Set version to 1.0-beta-3

KEYCLOAK-534 Fix MS-SQL, Oracle and Sybase

audit/api/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

audit/email/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

audit/jboss-logging/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

audit/jpa/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java

@@ -5,6 +5,7 @@ import org.keycloak.audit.AuditProvider;
 import org.keycloak.audit.AuditProviderFactory;
 import org.keycloak.audit.EventType;
 import org.keycloak.provider.ProviderSession;
+import org.keycloak.util.JpaUtils;
 
 import javax.persistence.EntityManagerFactory;
 import javax.persistence.Persistence;
@@ -28,7 +29,7 @@ public class JpaAuditProviderFactory implements AuditProviderFactory {
 
     @Override
     public void init(Config.Scope config) {
-        emf = Persistence.createEntityManagerFactory("jpa-keycloak-audit-store");
+        emf = Persistence.createEntityManagerFactory("jpa-keycloak-audit-store", JpaUtils.getHibernateProperties());
 
         String[] include = config.getArray("include-events");
         if (include != null) {

audit/mongo/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>
@@ -13,12 +13,6 @@
     <description/>
 
     <dependencies>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <version>2.4</version>
-            <scope>provided</scope>
-        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-core</artifactId>

audit/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

audit/tests/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>keycloak-audit-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 

authentication/authentication-api/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-authentication-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java

@@ -68,12 +68,12 @@ public class AuthenticationProviderManager {
     }
 
     public AuthProviderStatus validatePassword(UserModel user, String password) {
-        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
+        AuthenticationLinkModel authLink = user.getAuthenticationLink();
         if (authLink == null) {
             // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
             AuthUser authUser = getUser(user.getLoginName());
             authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
-            realm.setAuthenticationLink(user, authLink);
+            user.setAuthenticationLink(authLink);
             logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
         }
 
@@ -98,7 +98,7 @@ public class AuthenticationProviderManager {
     }
 
     public boolean updatePassword(UserModel user, String password) throws AuthenticationProviderException {
-        AuthenticationLinkModel authLink = realm.getAuthenticationLink(user);
+        AuthenticationLinkModel authLink = user.getAuthenticationLink();
         if (authLink == null) {
             // Find provider with biggest priority where password update is supported. Then register user here and link him
             List<AuthenticationProviderModel> configuredProviders = getConfiguredProviderModels(realm);
@@ -111,7 +111,7 @@ public class AuthenticationProviderManager {
                             // Linking existing user supported just for "model" provider. In other cases throw exception
                             if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
                                 authLink = new AuthenticationLinkModel(providerModel.getProviderName(), authUser.getId());
-                                realm.setAuthenticationLink(user, authLink);
+                                user.setAuthenticationLink(authLink);
                                 logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
                             } else {
                                 throw new AuthenticationProviderException("User " + authUser.getUsername() + " exists in provider "
@@ -120,7 +120,7 @@ public class AuthenticationProviderManager {
                         } else {
                             String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user.getLoginName());
                             authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
-                            realm.setAuthenticationLink(user, authLink);
+                            user.setAuthenticationLink(authLink);
                             logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
                         }
                         break;

authentication/authentication-model/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-authentication-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java

@@ -66,7 +66,7 @@ public abstract class AbstractModelAuthenticationProvider implements Authenticat
         cred.setType(CredentialRepresentation.PASSWORD);
         cred.setValue(password);
 
-        realm.updateCredential(user, cred);
+        user.updateCredential(cred);
         return true;
     }
 

authentication/authentication-picketlink/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-authentication-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java

@@ -67,6 +67,10 @@ public class PicketlinkAuthenticationProvider implements AuthenticationProvider
         try {
             User picketlinkUser = new User(username);
             identityManager.add(picketlinkUser);
+
+            // Hack needed due to ActiveDirectory bug in Picketlink TODO: Remove once https://issues.jboss.org/browse/PLINK-485 fixed and updated in keycloak master
+            picketlinkUser = BasicModel.getUser(identityManager, picketlinkUser.getLoginName());
+
             return picketlinkUser.getId();
         } catch (IdentityManagementException ie) {
             throw convertIDMException(ie);

authentication/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core-jaxrs/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -17,7 +17,12 @@ public class RSATokenVerifier {
     }
 
     public static AccessToken verifyToken(String tokenString, PublicKey realmKey, String realm, boolean checkActive) throws VerificationException {
-        JWSInput input = new JWSInput(tokenString);
+        JWSInput input = null;
+        try {
+            input = new JWSInput(tokenString);
+        } catch (Exception e) {
+            throw new VerificationException("Couldn't parse token", e);
+        }
         if (!isPublicKeyValid(input, realmKey)) throw new VerificationException("Invalid token signature.");
 
         AccessToken token;

core/src/main/java/org/keycloak/util/JpaUtils.java

@@ -0,0 +1,22 @@
+package org.keycloak.util;
+
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class JpaUtils {
+
+    // Allows to override some properties in persistence.xml by system properties
+    public static Properties getHibernateProperties() {
+        Properties result = new Properties();
+
+        for (Object property : System.getProperties().keySet()) {
+            if (property.toString().startsWith("hibernate.")) {
+                String propValue = System.getProperty(property.toString());
+                result.put(property, propValue);
+            }
+        }
+        return result;
+    }
+}

distribution/appliance-dist/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/as7-adapter-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/eap6-adapter-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/examples-docs-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/modules/pom.xml

@@ -30,7 +30,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Distribution</name>

distribution/src-dist/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/theme-template-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/war-dist/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/war-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

distribution/wildfly-adapter-zip/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

docbook/pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>org.keycloak</groupId>
     <artifactId>keycloak-reference-guide-${translation}</artifactId>
-    <version>1.0-beta-2</version>
+    <version>1.0-beta-3</version>
     <packaging>jdocbook</packaging>
     <name>Keycloak Reference Guide (${translation})</name>
     <description/>

docbook/reference/en/en-US/master.xml

@@ -37,7 +37,7 @@
    <bookinfo>
       <title>Keycloak Reference Guide</title>
       <subtitle>SSO for Web Apps and REST Services</subtitle>
-      <releaseinfo>1.0-beta-2</releaseinfo>
+      <releaseinfo>1.0-beta-3</releaseinfo>
    </bookinfo>
 
    <toc/>

docbook/reference/en/en-US/modules/server-installation.xml

@@ -8,11 +8,11 @@
         <itemizedlist>
 
             <listitem>
-                keycloak-appliance-dist-all-1.0-beta-2.zip
+                keycloak-appliance-dist-all-1.0-beta-3.zip
             </listitem>
 
             <listitem>
-                keycloak-war-dist-all-1.0-beta-2.zip
+                keycloak-war-dist-all-1.0-beta-3.zip
             </listitem>
 
         </itemizedlist>
@@ -31,7 +31,7 @@
 
         <para>
 <programlisting>
-keycloak-appliance-dist-all-1.0-beta-2/
+keycloak-appliance-dist-all-1.0-beta-3/
     keycloak/
         bin/
             standalone.sh
@@ -42,9 +42,9 @@ keycloak-appliance-dist-all-1.0-beta-2/
                 keycloak-server.json
                 themes/
     adapters/
-        keycloak-as7-adapter-dist-1.0-beta-2.zip
-        keycloak-eap6-adapter-dist-1.0-beta-2.zip
-        keycloak-wildfly-adapter-dist-1.0-beta-2.zip
+        keycloak-as7-adapter-dist-1.0-beta-3.zip
+        keycloak-eap6-adapter-dist-1.0-beta-3.zip
+        keycloak-wildfly-adapter-dist-1.0-beta-3.zip
     examples/
     docs/
 </programlisting>
@@ -79,7 +79,7 @@ keycloak-appliance-dist-all-1.0-beta-2/
         </para>
         <para>
 <programlisting>
-keycloak-war-dist-all-1.0-beta-2/
+keycloak-war-dist-all-1.0-beta-3/
     deployments/
         auth-server.war/
         keycloak-ds.xml
@@ -87,9 +87,9 @@ keycloak-war-dist-all-1.0-beta-2/
         keycloak-server.json
         themes/
     adapters/
-        keycloak-as7-adapter-dist-1.0-beta-2.zip
-        keycloak-eap6-adapter-dist-1.0-beta-2.zip
-        keycloak-wildfly-adapter-dist-1.0-beta-2.zip
+        keycloak-as7-adapter-dist-1.0-beta-3.zip
+        keycloak-eap6-adapter-dist-1.0-beta-3.zip
+        keycloak-wildfly-adapter-dist-1.0-beta-3.zip
     examples/
     docs/
 </programlisting>
@@ -101,7 +101,7 @@ keycloak-war-dist-all-1.0-beta-2/
         </para>
         <para>
 <programlisting>
-    $ cd keycloak-war-dist-all-1.0-beta-2
+    $ cd keycloak-war-dist-all-1.0-beta-3
     $ cp -r deployments $JBOSS_HOME/standalone
 </programlisting>
         </para>
@@ -337,153 +337,157 @@ keycloak-war-dist-all-1.0-beta-2/
             <warning>
                 <para>
                     Keycloak is not set up by default to handle SSL/HTTPS in either the
-                    war distribution or appliance.  It is highly recommended that you enable it!
+                    war distribution or appliance.  It is highly recommended that you either enable SSL on the Keycloak server
+                    itself or on a reverse proxy in front of the Keycloak server.
                 </para>
             </warning>
+
             <para>
-                The following things need to be done
-                <itemizedlist>
-
-                    <listitem>
-                        Generate a self signed or third-party signed certificate and import it into a Java keystore
-                        using <literal>keytool</literal>.
-                    </listitem>
-
-                    <listitem>
-                        Enable JBoss or Wildfly to use this certificate and turn on SSL/HTTPS.
-                    </listitem>
-
-                    <listitem>
-                        Configure the Keycloak Server to enforce HTTPS connections.
-                    </listitem>
-                </itemizedlist>
+                First enable SSL on Keycloak or on a reverse proxy in front of Keycloak. Then configure the Keycloak Server to enforce HTTPS connections.
             </para>
+
             <section>
-                <title>Creating the Certificate and Java Keystore</title>
+                <title>Enable SSL on Keycloak</title>
                 <para>
-                    In order to allow HTTPS connections, you need to obtain a self signed or third-party signed certificate
-                    and import it into a Java keystore before you can enable HTTPS in the web container you are deploying
-                    the Keycloak Server to.
+                    The following things need to be done
+                    <itemizedlist>
+
+                        <listitem>
+                            Generate a self signed or third-party signed certificate and import it into a Java keystore
+                            using <literal>keytool</literal>.
+                        </listitem>
+
+                        <listitem>
+                            Enable JBoss or Wildfly to use this certificate and turn on SSL/HTTPS.
+                        </listitem>
+                    </itemizedlist>
                 </para>
                 <section>
-                    <title>Self Signed Certificate</title>
+                    <title>Creating the Certificate and Java Keystore</title>
                     <para>
-                        In development, you will probably not have a third party signed certificate available to test
-                        a Keycloak deployment so you'll need to generate a self-signed on.  Generate one is very easy
-                        to do with the <literal>keytool</literal> utility that comes with the Java jdk.
+                        In order to allow HTTPS connections, you need to obtain a self signed or third-party signed certificate
+                        and import it into a Java keystore before you can enable HTTPS in the web container you are deploying
+                        the Keycloak Server to.
+                    </para>
+                    <section>
+                        <title>Self Signed Certificate</title>
+                        <para>
+                            In development, you will probably not have a third party signed certificate available to test
+                            a Keycloak deployment so you'll need to generate a self-signed on.  Generate one is very easy
+                            to do with the <literal>keytool</literal> utility that comes with the Java jdk.
+                        </para>
+                        <para>
+    <programlisting>
+    $ keytool -genkey -alias localhost -keyalg RSA -keystore keycloak.jks -validity 10950
+        Enter keystore password: secret
+        Re-enter new password: secret
+        What is your first and last name?
+        [Unknown]:  localhost
+        What is the name of your organizational unit?
+        [Unknown]:  Keycloak
+        What is the name of your organization?
+        [Unknown]:  Red Hat
+        What is the name of your City or Locality?
+        [Unknown]:  Westford
+        What is the name of your State or Province?
+        [Unknown]:  MA
+        What is the two-letter country code for this unit?
+        [Unknown]:  US
+        Is CN=localhost, OU=Keycloak, O=Test, L=Westford, ST=MA, C=US correct?
+        [no]:  yes
+    </programlisting>
+                        </para>
+                        <para>
+                            You should answer the <literal>What is your first and last name?</literal> question with
+                            the DNS name of the machine you're installing the server on.  For testing purposes,
+                            <literal>localhost</literal> should be used.  After executing this command, the
+                            <literal>keycloak.jks</literal> file will be generated in the same directory as you executed
+                            the <literal>keytool</literal> command in.
+                        </para>
+                        <para>
+                            If you want a third-party signed certificate, but don't have one, you can obtain one for free
+                            at <ulink url="http://cacert.org">cacert.org</ulink>.  You'll have to do a little set up first
+                            before doing this though.
+                        </para>
+                        <para>
+                            The first thing to do is generate a Certificate Request:
+    <programlisting>
+    $ keytool -certreq -alias yourdomain -keystore keycloak.jks > keycloak.careq
+    </programlisting>
+                        </para>
+                        <para>
+                             Where <literal>yourdomain</literal> is a DNS name for which this certificate is generated for.
+                             Keytool generates the request:
+    <programlisting>
+    -----BEGIN NEW CERTIFICATE REQUEST-----
+    MIIC2jCCAcICAQAwZTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1BMREwDwYDVQQHEwhXZXN0Zm9y
+    ZDEQMA4GA1UEChMHUmVkIEhhdDEQMA4GA1UECxMHUmVkIEhhdDESMBAGA1UEAxMJbG9jYWxob3N0
+    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr7kck2TaavlEOGbcpi9c0rncY4HhdzmY
+    Ax2nZfq1eZEaIPqI5aTxwQZzzLDK9qbeAd8Ji79HzSqnRDxNYaZu7mAYhFKHgixsolE3o5Yfzbw1
+    29Rvy+eUVe+WZxv5oo9wolVVpdSINIMEL2LaFhtX/c1dqiqYVpfnvFshZQaIg2nL8juzZcBjj4as
+    H98gIS7khql/dkZKsw9NLvyxgJvp7PaXurX29fNf3ihG+oFrL22oFyV54BWWxXCKU/GPn61EGZGw
+    Ft2qSIGLdctpMD1aJR2bcnlhEjZKDksjQZoQ5YMXaAGkcYkG6QkgrocDE2YXDbi7GIdf9MegVJ35
+    2DQMpwIDAQABoDAwLgYJKoZIhvcNAQkOMSEwHzAdBgNVHQ4EFgQUQwlZJBA+fjiDdiVzaO9vrE/i
+    n2swDQYJKoZIhvcNAQELBQADggEBAC5FRvMkhal3q86tHPBYWBuTtmcSjs4qUm6V6f63frhveWHf
+    PzRrI1xH272XUIeBk0gtzWo0nNZnf0mMCtUBbHhhDcG82xolikfqibZijoQZCiGiedVjHJFtniDQ
+    9bMDUOXEMQ7gHZg5q6mJfNG9MbMpQaUVEEFvfGEQQxbiFK7hRWU8S23/d80e8nExgQxdJWJ6vd0X
+    MzzFK6j4Dj55bJVuM7GFmfdNC52pNOD5vYe47Aqh8oajHX9XTycVtPXl45rrWAH33ftbrS8SrZ2S
+    vqIFQeuLL3BaHwpl3t7j2lMWcK1p80laAxEASib/fAwrRHpLHBXRcq6uALUOZl4Alt8=
+    -----END NEW CERTIFICATE REQUEST-----
+     </programlisting>
+                        </para>
+                        <para>
+                            Send this ca request to your CA.  The CA will issue you a signed certificate and send it to you.
+                            Before you import your new cert, you must obtain and import the root certificate of the CA.
+                            You can download the cert from CA (ie.: root.crt) and import as follows:
+    <programlisting>
+    $ keytool -import -keystore keycloak.jks -file root.crt -alias root
+    </programlisting>
+                        </para>
+                        <para>
+                            Last step is import your new CA generated certificate to your keystore:
+    <programlisting>
+    $ keytool -import -alias yourdomain -keystore keycloak.jks -file your-certificate.cer
+    </programlisting>
+                        </para>
+                    </section>
+                </section>
+                <section>
+                    <title>Installing the keystore to WildFly</title>
+                    <para>
+                        Now that you have a Java keystore with the appropriate certificates, you need to configure your
+                        Wildfly installation to use it.  First step is to move the keystore file to a directory
+                        you can reference in configuration.  I like to put it in <literal>standalone/configuration</literal>.
+                        Then you need to edit <literal>standalone/configuration/standalone.xml</literal> to enable SSL/HTTPS.
                     </para>
                     <para>
-<programlisting>
-$ keytool -genkey -alias localhost -keyalg RSA -keystore keycloak.jks -validity 10950
-    Enter keystore password: secret
-    Re-enter new password: secret
-    What is your first and last name?
-    [Unknown]:  localhost
-    What is the name of your organizational unit?
-    [Unknown]:  Keycloak
-    What is the name of your organization?
-    [Unknown]:  Red Hat
-    What is the name of your City or Locality?
-    [Unknown]:  Westford
-    What is the name of your State or Province?
-    [Unknown]:  MA
-    What is the two-letter country code for this unit?
-    [Unknown]:  US
-    Is CN=localhost, OU=Keycloak, O=Test, L=Westford, ST=MA, C=US correct?
-    [no]:  yes
-</programlisting>
+                        To the <literal>security-realms</literal> element add:
+                        <programlisting><![CDATA[<security-realm name="UndertowRealm">
+        <server-identities>
+            <ssl>
+                <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" />
+            </ssl>
+        </server-identities>
+    </security-realm>]]></programlisting>
                     </para>
                     <para>
-                        You should answer the <literal>What is your first and last name?</literal> question with
-                        the DNS name of the machine you're installing the server on.  For testing purposes,
-                        <literal>localhost</literal> should be used.  After executing this command, the
-                        <literal>keycloak.jks</literal> file will be generated in the same directory as you executed
-                        the <literal>keytool</literal> command in.
+                        Find the element <literal>&lt;server name="default-server"&gt;</literal> (it's a child element of <literal>&lt;subsystem xmlns="urn:jboss:domain:undertow:1.0"&gt;</literal>) and add:
+                        <programlisting><![CDATA[<https-listener name="https" socket-binding="https" security-realm="UndertowRealm"/>
+    ]]></programlisting>
                     </para>
                     <para>
-                        If you want a third-party signed certificate, but don't have one, you can obtain one for free
-                        at <ulink url="http://cacert.org">cacert.org</ulink>.  You'll have to do a little set up first
-                        before doing this though.
-                    </para>
-                    <para>
-                        The first thing to do is generate a Certificate Request:
-<programlisting>
-$ keytool -certreq -alias yourdomain -keystore keycloak.jks > keycloak.careq
-</programlisting>
-                    </para>
-                    <para>
-                         Where <literal>yourdomain</literal> is a DNS name for which this certificate is generated for.
-                         Keytool generates the request:
-<programlisting>
------BEGIN NEW CERTIFICATE REQUEST-----
-MIIC2jCCAcICAQAwZTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1BMREwDwYDVQQHEwhXZXN0Zm9y
-ZDEQMA4GA1UEChMHUmVkIEhhdDEQMA4GA1UECxMHUmVkIEhhdDESMBAGA1UEAxMJbG9jYWxob3N0
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr7kck2TaavlEOGbcpi9c0rncY4HhdzmY
-Ax2nZfq1eZEaIPqI5aTxwQZzzLDK9qbeAd8Ji79HzSqnRDxNYaZu7mAYhFKHgixsolE3o5Yfzbw1
-29Rvy+eUVe+WZxv5oo9wolVVpdSINIMEL2LaFhtX/c1dqiqYVpfnvFshZQaIg2nL8juzZcBjj4as
-H98gIS7khql/dkZKsw9NLvyxgJvp7PaXurX29fNf3ihG+oFrL22oFyV54BWWxXCKU/GPn61EGZGw
-Ft2qSIGLdctpMD1aJR2bcnlhEjZKDksjQZoQ5YMXaAGkcYkG6QkgrocDE2YXDbi7GIdf9MegVJ35
-2DQMpwIDAQABoDAwLgYJKoZIhvcNAQkOMSEwHzAdBgNVHQ4EFgQUQwlZJBA+fjiDdiVzaO9vrE/i
-n2swDQYJKoZIhvcNAQELBQADggEBAC5FRvMkhal3q86tHPBYWBuTtmcSjs4qUm6V6f63frhveWHf
-PzRrI1xH272XUIeBk0gtzWo0nNZnf0mMCtUBbHhhDcG82xolikfqibZijoQZCiGiedVjHJFtniDQ
-9bMDUOXEMQ7gHZg5q6mJfNG9MbMpQaUVEEFvfGEQQxbiFK7hRWU8S23/d80e8nExgQxdJWJ6vd0X
-MzzFK6j4Dj55bJVuM7GFmfdNC52pNOD5vYe47Aqh8oajHX9XTycVtPXl45rrWAH33ftbrS8SrZ2S
-vqIFQeuLL3BaHwpl3t7j2lMWcK1p80laAxEASib/fAwrRHpLHBXRcq6uALUOZl4Alt8=
------END NEW CERTIFICATE REQUEST-----
- </programlisting>
-                    </para>
-                    <para>
-                        Send this ca request to your CA.  The CA will issue you a signed certificate and send it to you.
-                        Before you import your new cert, you must obtain and import the root certificate of the CA.
-                        You can download the cert from CA (ie.: root.crt) and import as follows:
-<programlisting>
-$ keytool -import -keystore keycloak.jks -file root.crt -alias root
-</programlisting>
-                    </para>
-                    <para>
-                        Last step is import your new CA generated certificate to your keystore:
-<programlisting>
-$ keytool -import -alias yourdomain -keystore keycloak.jks -file your-certificate.cer
-</programlisting>
+                        Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">Wildfly Undertow</ulink> documentation for more information on fine tuning the socket connections.
                     </para>
                 </section>
-            </section>
-            <section>
-                <title>Installing the keystore to WildFly</title>
-                <para>
-                    Now that you have a Java keystore with the appropriate certificates, you need to configure your
-                    Wildfly installation to use it.  First step is to move the keystore file to a directory
-                    you can reference in configuration.  I like to put it in <literal>standalone/configuration</literal>.
-                    Then you need to edit <literal>standalone/configuration/standalone.xml</literal> to enable SSL/HTTPS.
-                </para>
-                <para>
-                    To the <literal>security-realms</literal> element add:
-                    <programlisting><![CDATA[<security-realm name="UndertowRealm">
-    <server-identities>
-        <ssl>
-            <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" />
-        </ssl>
-    </server-identities>
-</security-realm>]]></programlisting>
-                </para>
-                <para>
-                    Find the element <literal>&lt;server name="default-server"&gt;</literal> (it's a child element of <literal>&lt;subsystem xmlns="urn:jboss:domain:undertow:1.0"&gt;</literal>) and add:
-                    <programlisting><![CDATA[<https-listener name="https" socket-binding="https" security-realm="UndertowRealm"/>
-]]></programlisting>
-                </para>
-                <para>
-                    Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">Wildfly Undertow</ulink> documentation for more information on fine tuning the socket connections.
-                </para>
-            </section>
-            <section>
-                <title>Installing the keystore to JBoss EAP6/AS7</title>
-                <para>
-                    Now that you have a Java keystore with the appropriate certificates, you need to configure your
-                    JBoss EAP6/AS7 installation to use it.  First step is to move the keystore file to a directory
-                    you can reference in configuration.  I like to put it in <literal>standalone/configuration</literal>.
-                    Then you need to edit <literal>standalone/configuration/standalone.xml</literal> to enable SSL/HTTPS.
-                </para>
-                <para>
+                <section>
+                    <title>Installing the keystore to JBoss EAP6/AS7</title>
+                    <para>
+                        Now that you have a Java keystore with the appropriate certificates, you need to configure your
+                        JBoss EAP6/AS7 installation to use it.  First step is to move the keystore file to a directory
+                        you can reference in configuration.  I like to put it in <literal>standalone/configuration</literal>.
+                        Then you need to edit <literal>standalone/configuration/standalone.xml</literal> to enable SSL/HTTPS.
+                    </para>
+                    <para>
 <programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"  redirect-port="443" />
    <connector name="https" scheme="https" protocol="HTTP/1.1" socket-binding="https"
@@ -493,11 +497,46 @@ $ keytool -import -alias yourdomain -keystore keycloak.jks -file your-certificat
    </connector>
         ...
 </subsystem>]]></programlisting>
+                    </para>
+                    <para>
+                        Check the <ulink url="https://docs.jboss.org/author/display/AS71/SSL+setup+guide">JBoss</ulink> documentation for more information on fine tuning the socket connections.
+                    </para>
+                </section>
+            </section>
+
+            <section>
+                <title>Enable SSL on a Reverse Proxy</title>
+                <para>
+                    Follow the documentation for your web server to enable SSL and configure reverse proxy for Keycloak.
+                    It is important that you make sure the web server sets the <literal>X-Forwarded-For</literal> and
+                    <literal>X-Forwarded-Proto</literal> headers on the requests made to Keycloak. Next you need to enable
+                    <literal>proxy-address-forwarding</literal> on the Keycloak http connector. Assuming that your reverse
+                    proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to.
+                    This is done by editing <literal>standalone/configuration/standalone.xml</literal>.
+                </para>
+                First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to the <literal>http-listener</literal>
+                element:
+                <para>
+<programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:undertow:1.1">
+    ...
+    <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
+    ...
+</subsystem>
+]]></programlisting>
+                Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
+<programlisting><![CDATA[
+<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
+    ...
+    <socket-binding name="proxy-https" port="443"/>
+    ...
+</socket-binding-group>
+]]></programlisting>
                 </para>
                 <para>
-                    Check the <ulink url="https://docs.jboss.org/author/display/AS71/SSL+setup+guide">JBoss</ulink> documentation for more information on fine tuning the socket connections.
+                    Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
                 </para>
             </section>
+
             <section>
                 <title>Enforce HTTPS For Server Connections</title>
                 <para>
@@ -519,6 +558,7 @@ $ keytool -import -alias yourdomain -keystore keycloak.jks -file your-certificat
 </web-app>]]></programlisting>
                 </para>
             </section>
+
             <section>
                 <title>Enforce HTTPS at Realm Level</title>
                 <para>

docbook/reference/en/en-US/modules/themes.xml

@@ -154,7 +154,7 @@
             </para>
             <para>
                 Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-1.0-beta-2.jar</literal>
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-1.0-beta-3.jar</literal>
                 or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
             </para>
         </section>
@@ -167,7 +167,7 @@
             </para>
             <para>
                 Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-1.0-beta-2.jar</literal>
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-1.0-beta-3.jar</literal>
                 or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
             </para>
         </section>

examples/cors/angular-product-app/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/cors/database-service/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/cors/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Examples</name>

examples/demo-template/admin-access-app/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/angular-product-app/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/customer-app-cli/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/customer-app-js/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/customer-app/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/database-service/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Examples</name>

examples/demo-template/product-app/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -23,11 +23,6 @@
     </repositories>
 
     <dependencies>
-        <dependency>
-            <groupId>org.jboss.spec.javax.servlet</groupId>
-            <artifactId>jboss-servlet-api_3.0_spec</artifactId>
-            <scope>provided</scope>
-        </dependency>
         <dependency>
             <groupId>org.jboss.spec.javax.servlet</groupId>
             <artifactId>jboss-servlet-api_3.0_spec</artifactId>

examples/demo-template/third-party-cdi/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/demo-template/third-party/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/js-console/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath> 
     </parent>
     <modelVersion>4.0.0</modelVersion>

examples/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Examples</name>

examples/providers/audit-listener-sysout/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>examples-providers-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Audit Listener System.out Example</name>

examples/providers/audit-provider-mem/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>examples-providers-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Audit Provider In-Mem Example</name>

examples/providers/authentication-properties/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>examples-providers-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Properties Authentication Provider Example</name>

examples/providers/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>examples-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Provider Examples</name>

export-import/export-import-api/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-export-import-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

export-import/export-import-impl/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-export-import-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -95,6 +95,12 @@
             <classifier>tests</classifier>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-invalidation-cache-model</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-model-jpa</artifactId>

export-import/export-import-impl/src/main/java/org/keycloak/exportimport/ExportImportPropertiesManager.java

@@ -132,7 +132,7 @@ public class ExportImportPropertiesManager {
 
     public static class NonEmptyGetterCriteria implements PropertyCriteria {
 
-        private static final List<String> IGNORED_METHODS = Arrays.asList("getPasswordPolicy", "getAuthenticationProviders");
+        private static final List<String> IGNORED_METHODS = Arrays.asList("getPasswordPolicy", "getAuthenticationProviders", "getAuthenticationLink");
 
         @Override
         public boolean methodMatches(Method m) {

export-import/export-import-impl/src/main/java/org/keycloak/exportimport/ModelExporter.java

@@ -215,7 +215,7 @@ public class ModelExporter {
                 userEntity.setRealmId(realm.getId());
 
                 // authentication links
-                AuthenticationLinkModel authLink = realm.getAuthenticationLink(userModel);
+                AuthenticationLinkModel authLink = userModel.getAuthenticationLink();
                 if (authLink != null) {
                     AuthenticationLinkEntity authLinkEntity = new AuthenticationLinkEntity();
                     this.propertiesManager.setBasicPropertiesFromModel(authLink, authLinkEntity);
@@ -247,7 +247,7 @@ public class ModelExporter {
                 userEntity.setAttributes(userModel.getAttributes());
 
                 // roleIds
-                Set<RoleModel> roles = realm.getRoleMappings(userModel);
+                Set<RoleModel> roles = userModel.getRoleMappings();
                 List<String> roleIds = new ArrayList<String>();
                 for (RoleModel role : roles) {
                     roleIds.add(role.getId());
@@ -255,7 +255,7 @@ public class ModelExporter {
                 userEntity.setRoleIds(roleIds);
 
                 // credentials
-                List<UserCredentialValueModel> credentials = realm.getCredentialsDirectly(userModel);
+                List<UserCredentialValueModel> credentials = userModel.getCredentialsDirectly();
                 List<CredentialEntity> credEntities = new ArrayList<CredentialEntity>();
                 for (UserCredentialValueModel credModel : credentials) {
                     CredentialEntity credEntity = new CredentialEntity();
@@ -298,7 +298,7 @@ public class ModelExporter {
     }
 
     private List<String> getScopeIds(ClientModel clientModel) {
-        Set<RoleModel> allScopes = clientModel.getRealm().getScopeMappings(clientModel);
+        Set<RoleModel> allScopes = clientModel.getScopeMappings();
         List<String> scopeIds = new ArrayList<String>();
         for (RoleModel role : allScopes) {
             scopeIds.add(role.getId());

export-import/export-import-impl/src/main/java/org/keycloak/exportimport/ModelImporter.java

@@ -207,7 +207,7 @@ public class ModelImporter {
     private void addScopes(RealmModel realm, ClientModel client, ClientEntity clientEntity) {
         for (String scopeId : clientEntity.getScopeIds()) {
             RoleModel scope = realm.getRoleById(scopeId);
-            realm.addScopeMapping(client, scope);
+            client.addScopeMapping(scope);
         }
     }
 
@@ -246,8 +246,8 @@ public class ModelImporter {
             UserModel user = realm.addUser(userEntity.getId(), userEntity.getLoginName());
 
             // We need to remove defaultRoles here as realm.addUser is automatically adding them. We may add them later during roles mapping processing
-            for (RoleModel role : realm.getRoleMappings(user)) {
-                realm.deleteRoleMapping(user, role);
+            for (RoleModel role : user.getRoleMappings()) {
+                user.deleteRoleMapping(role);
             }
 
             this.propertiesManager.setBasicPropertiesToModel(user, userEntity);
@@ -258,7 +258,7 @@ public class ModelImporter {
                 AuthenticationLinkModel authLinkModel = new AuthenticationLinkModel();
                 this.propertiesManager.setBasicPropertiesToModel(authLinkModel, authLinkEntity);
 
-                realm.setAuthenticationLink(user, authLinkModel);
+                user.setAuthenticationLink(authLinkModel);
             }
 
             // social links
@@ -291,7 +291,7 @@ public class ModelImporter {
             if (userEntity.getRoleIds() != null) {
                 for (String roleId : userEntity.getRoleIds()) {
                     RoleModel role = realm.getRoleById(roleId);
-                    realm.grantRole(user, role);
+                    user.grantRole(role);
                 }
             }
 
@@ -302,7 +302,7 @@ public class ModelImporter {
                     UserCredentialValueModel credModel = new UserCredentialValueModel();
                     this.propertiesManager.setBasicPropertiesToModel(credModel, credEntity);
 
-                    realm.updateCredentialDirectly(user, credModel);
+                    user.updateCredentialDirectly(credModel);
                 }
             }
         }

export-import/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

forms/account-api/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/account-freemarker/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountSocialBean.java

@@ -50,7 +50,7 @@ public class AccountSocialBean {
         }
 
         // Removing last social provider is not possible if you don't have other possibility to authenticate
-        this.removeLinkPossible = availableLinks > 1 || realm.getAuthenticationLink(user) != null;
+        this.removeLinkPossible = availableLinks > 1 || user.getAuthenticationLink() != null;
     }
 
     private SocialLinkModel getSocialLink(Set<SocialLinkModel> userSocialLinks, String socialProviderId) {

forms/common-freemarker/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/common-freemarker/src/main/java/org/keycloak/freemarker/ExtendingThemeManager.java

@@ -40,8 +40,8 @@ public class ExtendingThemeManager implements ThemeProvider {
             }
         });
 
-        this.defaultTheme = Config.scope("theme").get("default");
-        this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge");
+        this.defaultTheme = Config.scope("theme").get("default", "keycloak");
+        this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge", -1);
     }
 
     public int getStaticMaxAge() {

forms/common-themes/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/common-themes/src/main/resources/theme/admin/base/resources/index.html

@@ -21,6 +21,7 @@
     <script src="lib/jquery/jquery.idletimeout.js" type="text/javascript"></script>
     <script src="lib/angular/select2.js" type="text/javascript"></script>
     <script src="lib/fileupload/angular-file-upload.min.js"></script>
+    <script src="lib/filesaver/FileSaver.js"></script>
 
     <script src="js/keycloak.js" type="text/javascript"></script>
     <script src="js/app.js" type="text/javascript"></script>

forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js

@@ -178,21 +178,23 @@ module.controller('ApplicationInstallationCtrl', function($scope, realm, applica
     $scope.changeFormat = function() {
         if ($scope.configFormat == "keycloak.json") {
             var url = ApplicationInstallation.url({ realm: $routeParams.realm, application: $routeParams.application });
-            var installation = $http.get(url).success(function(data) {
+            $http.get(url).success(function(data) {
                 var tmp = angular.fromJson(data);
                 $scope.installation = angular.toJson(tmp, true);
+                $scope.type = 'application/json';
             })
-            $scope.download = url;
         } else if ($scope.configFormat == "Wildfly/JBoss Subsystem XML") {
             var url = ApplicationInstallationJBoss.url({ realm: $routeParams.realm, application: $routeParams.application });
-            var installation = $http.get(url).success(function(data) {
+            $http.get(url).success(function(data) {
                 $scope.installation = data;
+                $scope.type = 'text/xml';
             })
-            $scope.download = url;
         }
-
     };
 
+    $scope.download = function() {
+        saveAs(new Blob([$scope.installation], { type: $scope.type }), 'keycloak.json');
+    }
 });
 
 module.controller('ApplicationDetailCtrl', function($scope, realm, application, Application, $location, Dialog, Notifications) {

forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/realm.js

@@ -615,7 +615,7 @@ module.controller('RealmSocialCtrl', function($scope, realm, Realm, serverInfo,
 
 });
 
-module.controller('RealmTokenDetailCtrl', function($scope, Realm, realm, $http, $location, Dialog, Notifications, TimeUnit) {
+module.controller('RealmTokenDetailCtrl', function($scope, Realm, realm, $http, $location, $route, Dialog, Notifications, TimeUnit) {
     console.log('RealmTokenDetailCtrl');
 
     $scope.realm = realm;
@@ -650,7 +650,6 @@ module.controller('RealmTokenDetailCtrl', function($scope, Realm, realm, $http,
         $scope.realm.accessCodeLifespanUserAction = TimeUnit.convert($scope.realm.accessCodeLifespanUserAction, from, to);
     });
 
-
     var oldCopy = angular.copy($scope.realm);
     $scope.changed = false;
 
@@ -674,16 +673,14 @@ module.controller('RealmTokenDetailCtrl', function($scope, Realm, realm, $http,
         realmCopy.accessCodeLifespan = TimeUnit.toSeconds($scope.realm.accessCodeLifespan, $scope.realm.accessCodeLifespanUnit)
         realmCopy.accessCodeLifespanUserAction = TimeUnit.toSeconds($scope.realm.accessCodeLifespanUserAction, $scope.realm.accessCodeLifespanUserActionUnit)
 
-        $scope.changed = false;
         Realm.update(realmCopy, function () {
-            $location.url("/realms/" + realm.realm + "/token-settings");
+            $route.reload();
             Notifications.success("The changes have been saved to the realm.");
         });
     };
 
     $scope.reset = function() {
-        $scope.realm = angular.copy(oldCopy);
-        $scope.changed = false;
+        $route.reload();
     };
 });
 
@@ -902,6 +899,12 @@ module.controller('RealmSMTPSettingsCtrl', function($scope, Current, Realm, real
 module.controller('RealmLdapSettingsCtrl', function($scope, $location, Notifications, Realm, realm) {
     console.log('RealmLdapSettingsCtrl');
 
+    $scope.ldapVendors = [
+        { "id": "ad", "name": "Active Directory" },
+        { "id": "rhds", "name": "Red Hat Directory Server" },
+        { "id": "other", "name": "Other" }
+    ];
+
     $scope.realm = realm;
 
     var oldCopy = angular.copy($scope.realm);

forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js

@@ -222,7 +222,7 @@ module.factory('UserLogout', function($resource) {
     });
 });
 module.factory('UserSocialLinks', function($resource) {
-    return $resource(authUrl + '/rest/admin/realms/:realm/users/:user/social-links', {
+    return $resource(authUrl + '/admin/realms/:realm/users/:user/social-links', {
         realm : '@realm',
         user : '@user'
     });

forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-installation.html

@@ -43,7 +43,7 @@
         </form>
 
         <div class="pull-right form-actions" ng-show="installation">
-            <a class="btn btn-primary btn-lg" href="{{download}}" download="keycloak.json" type="submit">Download</a>
+            <a class="btn btn-primary btn-lg" data-ng-click="download()" type="submit">Download</a>
         </div>
     </div>
 </div>

forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-ldap.html

@@ -13,6 +13,17 @@
             
             <fieldset>
                 <legend><span class="text">Required Settings</span></legend>
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="vendor">Vendor <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <div class="select-kc">
+                            <select id="vendor"
+                                    ng-model="realm.ldapServer.vendor"
+                                    ng-options="vendor.id as vendor.name for vendor in ldapVendors">
+                            </select>
+                        </div>
+                    </div>
+                </div>
                 <div class="form-group clearfix">
                     <label class="col-sm-2 control-label" for="ldapConnectionUrl">Connection URL <span class="required">*</span></label>
                     <div class="col-sm-4">

forms/common-themes/src/main/resources/theme/common/keycloak/resources/lib/filesaver/FileSaver.js

@@ -0,0 +1,241 @@
+/* FileSaver.js
+ *  A saveAs() FileSaver implementation.
+ *  2014-05-27
+ *
+ *  By Eli Grey, http://eligrey.com
+ *  License: X11/MIT
+ *    See https://github.com/eligrey/FileSaver.js/blob/master/LICENSE.md
+ */
+
+/*global self */
+/*jslint bitwise: true, indent: 4, laxbreak: true, laxcomma: true, smarttabs: true, plusplus: true */
+
+/*! @source http://purl.eligrey.com/github/FileSaver.js/blob/master/FileSaver.js */
+
+var saveAs = saveAs
+  // IE 10+ (native saveAs)
+  || (typeof navigator !== "undefined" &&
+      navigator.msSaveOrOpenBlob && navigator.msSaveOrOpenBlob.bind(navigator))
+  // Everyone else
+  || (function(view) {
+	"use strict";
+	// IE <10 is explicitly unsupported
+	if (typeof navigator !== "undefined" &&
+	    /MSIE [1-9]\./.test(navigator.userAgent)) {
+		return;
+	}
+	var
+		  doc = view.document
+		  // only get URL when necessary in case Blob.js hasn't overridden it yet
+		, get_URL = function() {
+			return view.URL || view.webkitURL || view;
+		}
+		, save_link = doc.createElementNS("http://www.w3.org/1999/xhtml", "a")
+		, can_use_save_link = !view.externalHost && "download" in save_link
+		, click = function(node) {
+			var event = doc.createEvent("MouseEvents");
+			event.initMouseEvent(
+				"click", true, false, view, 0, 0, 0, 0, 0
+				, false, false, false, false, 0, null
+			);
+			node.dispatchEvent(event);
+		}
+		, webkit_req_fs = view.webkitRequestFileSystem
+		, req_fs = view.requestFileSystem || webkit_req_fs || view.mozRequestFileSystem
+		, throw_outside = function(ex) {
+			(view.setImmediate || view.setTimeout)(function() {
+				throw ex;
+			}, 0);
+		}
+		, force_saveable_type = "application/octet-stream"
+		, fs_min_size = 0
+		, deletion_queue = []
+		, process_deletion_queue = function() {
+			var i = deletion_queue.length;
+			while (i--) {
+				var file = deletion_queue[i];
+				if (typeof file === "string") { // file is an object URL
+					get_URL().revokeObjectURL(file);
+				} else { // file is a File
+					file.remove();
+				}
+			}
+			deletion_queue.length = 0; // clear queue
+		}
+		, dispatch = function(filesaver, event_types, event) {
+			event_types = [].concat(event_types);
+			var i = event_types.length;
+			while (i--) {
+				var listener = filesaver["on" + event_types[i]];
+				if (typeof listener === "function") {
+					try {
+						listener.call(filesaver, event || filesaver);
+					} catch (ex) {
+						throw_outside(ex);
+					}
+				}
+			}
+		}
+		, FileSaver = function(blob, name) {
+			// First try a.download, then web filesystem, then object URLs
+			var
+				  filesaver = this
+				, type = blob.type
+				, blob_changed = false
+				, object_url
+				, target_view
+				, get_object_url = function() {
+					var object_url = get_URL().createObjectURL(blob);
+					deletion_queue.push(object_url);
+					return object_url;
+				}
+				, dispatch_all = function() {
+					dispatch(filesaver, "writestart progress write writeend".split(" "));
+				}
+				// on any filesys errors revert to saving with object URLs
+				, fs_error = function() {
+					// don't create more object URLs than needed
+					if (blob_changed || !object_url) {
+						object_url = get_object_url(blob);
+					}
+					if (target_view) {
+						target_view.location.href = object_url;
+					} else {
+						window.open(object_url, "_blank");
+					}
+					filesaver.readyState = filesaver.DONE;
+					dispatch_all();
+				}
+				, abortable = function(func) {
+					return function() {
+						if (filesaver.readyState !== filesaver.DONE) {
+							return func.apply(this, arguments);
+						}
+					};
+				}
+				, create_if_not_found = {create: true, exclusive: false}
+				, slice
+			;
+			filesaver.readyState = filesaver.INIT;
+			if (!name) {
+				name = "download";
+			}
+			if (can_use_save_link) {
+				object_url = get_object_url(blob);
+				save_link.href = object_url;
+				save_link.download = name;
+				click(save_link);
+				filesaver.readyState = filesaver.DONE;
+				dispatch_all();
+				return;
+			}
+			// Object and web filesystem URLs have a problem saving in Google Chrome when
+			// viewed in a tab, so I force save with application/octet-stream
+			// http://code.google.com/p/chromium/issues/detail?id=91158
+			if (view.chrome && type && type !== force_saveable_type) {
+				slice = blob.slice || blob.webkitSlice;
+				blob = slice.call(blob, 0, blob.size, force_saveable_type);
+				blob_changed = true;
+			}
+			// Since I can't be sure that the guessed media type will trigger a download
+			// in WebKit, I append .download to the filename.
+			// https://bugs.webkit.org/show_bug.cgi?id=65440
+			if (webkit_req_fs && name !== "download") {
+				name += ".download";
+			}
+			if (type === force_saveable_type || webkit_req_fs) {
+				target_view = view;
+			}
+			if (!req_fs) {
+				fs_error();
+				return;
+			}
+			fs_min_size += blob.size;
+			req_fs(view.TEMPORARY, fs_min_size, abortable(function(fs) {
+				fs.root.getDirectory("saved", create_if_not_found, abortable(function(dir) {
+					var save = function() {
+						dir.getFile(name, create_if_not_found, abortable(function(file) {
+							file.createWriter(abortable(function(writer) {
+								writer.onwriteend = function(event) {
+									target_view.location.href = file.toURL();
+									deletion_queue.push(file);
+									filesaver.readyState = filesaver.DONE;
+									dispatch(filesaver, "writeend", event);
+								};
+								writer.onerror = function() {
+									var error = writer.error;
+									if (error.code !== error.ABORT_ERR) {
+										fs_error();
+									}
+								};
+								"writestart progress write abort".split(" ").forEach(function(event) {
+									writer["on" + event] = filesaver["on" + event];
+								});
+								writer.write(blob);
+								filesaver.abort = function() {
+									writer.abort();
+									filesaver.readyState = filesaver.DONE;
+								};
+								filesaver.readyState = filesaver.WRITING;
+							}), fs_error);
+						}), fs_error);
+					};
+					dir.getFile(name, {create: false}, abortable(function(file) {
+						// delete file if it already exists
+						file.remove();
+						save();
+					}), abortable(function(ex) {
+						if (ex.code === ex.NOT_FOUND_ERR) {
+							save();
+						} else {
+							fs_error();
+						}
+					}));
+				}), fs_error);
+			}), fs_error);
+		}
+		, FS_proto = FileSaver.prototype
+		, saveAs = function(blob, name) {
+			return new FileSaver(blob, name);
+		}
+	;
+	FS_proto.abort = function() {
+		var filesaver = this;
+		filesaver.readyState = filesaver.DONE;
+		dispatch(filesaver, "abort");
+	};
+	FS_proto.readyState = FS_proto.INIT = 0;
+	FS_proto.WRITING = 1;
+	FS_proto.DONE = 2;
+
+	FS_proto.error =
+	FS_proto.onwritestart =
+	FS_proto.onprogress =
+	FS_proto.onwrite =
+	FS_proto.onabort =
+	FS_proto.onerror =
+	FS_proto.onwriteend =
+		null;
+
+	view.addEventListener("unload", process_deletion_queue, false);
+	saveAs.unload = function() {
+		process_deletion_queue();
+		view.removeEventListener("unload", process_deletion_queue, false);
+	};
+	return saveAs;
+}(
+	   typeof self !== "undefined" && self
+	|| typeof window !== "undefined" && window
+	|| this.content
+));
+// `self` is undefined in Firefox for Android content script context
+// while `this` is nsIContentFrameMessageManager
+// with an attribute `content` that corresponds to the window
+
+if (typeof module !== "undefined" && module !== null) {
+  module.exports = saveAs;
+} else if ((typeof define !== "undefined" && define !== null) && (define.amd != null)) {
+  define([], function() {
+    return saveAs;
+  });
+}

forms/email-api/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/email-freemarker/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-forms-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

forms/login-api/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/login-freemarker/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

forms/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

integration/adapter-core/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -280,13 +280,13 @@ public class AdapterDeploymentContext {
     protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(base);
         URI request = URI.create(facade.getRequest().getURI());
-        String scheme = "http";
+        String scheme = request.getScheme();
         if (deployment.isSslRequired()) {
             scheme = "https";
-        }
-        if (!request.getScheme().equals(scheme) && request.getPort() != -1) {
-            log.error("request scheme: " + request.getScheme() + " ssl required: " + deployment.isSslRequired());
-            throw new RuntimeException("Can't resolve relative url from adapter config.");
+            if (!request.getScheme().equals(scheme) && request.getPort() != -1) {
+                log.error("request scheme: " + request.getScheme() + " ssl required: " + deployment.isSslRequired());
+                throw new RuntimeException("Can't resolve relative url from adapter config.");
+            }
         }
         builder.scheme(scheme);
         builder.host(request.getHost());

integration/as7-eap-subsystem/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

integration/as7-eap-subsystem/src/main/java/org/keycloak/subsystem/extension/KeycloakAdapterConfigDeploymentProcessor.java

@@ -70,7 +70,7 @@ public class KeycloakAdapterConfigDeploymentProcessor implements DeploymentUnitP
         if (webMetaData == null) return;
 
         LoginConfigMetaData loginConfig = webMetaData.getLoginConfig();
-        if (loginConfig != null && loginConfig.getAuthMethod().equalsIgnoreCase("KEYCLOAK")) {
+        if (loginConfig != null && "KEYCLOAK".equalsIgnoreCase(loginConfig.getAuthMethod())) {
             addValve(webMetaData);
         }
     }

integration/as7-eap6/adapter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/installed/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/jaxrs-oauth-client/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/jboss-adapter-core/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/js/pom.xml

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

integration/js/src/main/resources/keycloak.js

@@ -57,6 +57,7 @@ var Keycloak = function (config) {
             } else if (initOptions) {
                 if (initOptions.token || initOptions.refreshToken) {
                     setToken(initOptions.token, initOptions.refreshToken);
+                    initPromise.setSuccess();
                 } else if (initOptions.onLoad) {
                     var options = {};
                     switch (initOptions.onLoad) {
@@ -244,16 +245,12 @@ var Keycloak = function (config) {
         }
 
         if (loginIframe.enable) {
-            if (loginIframe.enable) {
-                var iframePromise = checkLoginIframe();
-                iframePromise.success(function() {
-                    exec();
-                }).error(function() {
-                    promise.setError();
-                })
-            } else {
-                promise.setSuccess(false);
-            }
+            var iframePromise = checkLoginIframe();
+            iframePromise.success(function() {
+                exec();
+            }).error(function() {
+                promise.setError();
+            });
         } else {
             exec();
         }
@@ -534,7 +531,11 @@ var Keycloak = function (config) {
 
         iframe.onload = function() {
             var realmUrl = getRealmUrl();
-            loginIframe.iframeOrigin = realmUrl.substring(0, realmUrl.indexOf('/', 8));
+            if (realmUrl.charAt(0) === '/') {
+                loginIframe.iframeOrigin = window.location.origin;
+            } else {
+                loginIframe.iframeOrigin = realmUrl.substring(0, realmUrl.indexOf('/', 8));
+            }
             loginIframe.iframe = iframe;
         }
 

integration/pom.xml

@@ -3,7 +3,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Integration</name>

integration/servlet-oauth-client/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/tomcat7/adapter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-beta-2</version>
+		<version>1.0-beta-3</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

integration/undertow/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>1.0-beta-2</version>
+        <version>1.0-beta-3</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakChallenge.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.security.api.AuthenticationMechanism;

integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.security.api.AuthenticationMechanism;

integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakUndertowAccount.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.security.idm.Account;

integration/undertow/src/main/java/org/keycloak/adapters/undertow/ServletKeycloakAuthMech.java

@@ -1,21 +1,34 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
-import io.undertow.security.api.AuthenticationMechanism;
 import io.undertow.security.api.SecurityContext;
 import io.undertow.server.HttpServerExchange;
 import io.undertow.servlet.api.ConfidentialPortManager;
-import io.undertow.util.AttachmentKey;
 import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.AuthChallenge;
-import org.keycloak.adapters.AuthOutcome;
 import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.RequestAuthenticator;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author Stan Silvert ssilvert@redhat.com (C) 2014 Red Hat Inc.
  * @version $Revision: 1 $
  */
-public class ServletKeycloakAuthMech implements AuthenticationMechanism {
-    public static final AttachmentKey<AuthChallenge> KEYCLOAK_CHALLENGE_ATTACHMENT_KEY = AttachmentKey.create(AuthChallenge.class);
+public class ServletKeycloakAuthMech extends UndertowKeycloakAuthMech {
 
     protected AdapterDeploymentContext deploymentContext;
     protected UndertowUserSessionManagement userSessionManagement;
@@ -34,23 +47,13 @@ public class ServletKeycloakAuthMech implements AuthenticationMechanism {
         if (!deployment.isConfigured()) {
             return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
         }
-        ServletRequestAuthenticator authenticator = createRequestAuthenticator(deployment, exchange, securityContext, facade);
-        AuthOutcome outcome = authenticator.authenticate();
-        if (outcome == AuthOutcome.AUTHENTICATED) {
-            return AuthenticationMechanismOutcome.AUTHENTICATED;
-        }
-        AuthChallenge challenge = authenticator.getChallenge();
-        if (challenge != null) {
-            exchange.putAttachment(KEYCLOAK_CHALLENGE_ATTACHMENT_KEY, challenge);
-        }
 
-        if (outcome == AuthOutcome.FAILED) {
-            return AuthenticationMechanismOutcome.NOT_AUTHENTICATED;
-        }
-        return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
+        RequestAuthenticator authenticator = createRequestAuthenticator(deployment, exchange, securityContext, facade);
+
+        return super.keycloakAuthenticate(exchange, authenticator);
     }
 
-    protected ServletRequestAuthenticator createRequestAuthenticator(KeycloakDeployment deployment, HttpServerExchange exchange, SecurityContext securityContext, UndertowHttpFacade facade) {
+    protected RequestAuthenticator createRequestAuthenticator(KeycloakDeployment deployment, HttpServerExchange exchange, SecurityContext securityContext, UndertowHttpFacade facade) {
 
         int confidentialPort = getConfidentilPort(exchange);
         return new ServletRequestAuthenticator(facade, deployment,
@@ -67,15 +70,4 @@ public class ServletKeycloakAuthMech implements AuthenticationMechanism {
         return confidentialPort;
     }
 
-    @Override
-    public ChallengeResult sendChallenge(HttpServerExchange exchange, SecurityContext securityContext) {
-        AuthChallenge challenge = exchange.getAttachment(KEYCLOAK_CHALLENGE_ATTACHMENT_KEY);
-        if (challenge != null) {
-            UndertowHttpFacade facade = new UndertowHttpFacade(exchange);
-            if (challenge.challenge(facade)) {
-                return new ChallengeResult(true, exchange.getResponseCode());
-            }
-        }
-        return new ChallengeResult(false);
-    }
 }

integration/undertow/src/main/java/org/keycloak/adapters/undertow/ServletPreAuthActionsHandler.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.server.HandlerWrapper;

integration/undertow/src/main/java/org/keycloak/adapters/undertow/ServletRequestAuthenticator.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.security.api.SecurityContext;
@@ -10,20 +26,21 @@ import org.keycloak.adapters.KeycloakDeployment;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
+import org.keycloak.KeycloakPrincipal;
+import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author Stan Silvert ssilvert@redhat.com (C) 2014 Red Hat Inc.
  * @version $Revision: 1 $
  */
 public class ServletRequestAuthenticator extends UndertowRequestAuthenticator {
 
-    protected UndertowUserSessionManagement userSessionManagement;
 
     public ServletRequestAuthenticator(HttpFacade facade, KeycloakDeployment deployment, int sslRedirectPort,
                                        SecurityContext securityContext, HttpServerExchange exchange,
                                        UndertowUserSessionManagement userSessionManagement) {
-        super(facade, deployment, sslRedirectPort, securityContext, exchange);
-        this.userSessionManagement = userSessionManagement;
+        super(facade, deployment, sslRedirectPort, securityContext, exchange, userSessionManagement);
     }
 
     @Override
@@ -69,4 +86,9 @@ public class ServletRequestAuthenticator extends UndertowRequestAuthenticator {
         userSessionManagement.login(servletRequestContext.getDeployment().getSessionManager(), session.getId(), account.getPrincipal().getName(), account.getKeycloakSecurityContext().getToken().getSessionState());
 
     }
+
+    @Override
+    protected KeycloakUndertowAccount createAccount(KeycloakPrincipal principal, RefreshableKeycloakSecurityContext session) {
+        return new KeycloakUndertowAccount(principal, session, deployment);
+    }
 }

integration/undertow/src/main/java/org/keycloak/adapters/undertow/SessionManagementBridge.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.server.session.SessionManager;

integration/undertow/src/main/java/org/keycloak/adapters/undertow/UndertowAuthenticatedActionsHandler.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.server.HandlerWrapper;
@@ -12,6 +28,7 @@ import org.keycloak.adapters.KeycloakDeployment;
  * Bridge for authenticated Keycloak adapter actions
  *
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author Stan Silvert ssilvert@redhat.com (C) 2014 Red Hat Inc.
  * @version $Revision: 1 $
  */
 public class UndertowAuthenticatedActionsHandler implements HttpHandler {
@@ -33,7 +50,7 @@ public class UndertowAuthenticatedActionsHandler implements HttpHandler {
     }
 
 
-    protected UndertowAuthenticatedActionsHandler(AdapterDeploymentContext deploymentContext, HttpHandler next) {
+    public UndertowAuthenticatedActionsHandler(AdapterDeploymentContext deploymentContext, HttpHandler next) {
         this.deploymentContext = deploymentContext;
         this.next = next;
     }

integration/undertow/src/main/java/org/keycloak/adapters/undertow/UndertowHttpFacade.java

@@ -1,3 +1,19 @@
+/*
+ * Copyright 2014 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
 package org.keycloak.adapters.undertow;
 
 import io.undertow.server.HttpServerExchange;