", user.getLoginName());
-                return false;
-            }
-        }
-
-        String providerName = authLink.getAuthProvider();
-
-        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
-        if (providerModel == null) {
-            return false;
-        }
-
-        String username = user.getLoginName();
-
-        // Update just those, which support password update
-        if (providerModel.isPasswordUpdateSupported()) {
-            try {
-                AuthenticationProvider delegate = getProvider(providerName);
-                if (delegate == null) {
-                    return false;
-                }
-
-                checkCorrectAuthLink(delegate, providerModel, authLink, username);
-
-                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getLoginName(), password)) {
-                    logger.debugf("Updated password in authentication provider '%s' for user '%s'", providerName, username);
-                    return true;
-                } else {
-                    logger.warnf("Password not updated in authentication provider '%s' for user '%s'", providerName, username);
-                    return false;
-                }
-            } catch (AuthenticationProviderException ape) {
-                // Rethrow it to upper layer
-                logger.warn("Failed to update password: " + ape.getMessage());
-                throw ape;
-            }
-        } else {
-            logger.warnf("Skip password update for authentication provider '%s' for user '%s'", providerName, username);
-            return false;
-        }
-    }
-
-    private AuthenticationProvider getProvider(String providerName) {
-        AuthenticationProvider delegate = delegates.get(providerName);
-        if (delegate == null) {
-            logger.warnf("Provider '%s' not available on classpath", providerName);
-        }
-        return delegate;
-    }
-
-    private static List<AuthenticationProviderModel> getConfiguredProviderModels(RealmModel realm) {
-        List<AuthenticationProviderModel> configuredProviders = realm.getAuthenticationProviders();
-
-        // Use model based authentication of current realm by default
-        if (configuredProviders == null || configuredProviders.isEmpty()) {
-            configuredProviders = Collections.EMPTY_LIST;
-            logger.warnf("No authentication providers found");
-        }
-
-        return configuredProviders;
-    }
-
-    public static AuthenticationProviderModel getConfiguredProviderModel(RealmModel realm, String providerName) {
-        List<AuthenticationProviderModel> providers = getConfiguredProviderModels(realm);
-        for (AuthenticationProviderModel provider : providers) {
-            if (providerName.equals(provider.getProviderName())) {
-                return provider;
-            }
-        }
-
-        logger.warnf("Provider '%s' not configured in realm", providerName);
-        return null;
-    }
-
-    // Check if ID of linked AuthUser is same as expected ID from authenticationLink . It should catch the case when for example user "john" was deleted in LDAP
-    // and then user "john" has been created again, but it's actually different user with different ID
-    private void checkCorrectAuthLink(AuthenticationProvider authProvider, AuthenticationProviderModel providerModel,
-                                      AuthenticationLinkModel authLinkModel, String username) throws AuthenticationProviderException {
-        AuthUser authUser = authProvider.getUser(realm, providerModel.getConfig(), username);
-        if (authUser == null) {
-            throw new AuthenticationProviderException("User " + username + " not found in authentication provider " + providerModel.getProviderName());
-        }
-        String userExternalId = authUser.getId();
-        if (!userExternalId.equals(authLinkModel.getAuthUserId())) {
-            throw new AuthenticationProviderException("ID did not match! ID from provider: " + userExternalId + ", ID from authentication link: " + authLinkModel.getAuthUserId());
-        }
-    }
-}

authentication/authentication-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -1 +0,0 @@
-org.keycloak.authentication.AuthenticationSpi

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java

@@ -1,84 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Map;
-
-import org.jboss.logging.Logger;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.idm.CredentialRepresentation;
-import org.keycloak.authentication.AuthProviderStatus;
-import org.keycloak.authentication.AuthUser;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderException;
-
-/**
- * Authentication provider, which delegates calling of all methods to specified realm
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public abstract class AbstractModelAuthenticationProvider implements AuthenticationProvider {
-
-    private static final Logger logger = Logger.getLogger(AbstractModelAuthenticationProvider.class);
-
-    @Override
-    public AuthUser getUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
-        return user == null ? null : createAuthenticatedUserInstance(user);
-    }
-
-    @Override
-    public String registerUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = currentRealm.addUser(username);
-        user.setEnabled(true);
-        return user.getId();
-    }
-
-    @Override
-    public AuthProviderStatus validatePassword(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
-
-        boolean result = realm.validatePassword(user, password);
-        return result ? AuthProviderStatus.SUCCESS : AuthProviderStatus.INVALID_CREDENTIALS;
-    }
-
-    @Override
-    public boolean updateCredential(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-
-        // Validate password policy
-        String error = realm.getPasswordPolicy().validate(password);
-        if (error != null) {
-            throw new AuthenticationProviderException(error);
-        }
-
-        UserModel user = realm.getUser(username);
-        if (user == null) {
-            logger.warnf("User '%s' doesn't exists. Skip password update", username);
-            return false;
-        }
-
-        UserCredentialModel cred = new UserCredentialModel();
-        cred.setType(CredentialRepresentation.PASSWORD);
-        cred.setValue(password);
-
-        realm.updateCredential(user, cred);
-        return true;
-    }
-
-    @Override
-    public void close() {
-    }
-
-    protected abstract RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) throws AuthenticationProviderException;
-
-    protected AuthUser createAuthenticatedUserInstance(UserModel user) {
-        return new AuthUser(user.getId(), user.getLoginName(), getName())
-                .setName(user.getFirstName(), user.getLastName())
-                .setEmail(user.getEmail());
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java

@@ -1,53 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import org.jboss.resteasy.spi.ResteasyProviderFactory;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProviderException;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * AbstractModelAuthenticationProvider, which delegates authentication operations to different (external) realm
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ExternalModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
-
-    public ExternalModelAuthenticationProvider(ProviderSession providerSession) {
-    }
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Arrays.asList(AuthProviderConstants.EXTERNAL_REALM_ID);
-    }
-
-    @Override
-    public RealmModel getRealm(RealmModel currentRealm, Map<String, String> configuration) throws AuthenticationProviderException {
-        String realmId = configuration.get(AuthProviderConstants.EXTERNAL_REALM_ID);
-        if (realmId == null) {
-            throw new AuthenticationProviderException("Option '" + AuthProviderConstants.EXTERNAL_REALM_ID + "' not specified in configuration");
-        }
-
-        // TODO: This won't be needed when KeycloakSession is available from ProviderSession
-        KeycloakSession session = ResteasyProviderFactory.getContextData(KeycloakSession.class);
-        if (session == null) {
-            throw new AuthenticationProviderException("KeycloakSession not available");
-        }
-
-        RealmModel realm = session.getRealm(realmId);
-        if (realm == null) {
-            throw new AuthenticationProviderException("Realm with id '" + realmId + "' doesn't exists");
-        }
-        return realm;
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java

@@ -1,32 +0,0 @@
-package org.keycloak.authentication.model;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ExternalModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new ExternalModelAuthenticationProvider(providerSession);
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
-    }
-
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java

@@ -1,31 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.models.RealmModel;
-import org.keycloak.authentication.AuthProviderConstants;
-
-/**
- * AbstractModelAuthenticationProvider, which uses current realm to call operations on
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_MODEL;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Collections.EMPTY_LIST;
-    }
-
-    @Override
-    protected RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) {
-        return currentRealm;
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java

@@ -1,32 +0,0 @@
-package org.keycloak.authentication.model;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new ModelAuthenticationProvider();
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_MODEL;
-    }
-
-}

authentication/authentication-model/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -1,2 +0,0 @@
-org.keycloak.authentication.model.ModelAuthenticationProviderFactory
-org.keycloak.authentication.model.ExternalModelAuthenticationProviderFactory

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java

@@ -1,130 +0,0 @@
-package org.keycloak.authentication.picketlink;
-
-import org.jboss.logging.Logger;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthProviderStatus;
-import org.keycloak.authentication.AuthUser;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderException;
-import org.keycloak.models.RealmModel;
-import org.keycloak.picketlink.IdentityManagerProvider;
-import org.picketlink.idm.IdentityManagementException;
-import org.picketlink.idm.IdentityManager;
-import org.picketlink.idm.credential.Credentials;
-import org.picketlink.idm.credential.Password;
-import org.picketlink.idm.credential.UsernamePasswordCredentials;
-import org.picketlink.idm.model.basic.BasicModel;
-import org.picketlink.idm.model.basic.User;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-/**
- * AuthenticationProvider, which delegates authentication to picketlink
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class PicketlinkAuthenticationProvider implements AuthenticationProvider {
-
-    private static final Logger logger = Logger.getLogger(PicketlinkAuthenticationProvider.class);
-
-    private final IdentityManagerProvider identityManagerProvider;
-
-    public PicketlinkAuthenticationProvider(IdentityManagerProvider identityManagerProvider) {
-        this.identityManagerProvider = identityManagerProvider;
-    }
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Collections.EMPTY_LIST;
-    }
-
-    @Override
-    public AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = BasicModel.getUser(identityManager, username);
-            return picketlinkUser == null ? null : new AuthUser(picketlinkUser.getId(), picketlinkUser.getLoginName(), getName())
-                    .setName(picketlinkUser.getFirstName(), picketlinkUser.getLastName())
-                    .setEmail(picketlinkUser.getEmail())
-                    .setProviderName(getName());
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = new User(username);
-            identityManager.add(picketlinkUser);
-            return picketlinkUser.getId();
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            UsernamePasswordCredentials credential = new UsernamePasswordCredentials();
-            credential.setUsername(username);
-            credential.setPassword(new Password(password.toCharArray()));
-            identityManager.validateCredentials(credential);
-            if (credential.getStatus() == Credentials.Status.VALID) {
-                return AuthProviderStatus.SUCCESS;
-            } else {
-                return AuthProviderStatus.INVALID_CREDENTIALS;
-            }
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = BasicModel.getUser(identityManager, username);
-            if (picketlinkUser == null) {
-                logger.debugf("User '%s' doesn't exists. Skip password update", username);
-                return false;
-            }
-
-            identityManager.updateCredential(picketlinkUser, new Password(password.toCharArray()));
-            return true;
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public void close() {
-    }
-
-    public IdentityManager getIdentityManager(RealmModel realm) throws AuthenticationProviderException {
-        return identityManagerProvider.getIdentityManager(realm);
-    }
-
-    private AuthenticationProviderException convertIDMException(IdentityManagementException ie) {
-        Throwable realCause = ie;
-        while (realCause.getCause() != null) {
-            realCause = realCause.getCause();
-        }
-
-        // Use the message from the realCause
-        return new AuthenticationProviderException(realCause.getMessage(), ie);
-    }
-}

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProviderFactory.java

@@ -1,33 +0,0 @@
-package org.keycloak.authentication.picketlink;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.picketlink.IdentityManagerProvider;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class PicketlinkAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new PicketlinkAuthenticationProvider(providerSession.getProvider(IdentityManagerProvider.class));
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
-    }
-
-}

authentication/authentication-picketlink/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -1 +0,0 @@
-org.keycloak.authentication.picketlink.PicketlinkAuthenticationProviderFactory

connections/jpa/pom.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.4.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-jpa</artifactId>
+    <name>Keycloak Connections JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProvider.java

@@ -0,0 +1,26 @@
+package org.keycloak.connections.jpa;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProvider implements JpaConnectionProvider {
+
+    private final EntityManager em;
+
+    public DefaultJpaConnectionProvider(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public EntityManager getEntityManager() {
+        return em;
+    }
+
+    @Override
+    public void close() {
+        em.close();
+    }
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java

@@ -0,0 +1,101 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.ejb.AvailableSettings;
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProviderFactory implements JpaConnectionProviderFactory {
+
+    private volatile EntityManagerFactory emf;
+
+    private Config.Scope config;
+
+    @Override
+    public JpaConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        EntityManager em = emf.createEntityManager();
+        em = PersistenceExceptionConverter.create(em);
+        session.getTransaction().enlist(new JpaKeycloakTransaction(em));
+        return new DefaultJpaConnectionProvider(em);
+    }
+
+    @Override
+    public void close() {
+        if (emf != null) {
+            emf.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (emf == null) {
+            synchronized (this) {
+                if (emf == null) {
+                    String unitName = config.get("unitName");
+                    Map<String, Object> properties = new HashMap<String, Object>();
+
+                    // Only load config from keycloak-server.json if unitName is not specified
+                    if (unitName == null) {
+                        unitName = "keycloak-default";
+
+                        String dataSource = config.get("dataSource");
+                        if (dataSource != null) {
+                            if (config.getBoolean("jta", false)) {
+                                properties.put(AvailableSettings.JTA_DATASOURCE, dataSource);
+                            } else {
+                                properties.put(AvailableSettings.NON_JTA_DATASOURCE, dataSource);
+                            }
+                        } else {
+                            properties.put(AvailableSettings.JDBC_URL, config.get("url"));
+                            properties.put(AvailableSettings.JDBC_DRIVER, config.get("driver"));
+
+                            String user = config.get("user");
+                            if (user != null) {
+                                properties.put(AvailableSettings.JDBC_USER, user);
+                            }
+                            String password = config.get("password");
+                            if (password != null) {
+                                properties.put(AvailableSettings.JDBC_PASSWORD, password);
+                            }
+                        }
+
+                        String driverDialect = config.get("driverDialect");
+                        if (driverDialect != null && driverDialect.length() > 0) {
+                            properties.put("hibernate.dialect", driverDialect);
+                        }
+
+                        String databaseSchema = config.get("databaseSchema", "validate");
+                        if (databaseSchema != null) {
+                            properties.put("hibernate.hbm2ddl.auto", databaseSchema);
+                        }
+
+                        properties.put("hibernate.show_sql", config.getBoolean("showSql", false));
+                        properties.put("hibernate.format_sql", config.getBoolean("formatSql", true));
+                    }
+
+                    emf = Persistence.createEntityManagerFactory(unitName, properties);
+                }
+            }
+        }
+    }
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProvider.java

@@ -0,0 +1,14 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProvider extends Provider {
+
+    EntityManager getEntityManager();
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProviderFactory extends ProviderFactory<JpaConnectionProvider> {
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionSpi.java

@@ -1,4 +1,4 @@
-package org.keycloak.authentication;
+package org.keycloak.connections.jpa;
 
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
@@ -7,21 +7,21 @@ import org.keycloak.provider.Spi;
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class AuthenticationSpi implements Spi {
+public class JpaConnectionSpi implements Spi {
 
     @Override
     public String getName() {
-        return "authentication";
+        return "connectionsJpa";
     }
 
     @Override
     public Class<? extends Provider> getProviderClass() {
-        return AuthenticationProvider.class;
+        return JpaConnectionProvider.class;
     }
 
     @Override
     public Class<? extends ProviderFactory> getProviderFactoryClass() {
-        return AuthenticationProviderFactory.class;
+        return JpaConnectionProviderFactory.class;
     }
 
 }

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaKeycloakTransaction.java

@@ -0,0 +1,53 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java

@@ -0,0 +1,48 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}

connections/jpa/src/main/resources/META-INF/persistence.xml

@@ -0,0 +1,36 @@
+<persistence xmlns="http://java.sun.com/xml/ns/persistence"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
+    version="1.0">
+    <persistence-unit name="keycloak-default" transaction-type="RESOURCE_LOCAL">
+        <class>org.keycloak.models.jpa.entities.ApplicationEntity</class>
+        <class>org.keycloak.models.jpa.entities.CredentialEntity</class>
+        <class>org.keycloak.models.jpa.entities.OAuthClientEntity</class>
+        <class>org.keycloak.models.jpa.entities.RealmEntity</class>
+        <class>org.keycloak.models.jpa.entities.RealmAttributeEntity</class>
+        <class>org.keycloak.models.jpa.entities.RequiredCredentialEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserFederationProviderEntity</class>
+        <class>org.keycloak.models.jpa.entities.RoleEntity</class>
+        <class>org.keycloak.models.jpa.entities.SocialLinkEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserRequiredActionEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserAttributeEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserRoleMappingEntity</class>
+        <class>org.keycloak.models.jpa.entities.ScopeMappingEntity</class>
+
+        <!-- JpaUserSessionProvider -->
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionRoleEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UserSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UsernameLoginFailureEntity</class>
+
+        <!-- JpaAuditProvider -->
+        <class>org.keycloak.events.jpa.EventEntity</class>
+
+        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+        
+        <properties>
+            <property name="jboss.as.jpa.managed" value="false"/>
+        </properties>
+    </persistence-unit>
+</persistence>

connections/jpa/src/main/resources/META-INF/services/org.keycloak.connections.jpa.JpaConnectionProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory

connections/jpa/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1 @@
+org.keycloak.connections.jpa.JpaConnectionSpi

connections/mongo/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.4.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-mongo</artifactId>
+    <name>Keycloak Connections Mongo</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+</project>

connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionFactoryProvider.java

@@ -0,0 +1,111 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.connections.mongo.impl.context.TransactionMongoStoreInvocationContext;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Collections;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionFactoryProvider implements MongoConnectionProviderFactory {
+
+    // TODO Make configurable
+    private String[] entities = new String[]{
+            "org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoUserEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity",
+            "org.keycloak.models.entities.RequiredCredentialEntity",
+            "org.keycloak.models.entities.CredentialEntity",
+            "org.keycloak.models.entities.SocialLinkEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUsernameLoginFailureEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUserSessionEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoClientSessionEntity",
+            "org.keycloak.models.entities.UserFederationProviderEntity"
+    };
+
+    private static final Logger logger = Logger.getLogger(DefaultMongoConnectionFactoryProvider.class);
+
+    private volatile MongoClient client;
+
+    private MongoStore mongoStore;
+    private DB db;
+    private Config.Scope config;
+
+    @Override
+    public MongoConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        TransactionMongoStoreInvocationContext invocationContext = new TransactionMongoStoreInvocationContext(mongoStore);
+        session.getTransaction().enlist(new MongoKeycloakTransaction(invocationContext));
+        return new DefaultMongoConnectionProvider(db, mongoStore, invocationContext);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (client == null) {
+            synchronized (this) {
+                if (client == null) {
+                    try {
+                        String host = config.get("host", ServerAddress.defaultHost());
+                        int port = config.getInt("port", ServerAddress.defaultPort());
+                        String dbName = config.get("db", "keycloak");
+                        boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
+
+                        String user = config.get("user");
+                        String password = config.get("password");
+                        if (user != null && password != null) {
+                            MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                            client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
+                        } else {
+                            client = new MongoClient(host, port);
+                        }
+
+                        this.db = client.getDB(dbName);
+
+                        this.mongoStore = new MongoStoreImpl(db, clearOnStartup, getManagedEntities());
+
+                        logger.infof("Initialized mongo model. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                }
+            }
+        }
+    }
+
+    private Class[] getManagedEntities() throws ClassNotFoundException {
+       Class[] entityClasses = new Class[entities.length];
+        for (int i = 0; i < entities.length; i++) {
+            entityClasses[i] = Thread.currentThread().getContextClassLoader().loadClass(entities[i]);
+        }
+        return entityClasses;
+    }
+
+    @Override
+    public void close() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionProvider.java

@@ -0,0 +1,41 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionProvider implements MongoConnectionProvider {
+
+    private DB db;
+    private MongoStore mongoStore;
+    private MongoStoreInvocationContext invocationContext;
+
+    public DefaultMongoConnectionProvider(DB db, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.db = db;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public DB getDB() {
+        return db;
+    }
+
+    @Override
+    public MongoStore getMongoStore() {
+        return mongoStore;
+    }
+
+    @Override
+    public MongoStoreInvocationContext getInvocationContext() {
+        return invocationContext;
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProvider.java

@@ -0,0 +1,19 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProvider extends Provider {
+
+    DB getDB();
+
+    MongoStore getMongoStore();
+
+    MongoStoreInvocationContext getInvocationContext();
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProviderFactory extends ProviderFactory<MongoConnectionProvider> {
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsMongo";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MongoConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MongoConnectionProviderFactory.class;
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoKeycloakTransaction.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.keycloak.adapters;
+package org.keycloak.connections.mongo;
 
 import com.mongodb.MongoException;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
 import org.keycloak.models.KeycloakTransaction;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -42,11 +42,13 @@ public class MongoKeycloakTransaction implements KeycloakTransaction {
         } catch (MongoException e) {
             throw MongoStoreImpl.convertException(e);
         }
+        started = false;
     }
 
     @Override
     public void rollback() {
         invocationContext.rollback();
+        started = false;
     }
 
     @Override

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoCollection.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Inherited;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoEntity.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 /**
  * Base interface for object, which is persisted in Mongo

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoField.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoIdentifiableEntity.java

@@ -1,6 +1,6 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * Entity with Id

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoIndex.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Inherited;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoIndexes.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Inherited;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoStore.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import com.mongodb.DBObject;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 
 import java.util.List;
 
@@ -31,6 +31,10 @@ public interface MongoStore {
 
     <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);
 
+    <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context);
+
+    <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);
+
     boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context);
 
     boolean removeEntity(Class<? extends MongoIdentifiableEntity> type, String id, MongoStoreInvocationContext context);
@@ -41,8 +45,4 @@ public interface MongoStore {
 
     <S> boolean pullItemFromList(MongoIdentifiableEntity entity, String listPropertyName, S itemToPull, MongoStoreInvocationContext context);
 
-    /**
-     * Completely remove all data from DB
-     */
-    void removeAllEntities();
 }

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/context/MongoStoreInvocationContext.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;
 
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
 
 /**
  * Context, which provides callback methods to be invoked by MongoStore

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/context/MongoTask.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/Mapper.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 /**
  * SPI object to convert object from application type to database type and vice versa. Shouldn't be directly used by application.

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/MapperContext.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 import java.util.List;
 

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/MapperRegistry.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 import java.util.HashMap;
 import java.util.Map;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/EntityInfo.java

@@ -1,6 +1,5 @@
-package org.keycloak.models.mongo.impl;
+package org.keycloak.connections.mongo.impl;
 
-import org.keycloak.models.mongo.api.MongoEntity;
 import org.keycloak.models.utils.reflection.Property;
 
 import java.util.Collection;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.impl;
+package org.keycloak.connections.mongo.impl;
 
 import com.mongodb.BasicDBList;
 import com.mongodb.BasicDBObject;
@@ -8,31 +8,29 @@ import com.mongodb.DBCursor;
 import com.mongodb.DBObject;
 import com.mongodb.MongoException;
 import org.jboss.logging.Logger;
-import org.keycloak.models.ModelException;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoEntity;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.MongoIndexes;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.types.BasicDBListMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectToMapMapper;
+import org.keycloak.connections.mongo.impl.types.EnumToStringMapper;
+import org.keycloak.connections.mongo.impl.types.ListMapper;
+import org.keycloak.connections.mongo.impl.types.MapMapper;
+import org.keycloak.connections.mongo.impl.types.MongoEntityMapper;
+import org.keycloak.connections.mongo.impl.types.SimpleMapper;
+import org.keycloak.connections.mongo.impl.types.StringToEnumMapper;
 import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoField;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.MongoIndexes;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.types.BasicDBListMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectToMapMapper;
-import org.keycloak.models.mongo.impl.types.EnumToStringMapper;
-import org.keycloak.models.mongo.impl.types.ListMapper;
-import org.keycloak.models.mongo.impl.types.MapMapper;
-import org.keycloak.models.mongo.impl.types.MongoEntityMapper;
-import org.keycloak.models.mongo.impl.types.SimpleMapper;
-import org.keycloak.models.mongo.impl.types.StringToEnumMapper;
+import org.keycloak.models.ModelException;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.reflection.AnnotatedPropertyCriteria;
 import org.keycloak.models.utils.reflection.Property;
 import org.keycloak.models.utils.reflection.PropertyQueries;
 
@@ -41,7 +39,6 @@ import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
@@ -283,6 +280,35 @@ public class MongoStoreImpl implements MongoStore {
         return convertCursor(type, cursor, context);
     }
 
+    @Override
+    public <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context) {
+        // First we should execute all pending tasks before searching DB
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        DBCursor cursor = dbCollection.find(query);
+        if (firstResult != -1) {
+            cursor.skip(firstResult);
+        }
+        if (maxResults != -1) {
+            cursor.limit(maxResults);
+        }
+        if (sort != null) {
+            cursor.sort(sort);
+        }
+
+        return convertCursor(type, cursor, context);
+    }
+
+    public <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context) {
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        Long count = dbCollection.count(query);
+
+        // For now, assume that int is sufficient
+        return count.intValue();
+    }
 
     @Override
     public boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
@@ -417,13 +443,6 @@ public class MongoStoreImpl implements MongoStore {
         }
     }
 
-    @Override
-    public void removeAllEntities() {
-        Set<Class<?>> managedTypes = this.entityInfoCache.keySet();
-        Class<? extends MongoEntity>[] arrayTemplate = (Class<? extends MongoEntity>[])new Class<?>[0];
-        this.clearManagedCollections(managedTypes.toArray(arrayTemplate));
-    }
-
     // Possibility to add user-defined mappers
     public void addAppObjectConverter(Mapper<?, ?> mapper) {
         mapperRegistry.addAppObjectMapper(mapper);

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/context/SimpleMongoStoreInvocationContext.java

@@ -1,10 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;
 
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
 
 /**
  * Context, which is not doing any postponing of tasks and does not cache anything

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/context/TransactionMongoStoreInvocationContext.java

@@ -1,4 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;
+
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
 
 import java.util.HashMap;
 import java.util.HashSet;
@@ -6,11 +11,6 @@ import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
 
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-
 /**
  * Invocation context, which has some very basic support for transactions, and is able to cache loaded objects.
  * It always execute all pending update tasks before start searching for other objects

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
 import java.util.ArrayList;
 import java.util.List;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBObjectMapper.java

@@ -1,22 +1,21 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.models.utils.reflection.Property;
+import org.keycloak.models.utils.reflection.Types;
 
 import java.lang.reflect.ParameterizedType;
 import java.lang.reflect.Type;
 import java.util.ArrayList;
 import java.util.List;
 
-import com.mongodb.BasicDBObject;
-import org.jboss.logging.Logger;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
-import org.keycloak.models.utils.reflection.Property;
-import org.keycloak.models.utils.reflection.Types;
-
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBObjectToMapMapper.java

@@ -1,12 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 import java.util.HashMap;
 import java.util.Map;
 
-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
  * For now, there is support just for convert to Map<String, String>
  *

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/EnumToStringMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
 import java.util.List;
 

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/MapMapper.java

@@ -1,12 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 import java.util.Map;
 import java.util.Set;
 
-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
  * For now, we support just convert from Map<String, String>
  *

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/MongoEntityMapper.java

@@ -1,11 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
 import org.keycloak.models.utils.reflection.Property;
 
 import java.util.Collection;
@@ -38,7 +39,7 @@ public class MongoEntityMapper<T> implements Mapper<T, BasicDBObject> {
             String propName = property.getName();
 
             // Ignore "id" property
-            if (!"id".equals(propName)) {
+            if (!"id".equals(propName) || !(applicationObject instanceof MongoIdentifiableEntity)) {
                 Object propValue = property.getValue(applicationObject);
                 if (propValue != null) {
                     Object dbValue = propValue == null ? null : mapperRegistry.convertApplicationObjectToDBObject(propValue, Object.class);

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/SimpleMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * Just returns input

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/StringToEnumMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/resources/META-INF/services/org.keycloak.connections.mongo.MongoConnectionProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.mongo.DefaultMongoConnectionFactoryProvider

connections/mongo/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1 @@
+org.keycloak.connections.mongo.MongoConnectionSpi

connections/pom.xml

@@ -0,0 +1,31 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0.4.Final</version>
+    </parent>
+    <name>Connections Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-pom</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>jpa</module>
+        <module>mongo</module>
+    </modules>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

core-jaxrs/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-1-20150523</version>
+        <version>1.0.4.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-1-20150523</version>
+        <version>1.0.4.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -13,6 +13,10 @@
     <name>Keycloak Core</name>
     <description/>
 
+    <properties>
+        <timestamp>${maven.build.timestamp}</timestamp>
+        <maven.build.timestamp.format>yyyy-MM-dd HH:mm</maven.build.timestamp.format>
+    </properties>
     <dependencies>
         <dependency>
             <groupId>org.bouncycastle</groupId>
@@ -41,6 +45,12 @@
         </dependency>
     </dependencies>
     <build>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+                <filtering>true</filtering>
+            </resource>
+        </resources>
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>

core/src/main/java/org/keycloak/AbstractOAuthClient.java

@@ -19,6 +19,7 @@ public class AbstractOAuthClient {
     protected String authUrl;
     protected String codeUrl;
     protected String refreshUrl;
+    protected boolean relativeUrls;
     protected String scope;
     protected String stateCookieName = OAUTH_TOKEN_REQUEST_STATE;
     protected String stateCookiePath;
@@ -100,6 +101,14 @@ public class AbstractOAuthClient {
         this.publicClient = publicClient;
     }
 
+    public boolean isRelativeUrls() {
+        return relativeUrls;
+    }
+
+    public void setRelativeUrls(boolean relativeUrls) {
+        this.relativeUrls = relativeUrls;
+    }
+
     protected String stripOauthParametersFromRedirect(String uri) {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(uri)
                 .replaceQueryParam(OAuth2Constants.CODE, null)

core/src/main/java/org/keycloak/ClientConnection.java

@@ -1,4 +1,4 @@
-package org.keycloak.services;
+package org.keycloak;
 
 /**
  * Information about the client connection

core/src/main/java/org/keycloak/Config.java

@@ -12,11 +12,16 @@ public class Config {
     }
 
     public static String getAdminRealm() {
-        return configProvider.scope("admin").get("realm", "keycloak-admin");
+        return configProvider.scope("admin").get("realm", "master");
     }
 
     public static String getProvider(String spi) {
-        return configProvider.getProvider(spi);
+        String provider = configProvider.getProvider(spi);
+        if (provider == null || provider.trim().equals("")) {
+            return null;
+        } else {
+            return provider;
+        }
     }
 
     public static Scope scope(String... scope) {

core/src/main/java/org/keycloak/KeycloakPrincipal.java

@@ -9,11 +9,15 @@ import java.security.Principal;
  */
 public class KeycloakPrincipal implements Principal, Serializable {
     protected final String name;
-    protected final String surrogate;
+    protected final KeycloakSecurityContext context;
 
-    public KeycloakPrincipal(String name, String surrogate) {
+    public KeycloakPrincipal(String name, KeycloakSecurityContext context) {
         this.name = name;
-        this.surrogate = surrogate;
+        this.context = context;
+    }
+
+    public KeycloakSecurityContext getKeycloakSecurityContext() {
+        return context;
     }
 
     @Override
@@ -21,10 +25,6 @@ public class KeycloakPrincipal implements Principal, Serializable {
         return name;
     }
 
-    public String getSurrogate() {
-        return surrogate;
-    }
-
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
@@ -33,16 +33,13 @@ public class KeycloakPrincipal implements Principal, Serializable {
         KeycloakPrincipal that = (KeycloakPrincipal) o;
 
         if (!name.equals(that.name)) return false;
-        if (surrogate != null ? !surrogate.equals(that.surrogate) : that.surrogate != null) return false;
 
         return true;
     }
 
     @Override
     public int hashCode() {
-        int result = name.hashCode();
-        result = 31 * result + (surrogate != null ? surrogate.hashCode() : 0);
-        return result;
+        return name.hashCode();
     }
 
     @Override

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -17,7 +17,12 @@ public class RSATokenVerifier {
     }
 
     public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
-        JWSInput input = new JWSInput(tokenString);
+        JWSInput input = null;
+        try {
+            input = new JWSInput(tokenString);
+        } catch (Exception e) {
+            throw new VerificationException("Couldn't parse token", e);
+        }
         if (!isPublicKeyValid(input, realmKey)) throw new VerificationException("Invalid token signature.");
 
         AccessToken token;

core/src/main/java/org/keycloak/ServiceUrlConstants.java

@@ -10,6 +10,7 @@ public interface ServiceUrlConstants {
     public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/realms/{realm-name}/tokens/access/codes";
     public static final String TOKEN_SERVICE_REFRESH_PATH = "/realms/{realm-name}/tokens/refresh";
     public static final String TOKEN_SERVICE_LOGOUT_PATH = "/realms/{realm-name}/tokens/logout";
+    public static final String TOKEN_SERVICE_DIRECT_GRANT_PATH = "/realms/{realm-name}/tokens/grants/access";
     public static final String ACCOUNT_SERVICE_PATH = "/realms/{realm-name}/account";
     public static final String REALM_INFO_PATH = "/realms/{realm-name}";
 

core/src/main/java/org/keycloak/Version.java

@@ -0,0 +1,46 @@
+package org.keycloak;
+
+import org.codehaus.jackson.annotate.JsonProperty;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Version {
+    public static String VERSION;
+    public static String BUILD_TIME;
+    public static final String UNKNOWN = "UNKNOWN";
+    public static final Version SINGLETON;
+
+    private final String version = VERSION;
+    private final String buildTime = BUILD_TIME;
+
+    static {
+        Properties props = new Properties();
+        InputStream is = Version.class.getResourceAsStream("/keycloak-version.properties");
+        try {
+            props.load(is);
+            VERSION = props.getProperty("version");
+            BUILD_TIME = props.getProperty("build-time");
+        } catch (IOException e) {
+            VERSION=UNKNOWN;
+            BUILD_TIME=UNKNOWN;
+        }
+
+        SINGLETON = new Version();
+    }
+
+    @JsonProperty("version")
+    public String getVersion() {
+        return version;
+    }
+
+    @JsonProperty("build-time")
+    public String getBuildTime() {
+        return buildTime;
+    }
+}

core/src/main/java/org/keycloak/adapters/AdapterConstants.java

@@ -8,6 +8,7 @@ public interface AdapterConstants {
 
     // URL endpoints
     public static final String K_LOGOUT = "k_logout";
+    public static final String K_VERSION = "k_version";
     public static final String K_PUSH_NOT_BEFORE = "k_push_not_before";
     public static final String K_GET_USER_STATS = "k_get_user_stats";
     public static final String K_GET_SESSION_STATS = "k_get_session_stats";

core/src/main/java/org/keycloak/enums/SslRequired.java

@@ -0,0 +1,43 @@
+package org.keycloak.enums;
+
+import org.keycloak.ClientConnection;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public enum SslRequired {
+
+    ALL,
+    EXTERNAL,
+    NONE;
+
+    public boolean isRequired(ClientConnection connection) {
+        return isRequired(connection.getRemoteAddr());
+    }
+
+    public boolean isRequired(String address) {
+        switch (this) {
+            case ALL:
+                return true;
+            case NONE:
+                return false;
+            case EXTERNAL:
+                return !isLocal(address);
+            default:
+                return true;
+        }
+    }
+
+    private boolean isLocal(String remoteAddress) {
+        try {
+            InetAddress inetAddress = InetAddress.getByName(remoteAddress);
+            return inetAddress.isAnyLocalAddress() || inetAddress.isLoopbackAddress() || inetAddress.isSiteLocalAddress();
+        } catch (UnknownHostException e) {
+            return false;
+        }
+    }
+
+}

core/src/main/java/org/keycloak/provider/ProviderSession.java

@@ -1,20 +0,0 @@
-package org.keycloak.provider;
-
-import java.util.Set;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public interface ProviderSession {
-
-    <T extends Provider> T getProvider(Class<T> clazz);
-
-    <T extends Provider> T getProvider(Class<T> clazz, String id);
-
-    <T extends Provider> Set<String> listProviderIds(Class<T> clazz);
-
-    <T extends Provider> Set<T> getAllProviders(Class<T> clazz);
-
-    void close();
-
-}

core/src/main/java/org/keycloak/provider/ProviderSessionFactory.java

@@ -1,14 +0,0 @@
-package org.keycloak.provider;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public interface ProviderSessionFactory {
-
-    ProviderSession createSession();
-
-    void close();
-
-    void init();
-
-}

core/src/main/java/org/keycloak/representations/AccessTokenResponse.java

@@ -27,6 +27,9 @@ public class AccessTokenResponse {
     @JsonProperty("not-before-policy")
     protected int notBeforePolicy;
 
+    @JsonProperty("session-state")
+    protected String sessionState;
+
     public String getToken() {
         return token;
     }
@@ -74,4 +77,12 @@ public class AccessTokenResponse {
     public void setNotBeforePolicy(int notBeforePolicy) {
         this.notBeforePolicy = notBeforePolicy;
     }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
 }

core/src/main/java/org/keycloak/representations/PasswordToken.java

@@ -0,0 +1,47 @@
+package org.keycloak.representations;
+
+import org.keycloak.util.Time;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PasswordToken {
+
+    private String realm;
+    private String user;
+    private int timestamp;
+
+    public PasswordToken() {
+    }
+
+    public PasswordToken(String realm, String user) {
+        this.realm = realm;
+        this.user = user;
+        this.timestamp = Time.currentTime();
+    }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
+
+    public String getUser() {
+        return user;
+    }
+
+    public void setUser(String user) {
+        this.user = user;
+    }
+
+    public int getTimestamp() {
+        return timestamp;
+    }
+
+    public void setTimestamp(int timestamp) {
+        this.timestamp = timestamp;
+    }
+
+}

core/src/main/java/org/keycloak/representations/adapters/config/AdapterConfig.java

@@ -9,7 +9,7 @@ import org.codehaus.jackson.annotate.JsonPropertyOrder;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-not-required",
+@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-required",
         "resource", "credentials",
         "use-resource-role-mappings",
         "enable-cors", "cors-max-age", "cors-allowed-methods",

core/src/main/java/org/keycloak/representations/adapters/config/BaseAdapterConfig.java

@@ -12,7 +12,7 @@ import java.util.Map;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-not-required",
+@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-required",
         "resource", "public-client", "credentials",
         "use-resource-role-mappings",
         "enable-cors", "cors-max-age", "cors-allowed-methods",

core/src/main/java/org/keycloak/representations/adapters/config/BaseRealmConfig.java

@@ -9,7 +9,7 @@ import org.codehaus.jackson.annotate.JsonPropertyOrder;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-not-required"})
+@JsonPropertyOrder({"realm", "realm-public-key", "auth-server-url", "ssl-required"})
 public class BaseRealmConfig {
     @JsonProperty("realm")
     protected String realm;
@@ -17,15 +17,15 @@ public class BaseRealmConfig {
     protected String realmKey;
     @JsonProperty("auth-server-url")
     protected String authServerUrl;
-    @JsonProperty("ssl-not-required")
-    protected boolean sslNotRequired;
+    @JsonProperty("ssl-required")
+    protected String sslRequired;
 
-    public boolean isSslNotRequired() {
-        return sslNotRequired;
+    public String getSslRequired() {
+        return sslRequired;
     }
 
-    public void setSslNotRequired(boolean sslNotRequired) {
-        this.sslNotRequired = sslNotRequired;
+    public void setSslRequired(String sslRequired) {
+        this.sslRequired = sslRequired;
     }
 
     public String getRealm() {

core/src/main/java/org/keycloak/representations/idm/ApplicationRepresentation.java

@@ -21,6 +21,7 @@ public class ApplicationRepresentation {
     protected Integer notBefore;
     protected Boolean bearerOnly;
     protected Boolean publicClient;
+    protected Boolean fullScopeAllowed;
 
 
     public String getId() {
@@ -134,4 +135,12 @@ public class ApplicationRepresentation {
     public void setPublicClient(Boolean publicClient) {
         this.publicClient = publicClient;
     }
+
+    public Boolean isFullScopeAllowed() {
+        return fullScopeAllowed;
+    }
+
+    public void setFullScopeAllowed(Boolean fullScopeAllowed) {
+        this.fullScopeAllowed = fullScopeAllowed;
+    }
 }

core/src/main/java/org/keycloak/representations/idm/AuthenticationLinkRepresentation.java

@@ -1,26 +0,0 @@
-package org.keycloak.representations.idm;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationLinkRepresentation {
-
-    private String authProvider;
-    private String authUserId;
-
-    public String getAuthProvider() {
-        return authProvider;
-    }
-
-    public void setAuthProvider(String authProvider) {
-        this.authProvider = authProvider;
-    }
-
-    public String getAuthUserId() {
-        return authUserId;
-    }
-
-    public void setAuthUserId(String authUserId) {
-        this.authUserId = authUserId;
-    }
-}

core/src/main/java/org/keycloak/representations/idm/AuthenticationProviderRepresentation.java

@@ -1,37 +0,0 @@
-package org.keycloak.representations.idm;
-
-import java.util.Map;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationProviderRepresentation {
-
-    private String providerName;
-    private boolean passwordUpdateSupported = true;
-    private Map<String, String> config;
-
-    public String getProviderName() {
-        return providerName;
-    }
-
-    public void setProviderName(String providerName) {
-        this.providerName = providerName;
-    }
-
-    public boolean isPasswordUpdateSupported() {
-        return passwordUpdateSupported;
-    }
-
-    public void setPasswordUpdateSupported(boolean passwordUpdateSupported) {
-        this.passwordUpdateSupported = passwordUpdateSupported;
-    }
-
-    public Map<String, String> getConfig() {
-        return config;
-    }
-
-    public void setConfig(Map<String, String> config) {
-        this.config = config;
-    }
-}

core/src/main/java/org/keycloak/representations/idm/ClaimRepresentation.java

@@ -95,4 +95,40 @@ public class ClaimRepresentation {
     public void setPhone(boolean phone) {
         this.phone = phone;
     }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        ClaimRepresentation that = (ClaimRepresentation) o;
+
+        if (address != that.address) return false;
+        if (email != that.email) return false;
+        if (gender != that.gender) return false;
+        if (locale != that.locale) return false;
+        if (name != that.name) return false;
+        if (phone != that.phone) return false;
+        if (picture != that.picture) return false;
+        if (profile != that.profile) return false;
+        if (username != that.username) return false;
+        if (website != that.website) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = (name ? 1 : 0);
+        result = 31 * result + (username ? 1 : 0);
+        result = 31 * result + (profile ? 1 : 0);
+        result = 31 * result + (picture ? 1 : 0);
+        result = 31 * result + (website ? 1 : 0);
+        result = 31 * result + (email ? 1 : 0);
+        result = 31 * result + (gender ? 1 : 0);
+        result = 31 * result + (locale ? 1 : 0);
+        result = 31 * result + (address ? 1 : 0);
+        result = 31 * result + (phone ? 1 : 0);
+        return result;
+    }
 }

core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java

@@ -7,13 +7,23 @@ package org.keycloak.representations.idm;
 public class CredentialRepresentation {
     public static final String SECRET = "secret";
     public static final String PASSWORD = "password";
+    public static final String PASSWORD_TOKEN = "password-token";
     public static final String TOTP = "totp";
     public static final String CLIENT_CERT = "cert";
 
     protected String type;
-    protected String value;
     protected String device;
 
+    // Plain-text value of credential (used for example during import from manually created JSON file)
+    protected String value;
+
+    // Value stored in DB (used for example during export/import)
+    protected String hashedSaltedValue;
+    protected String salt;
+    protected Integer hashIterations;
+    // only used when updating a credential.  Might set required action
+    protected boolean temporary;
+
     public String getType() {
         return type;
     }
@@ -37,4 +47,36 @@ public class CredentialRepresentation {
     public void setDevice(String device) {
         this.device = device;
     }
+
+    public String getHashedSaltedValue() {
+        return hashedSaltedValue;
+    }
+
+    public void setHashedSaltedValue(String hashedSaltedValue) {
+        this.hashedSaltedValue = hashedSaltedValue;
+    }
+
+    public String getSalt() {
+        return salt;
+    }
+
+    public void setSalt(String salt) {
+        this.salt = salt;
+    }
+
+    public Integer getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(Integer hashIterations) {
+        this.hashIterations = hashIterations;
+    }
+
+    public boolean isTemporary() {
+        return temporary;
+    }
+
+    public void setTemporary(boolean temporary) {
+        this.temporary = temporary;
+    }
 }

core/src/main/java/org/keycloak/representations/idm/OAuthClientRepresentation.java

@@ -9,7 +9,6 @@ import java.util.List;
 public class OAuthClientRepresentation {
     protected String id;
     protected String name;
-    protected String baseUrl;
     protected List<String> redirectUris;
     protected List<String> webOrigins;
     protected Boolean enabled;
@@ -17,6 +16,8 @@ public class OAuthClientRepresentation {
     protected ClaimRepresentation claims;
     protected Integer notBefore;
     protected Boolean publicClient;
+    protected Boolean directGrantsOnly;
+    protected Boolean fullScopeAllowed;
 
 
     public String getId() {
@@ -43,14 +44,6 @@ public class OAuthClientRepresentation {
         this.enabled = enabled;
     }
 
-    public String getBaseUrl() {
-        return baseUrl;
-    }
-
-    public void setBaseUrl(String baseUrl) {
-        this.baseUrl = baseUrl;
-    }
-
     public List<String> getRedirectUris() {
         return redirectUris;
     }
@@ -98,4 +91,21 @@ public class OAuthClientRepresentation {
     public void setPublicClient(Boolean publicClient) {
         this.publicClient = publicClient;
     }
+
+    public Boolean isDirectGrantsOnly() {
+        return directGrantsOnly;
+    }
+
+    public void setDirectGrantsOnly(Boolean directGrantsOnly) {
+        this.directGrantsOnly = directGrantsOnly;
+    }
+
+    public Boolean isFullScopeAllowed() {
+        return fullScopeAllowed;
+    }
+
+    public void setFullScopeAllowed(Boolean fullScopeAllowed) {
+        this.fullScopeAllowed = fullScopeAllowed;
+    }
+
 }

core/src/main/java/org/keycloak/representations/idm/RealmAuditRepresentation.java

@@ -1,37 +0,0 @@
-package org.keycloak.representations.idm;
-
-import java.util.List;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class RealmAuditRepresentation {
-    protected boolean auditEnabled;
-    protected Long auditExpiration;
-    protected List<String> auditListeners;
-
-    public boolean isAuditEnabled() {
-        return auditEnabled;
-    }
-
-    public void setAuditEnabled(boolean auditEnabled) {
-        this.auditEnabled = auditEnabled;
-    }
-
-    public Long getAuditExpiration() {
-        return auditExpiration;
-    }
-
-    public void setAuditExpiration(Long auditExpiration) {
-        this.auditExpiration = auditExpiration;
-    }
-
-    public List<String> getAuditListeners() {
-        return auditListeners;
-    }
-
-    public void setAuditListeners(List<String> auditListeners) {
-        this.auditListeners = auditListeners;
-    }
-}