Merge pull request #885 from patriot1burke/master

bump version

.gitignore

@@ -9,6 +9,12 @@
 .settings
 .classpath
 
+# NetBeans #
+############
+nbactions.xml
+nb-configuration.xml
+catalog.xml
+
 # Compiled source #
 ###################
 *.com

README.md

@@ -1,4 +1,36 @@
 keycloak
 ========
 
-SSO Service for web apps and REST services.
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.  
+
+Keycloak is an SSO Service for web apps and REST services.
+It can be used for social applications as well as enterprise applications.  It is based on OpenID Connect with support for SAML 2.0 as well.
+Here's some of the features:
+
+* SSO and Single Log Out for browser applications
+* Social Broker.  Enable Google, Facebook, Yahoo, Twitter social login with no code required.
+* Optional LDAP/Active Directory integration
+* Optional User Registration
+* Password and TOTP support (via Google Authenticator or FreeOTP).  Client cert auth coming soon.
+* User session management from both admin and user perspective
+* Customizable themes for user facing pages: login, grant pages, account management, emails, and admin console all customizable!
+* OAuth Bearer token auth for REST Services
+* Integrated Browser App to REST Service token propagation
+* Admin REST API
+* OAuth 2.0 Grant requests
+* CORS Support
+* CORS Web Origin management and validation
+* Completely centrally managed user and role mapping metadata.  Minimal configuration at the application side
+* Admin Console for managing users, roles, role mappings, applications, user sessions, allowed CORS web origins, and OAuth clients.
+* Deployable as a WAR, appliance, or an Openshift  cloud service (SaaS).
+* Supports JBoss AS7, EAP 6.x, Wildfly, Tomcat, and Jetty applications.   Plans to support Node.js, RAILS, GRAILS, and other non-Java applications.
+* Javascript/HTML 5 adapter for pure Javascript apps
+* Session management from admin console
+* Revocation policies
+* Password policies
+* OpenID Connect Support
+* SAML Support
+
+Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
+and video tutorials.

audit/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -1,2 +0,0 @@
-org.keycloak.audit.AuditProviderSpi
-org.keycloak.audit.AuditListenerSpi

audit/email/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -1 +0,0 @@
-org.keycloak.audit.email.EmailAuditListenerFactory

audit/jboss-logging/src/main/resources/META-INF/services/org.keycloak.audit.AuditListenerFactory

@@ -1 +0,0 @@
-org.keycloak.audit.log.JBossLoggingAuditListenerFactory

audit/jpa/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -1 +0,0 @@
-org.keycloak.audit.jpa.JpaAuditProviderFactory

audit/jpa/src/test/java/org/keycloak/audit/jpa/JpaAuditProviderTest.java

@@ -1,15 +0,0 @@
-package org.keycloak.audit.jpa;
-
-import org.keycloak.audit.tests.AbstractAuditProviderTest;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class JpaAuditProviderTest extends AbstractAuditProviderTest {
-
-    @Override
-    protected String getProviderId() {
-        return JpaAuditProviderFactory.ID;
-    }
-
-}

audit/jpa/src/test/resources/META-INF/persistence.xml

@@ -1,22 +0,0 @@
-<persistence xmlns="http://java.sun.com/xml/ns/persistence"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
-    version="1.0">
-    <persistence-unit name="jpa-keycloak-audit-store" transaction-type="RESOURCE_LOCAL">
-        <provider>org.hibernate.ejb.HibernatePersistence</provider>
-
-        <class>org.keycloak.audit.jpa.EventEntity</class>
-
-        <exclude-unlisted-classes>true</exclude-unlisted-classes>
-
-        <properties>
-            <property name="hibernate.connection.url" value="jdbc:h2:mem:test"/>
-            <property name="hibernate.connection.driver_class" value="org.h2.Driver"/>
-            <property name="hibernate.connection.username" value="sa"/>
-            <property name="hibernate.connection.password" value=""/>
-            <property name="hibernate.hbm2ddl.auto" value="create-drop" />
-            <property name="hibernate.show_sql" value="false" />
-            <property name="hibernate.format_sql" value="true" />
-        </properties>
-    </persistence-unit>
-</persistence>

audit/mongo/pom.xml

@@ -1,130 +0,0 @@
-<?xml version="1.0"?>
-<project>
-    <parent>
-        <artifactId>keycloak-audit-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>1.0-beta-3-SNAPSHOT</version>
-    </parent>
-
-    <modelVersion>4.0.0</modelVersion>
-
-    <artifactId>keycloak-audit-mongo</artifactId>
-    <name>Keycloak Audit Mongo Provider</name>
-    <description/>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-core</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-api</artifactId>
-            <version>${project.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-tests</artifactId>
-            <version>${project.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.logging</groupId>
-            <artifactId>jboss-logging</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.mongodb</groupId>
-            <artifactId>mongo-java-driver</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
-   </dependencies>
-
-    <properties>
-        <keycloak.audit.mongo.host>localhost</keycloak.audit.mongo.host>
-        <keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
-        <keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
-        <keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
-        <keycloak.audit.mongo.bindIp>127.0.0.1</keycloak.audit.mongo.bindIp>
-    </properties>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
-                </configuration>
-            </plugin>
-
-            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>test</id>
-                        <phase>integration-test</phase>
-                        <goals>
-                            <goal>test</goal>
-                        </goals>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <keycloak.audit.mongo.host>${keycloak.audit.mongo.host}</keycloak.audit.mongo.host>
-                                <keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
-                                <keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
-                                <keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
-                                <keycloak.audit.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.audit.mongo.bindIp>
-                            </systemPropertyVariables>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>default-test</id>
-                        <configuration>
-                            <skip>true</skip>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
-            <!-- Embedded mongo -->
-            <plugin>
-                <groupId>com.github.joelittlejohn.embedmongo</groupId>
-                <artifactId>embedmongo-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>start-mongodb</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>start</goal>
-                        </goals>
-                        <configuration>
-                            <port>${keycloak.audit.mongo.port}</port>
-                            <logging>file</logging>
-                            <logFile>${project.build.directory}/mongodb.log</logFile>
-                            <bindIp>${keycloak.audit.mongo.bindIp}</bindIp>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>stop-mongodb</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>stop</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-        </plugins>
-    </build>
-</project>

audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java

@@ -1,96 +0,0 @@
-package org.keycloak.audit.mongo;
-
-import com.mongodb.DB;
-import com.mongodb.MongoClient;
-import com.mongodb.MongoCredential;
-import com.mongodb.ServerAddress;
-import com.mongodb.WriteConcern;
-import org.jboss.logging.Logger;
-import org.keycloak.Config;
-import org.keycloak.audit.AuditProvider;
-import org.keycloak.audit.AuditProviderFactory;
-import org.keycloak.audit.EventType;
-import org.keycloak.provider.ProviderSession;
-
-import java.net.UnknownHostException;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class MongoAuditProviderFactory implements AuditProviderFactory {
-
-    protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
-
-    public static final String ID = "mongo";
-    private MongoClient client;
-    private DB db;
-
-    private Set<EventType> includedEvents = new HashSet<EventType>();
-
-    @Override
-    public AuditProvider create(ProviderSession providerSession) {
-        return new MongoAuditProvider(db.getCollection("audit"), includedEvents);
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-        try {
-            String host = config.get("host", ServerAddress.defaultHost());
-            int port = config.getInt("port", ServerAddress.defaultPort());
-            String dbName = config.get("db", "keycloak-audit");
-            boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
-
-            String user = config.get("user");
-            String password = config.get("password");
-            if (user != null && password != null) {
-                MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
-                client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
-            } else {
-                client = new MongoClient(host, port);
-            }
-
-            client.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
-            db = client.getDB(dbName);
-
-            if (clearOnStartup) {
-                db.getCollection("audit").drop();
-            }
-
-            logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
-        } catch (UnknownHostException e) {
-            throw new RuntimeException(e);
-        }
-
-        String[] include = config.getArray("include-events");
-        if (include != null) {
-            for (String i : include) {
-                includedEvents.add(EventType.valueOf(i.toUpperCase()));
-            }
-        } else {
-            for (EventType i : EventType.values()) {
-                includedEvents.add(i);
-            }
-        }
-
-        String[] exclude = config.getArray("exclude-events");
-        if (exclude != null) {
-            for (String e : exclude) {
-                includedEvents.remove(EventType.valueOf(e.toUpperCase()));
-            }
-        }
-    }
-
-    @Override
-    public void close() {
-        client.close();
-    }
-
-    @Override
-    public String getId() {
-        return ID;
-    }
-
-}

audit/mongo/src/main/resources/META-INF/services/org.keycloak.audit.AuditProviderFactory

@@ -1 +0,0 @@
-org.keycloak.audit.mongo.MongoAuditProviderFactory

audit/mongo/src/test/java/org/keycloak/audit/mongo/MongoAuditProviderTest.java

@@ -1,15 +0,0 @@
-package org.keycloak.audit.mongo;
-
-import org.keycloak.audit.tests.AbstractAuditProviderTest;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class MongoAuditProviderTest extends AbstractAuditProviderTest {
-
-    @Override
-    protected String getProviderId() {
-        return MongoAuditProviderFactory.ID;
-    }
-
-}

audit/tests/src/main/java/org/keycloak/audit/tests/AbstractAuditProviderTest.java

@@ -1,139 +0,0 @@
-package org.keycloak.audit.tests;
-
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.Config;
-import org.keycloak.audit.AuditProvider;
-import org.keycloak.audit.AuditProviderFactory;
-import org.keycloak.audit.Event;
-import org.keycloak.audit.EventType;
-import org.keycloak.provider.ProviderFactory;
-
-import java.util.HashMap;
-import java.util.Map;
-import java.util.ServiceLoader;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public abstract class AbstractAuditProviderTest {
-
-    private ProviderFactory<AuditProvider> factory;
-    private AuditProvider provider;
-
-    @Before
-    public void before() {
-        String providerId = getProviderId();
-        ServiceLoader<AuditProviderFactory> factories = ServiceLoader.load(AuditProviderFactory.class);
-        for (AuditProviderFactory f : factories) {
-            if (f.getId().equals(providerId)) {
-                factory = f;
-                factory.init(Config.scope("audit", providerId));
-            }
-        }
-
-        provider = factory.create(null);
-    }
-
-    protected abstract String getProviderId();
-
-    @After
-    public void after() {
-        provider.clear();
-        provider.close();
-        factory.close();
-    }
-
-    @Test
-    public void save() {
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-    }
-
-    @Test
-    public void query() {
-        long oldest = System.currentTimeMillis() - 30000;
-        long newest = System.currentTimeMillis() + 30000;
-
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(newest, EventType.REGISTER, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
-        provider.onEvent(create(EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(oldest, EventType.LOGIN, "realmId", "clientId2", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(EventType.LOGIN, "realmId", "clientId", "userId2", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        Assert.assertEquals(5, provider.createQuery().client("clientId").getResultList().size());
-        Assert.assertEquals(5, provider.createQuery().realm("realmId").getResultList().size());
-        Assert.assertEquals(4, provider.createQuery().event(EventType.LOGIN).getResultList().size());
-        Assert.assertEquals(6, provider.createQuery().event(EventType.LOGIN, EventType.REGISTER).getResultList().size());
-        Assert.assertEquals(4, provider.createQuery().user("userId").getResultList().size());
-
-        Assert.assertEquals(1, provider.createQuery().user("userId").event(EventType.REGISTER).getResultList().size());
-
-        Assert.assertEquals(2, provider.createQuery().maxResults(2).getResultList().size());
-        Assert.assertEquals(1, provider.createQuery().firstResult(5).getResultList().size());
-
-        Assert.assertEquals(newest, provider.createQuery().maxResults(1).getResultList().get(0).getTime());
-        Assert.assertEquals(oldest, provider.createQuery().firstResult(5).maxResults(1).getResultList().get(0).getTime());
-    }
-
-    @Test
-    public void clear() {
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        provider.clear("realmId");
-
-        Assert.assertEquals(1, provider.createQuery().getResultList().size());
-    }
-
-    @Test
-    public void clearOld() {
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 20000, EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis(), EventType.LOGIN, "realmId", "clientId", "userId", "127.0.0.1", "error"));
-        provider.onEvent(create(System.currentTimeMillis() - 30000, EventType.LOGIN, "realmId2", "clientId", "userId", "127.0.0.1", "error"));
-
-        provider.close();
-        provider = factory.create(null);
-
-        provider.clear("realmId", System.currentTimeMillis() - 10000);
-
-        Assert.assertEquals(3, provider.createQuery().getResultList().size());
-    }
-
-    private Event create(EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
-        return create(System.currentTimeMillis(), event, realmId, clientId, userId, ipAddress, error);
-    }
-
-    private Event create(long time, EventType event, String realmId, String clientId, String userId, String ipAddress, String error) {
-        Event e = new Event();
-        e.setTime(time);
-        e.setEvent(event);
-        e.setRealmId(realmId);
-        e.setClientId(clientId);
-        e.setUserId(userId);
-        e.setIpAddress(ipAddress);
-        e.setError(error);
-
-        Map<String, String> details = new HashMap<String, String>();
-        details.put("key1", "value1");
-        details.put("key2", "value2");
-
-        e.setDetails(details);
-
-        return e;
-    }
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderConstants.java

@@ -1,15 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthProviderConstants {
-
-    // Model is default provider. See AuthenticationProviderModel.DEFAULT_PROVIDER
-    public static final String PROVIDER_NAME_MODEL = "model";
-    public static final String PROVIDER_NAME_EXTERNAL_MODEL = "externalModel";
-    public static final String PROVIDER_NAME_PICKETLINK = "picketlink";
-
-    // Used in external-model provider
-    public static final String EXTERNAL_REALM_ID = "externalRealmId";
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthProviderStatus.java

@@ -1,12 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * Result of authentication by AuthenticationProvider
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public enum AuthProviderStatus {
-
-    SUCCESS, INVALID_CREDENTIALS, FAILED
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthUser.java

@@ -1,83 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthUser {
-
-    private String id;
-    private String username;
-    private String firstName;
-    private String lastName;
-    private String email;
-
-    private String providerName;
-
-    public AuthUser(String id, String username, String providerName) {
-        this.id = id;
-        this.username = username;
-        this.providerName = providerName;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public AuthUser setId(String id) {
-        this.id = id;
-        return this;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public AuthUser setUsername(String username) {
-        this.username = username;
-        return this;
-    }
-
-    public String getFirstName() {
-        return firstName;
-    }
-
-    public AuthUser setName(String name) {
-        int i = name.lastIndexOf(' ');
-        if (i != -1) {
-            firstName  = name.substring(0, i);
-            lastName = name.substring(i + 1);
-        } else {
-            firstName = name;
-        }
-
-        return this;
-    }
-
-    public AuthUser setName(String firstName, String lastName) {
-        this.firstName = firstName;
-        this.lastName = lastName;
-        return this;
-    }
-
-    public String getLastName() {
-        return lastName;
-    }
-
-    public String getEmail() {
-        return email;
-    }
-
-    public AuthUser setEmail(String email) {
-        this.email = email;
-        return this;
-    }
-
-    public String getProviderName() {
-        return providerName;
-    }
-
-    public AuthUser setProviderName(String providerName) {
-        this.providerName = providerName;
-        return this;
-    }
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProvider.java

@@ -1,68 +0,0 @@
-package org.keycloak.authentication;
-
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.models.RealmModel;
-import org.keycloak.provider.Provider;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface AuthenticationProvider extends Provider {
-
-    String getName();
-
-    /**
-     * Get names of all available configuration options of current provider
-     *
-     * @return options or empty list if no options available
-     */
-    List<String> getAvailableOptions();
-
-    /**
-     * Get user by given username or email. Return user instance or null if user doesn't exists in this authentication provider
-     *
-     * @param realm
-     * @param configuration
-     * @param username or email
-     * @return found user or null if user with given username doesn't exists
-     * @throws AuthenticationProviderException
-     */
-    AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
-
-    /**
-     * Try to register user with this authentication provider
-     *
-     * @param realm
-     * @param configuration
-     * @param username
-     * @return ID of newly created user (For example ID from LDAP)
-     * @throws AuthenticationProviderException if user creation couldn't happen
-     */
-    String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException;
-
-    /**
-     * Standard Authentication flow
-     *
-     * @param username
-     * @param password
-     * @return result of authentication, which might eventually encapsulate info about authenticated user and provider which successfully authenticated
-     */
-    AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
-
-
-    /**
-     * Update credential
-     *
-     * @param realm
-     * @param configuration
-     * @param username
-     * @param password
-     * @return true if credential has been successfully updated
-     * @throws AuthenticationProviderException
-     */
-    boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException;
-
-
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderException.java

@@ -1,24 +0,0 @@
-package org.keycloak.authentication;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationProviderException extends Exception {
-
-    private static final long serialVersionUID = 15L;
-
-    protected AuthenticationProviderException() {
-    }
-
-    public AuthenticationProviderException(String message) {
-        super(message);
-    }
-
-    public AuthenticationProviderException(Throwable cause) {
-        super(cause);
-    }
-
-    public AuthenticationProviderException(String message, Throwable cause) {
-        super(message, cause);
-    }
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderFactory.java

@@ -1,9 +0,0 @@
-package org.keycloak.authentication;
-
-import org.keycloak.provider.ProviderFactory;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface AuthenticationProviderFactory extends ProviderFactory<AuthenticationProvider> {
-}

authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java

@@ -1,219 +0,0 @@
-package org.keycloak.authentication;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.jboss.logging.Logger;
-import org.keycloak.models.AuthenticationLinkModel;
-import org.keycloak.models.AuthenticationProviderModel;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.provider.ProviderSession;
-import org.keycloak.util.ProviderLoader;
-
-/**
- * Access point to authentication SPI. It finds configured and available {@link AuthenticationProvider} instances for current realm
- * and then delegates method call to them.
- *
- * Example of usage: AuthenticationProviderManager.getManager(realm).validateUser("joe", "password");
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AuthenticationProviderManager {
-
-    private static final Logger logger = Logger.getLogger(AuthenticationProviderManager.class);
-
-    private final RealmModel realm;
-    private final Map<String, AuthenticationProvider> delegates;
-
-    public static AuthenticationProviderManager getManager(RealmModel realm, ProviderSession providerSession) {
-        Iterable<AuthenticationProvider> providers = providerSession.getAllProviders(AuthenticationProvider.class);
-
-        Map<String, AuthenticationProvider> providersMap = new HashMap<String, AuthenticationProvider>();
-        for (AuthenticationProvider provider : providers) {
-            providersMap.put(provider.getName(), provider);
-        }
-
-        return new AuthenticationProviderManager(realm, providersMap);
-    }
-
-    public AuthenticationProviderManager(RealmModel realm, Map<String, AuthenticationProvider> delegates) {
-        this.realm = realm;
-        this.delegates = delegates;
-    }
-
-    public AuthUser getUser(String username) {
-        List<AuthenticationProviderModel> authProviderModels = getConfiguredProviderModels(realm);
-        for (AuthenticationProviderModel providerModel : authProviderModels) {
-            AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
-            if (delegate == null) {
-                continue;
-            }
-
-            try {
-                AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), username);
-                if (authUser != null) {
-                    logger.debugf("User '%s' found with provider '%s'", username, providerModel.getProviderName());
-                    return authUser;
-                }
-            } catch (AuthenticationProviderException ape) {
-                logger.warn(ape.getMessage(), ape);
-            }
-        }
-
-        logger.debugf("User '%s' not found with any provider", username);
-        return null;
-    }
-
-    public AuthProviderStatus validatePassword(UserModel user, String password) {
-        AuthenticationLinkModel authLink = user.getAuthenticationLink();
-        if (authLink == null) {
-            // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
-            AuthUser authUser = getUser(user.getLoginName());
-            authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
-            user.setAuthenticationLink(authLink);
-            logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
-        }
-
-        String providerName = authLink.getAuthProvider();
-
-        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
-        AuthenticationProvider delegate = getProvider(providerName);
-        if (delegate == null || providerModel == null) {
-            return AuthProviderStatus.FAILED;
-        }
-
-        try {
-            checkCorrectAuthLink(delegate, providerModel, authLink, user.getLoginName());
-
-            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getLoginName(), password);
-            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getLoginName());
-            return currentResult;
-        } catch (AuthenticationProviderException ape) {
-            logger.warn(ape.getMessage(), ape);
-            return AuthProviderStatus.FAILED;
-        }
-    }
-
-    public boolean updatePassword(UserModel user, String password) throws AuthenticationProviderException {
-        AuthenticationLinkModel authLink = user.getAuthenticationLink();
-        if (authLink == null) {
-            // Find provider with biggest priority where password update is supported. Then register user here and link him
-            List<AuthenticationProviderModel> configuredProviders = getConfiguredProviderModels(realm);
-            for (AuthenticationProviderModel providerModel : configuredProviders) {
-                if (providerModel.isPasswordUpdateSupported()) {
-                    AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
-                    if (delegate != null) {
-                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getLoginName());
-                        if (authUser != null) {
-                            // Linking existing user supported just for "model" provider. In other cases throw exception
-                            if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
-                                authLink = new AuthenticationLinkModel(providerModel.getProviderName(), authUser.getId());
-                                user.setAuthenticationLink(authLink);
-                                logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
-                            } else {
-                                throw new AuthenticationProviderException("User " + authUser.getUsername() + " exists in provider "
-                                        + authUser.getProviderName() + " but is not linked with model user");
-                            }
-                        } else {
-                            String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user.getLoginName());
-                            authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
-                            user.setAuthenticationLink(authLink);
-                            logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
-                        }
-                        break;
-                    }
-                }
-            }
-
-            if (authLink == null) {
-                logger.warnf("No providers found where password update is supported for user '%s'", user.getLoginName());
-                return false;
-            }
-        }
-
-        String providerName = authLink.getAuthProvider();
-
-        AuthenticationProviderModel providerModel = getConfiguredProviderModel(realm, providerName);
-        if (providerModel == null) {
-            return false;
-        }
-
-        String username = user.getLoginName();
-
-        // Update just those, which support password update
-        if (providerModel.isPasswordUpdateSupported()) {
-            try {
-                AuthenticationProvider delegate = getProvider(providerName);
-                if (delegate == null) {
-                    return false;
-                }
-
-                checkCorrectAuthLink(delegate, providerModel, authLink, username);
-
-                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getLoginName(), password)) {
-                    logger.debugf("Updated password in authentication provider '%s' for user '%s'", providerName, username);
-                    return true;
-                } else {
-                    logger.warnf("Password not updated in authentication provider '%s' for user '%s'", providerName, username);
-                    return false;
-                }
-            } catch (AuthenticationProviderException ape) {
-                // Rethrow it to upper layer
-                logger.warn("Failed to update password: " + ape.getMessage());
-                throw ape;
-            }
-        } else {
-            logger.warnf("Skip password update for authentication provider '%s' for user '%s'", providerName, username);
-            return false;
-        }
-    }
-
-    private AuthenticationProvider getProvider(String providerName) {
-        AuthenticationProvider delegate = delegates.get(providerName);
-        if (delegate == null) {
-            logger.warnf("Provider '%s' not available on classpath", providerName);
-        }
-        return delegate;
-    }
-
-    private static List<AuthenticationProviderModel> getConfiguredProviderModels(RealmModel realm) {
-        List<AuthenticationProviderModel> configuredProviders = realm.getAuthenticationProviders();
-
-        // Use model based authentication of current realm by default
-        if (configuredProviders == null || configuredProviders.isEmpty()) {
-            configuredProviders = Collections.EMPTY_LIST;
-            logger.warnf("No authentication providers found");
-        }
-
-        return configuredProviders;
-    }
-
-    public static AuthenticationProviderModel getConfiguredProviderModel(RealmModel realm, String providerName) {
-        List<AuthenticationProviderModel> providers = getConfiguredProviderModels(realm);
-        for (AuthenticationProviderModel provider : providers) {
-            if (providerName.equals(provider.getProviderName())) {
-                return provider;
-            }
-        }
-
-        logger.warnf("Provider '%s' not configured in realm", providerName);
-        return null;
-    }
-
-    // Check if ID of linked AuthUser is same as expected ID from authenticationLink . It should catch the case when for example user "john" was deleted in LDAP
-    // and then user "john" has been created again, but it's actually different user with different ID
-    private void checkCorrectAuthLink(AuthenticationProvider authProvider, AuthenticationProviderModel providerModel,
-                                      AuthenticationLinkModel authLinkModel, String username) throws AuthenticationProviderException {
-        AuthUser authUser = authProvider.getUser(realm, providerModel.getConfig(), username);
-        if (authUser == null) {
-            throw new AuthenticationProviderException("User " + username + " not found in authentication provider " + providerModel.getProviderName());
-        }
-        String userExternalId = authUser.getId();
-        if (!userExternalId.equals(authLinkModel.getAuthUserId())) {
-            throw new AuthenticationProviderException("ID did not match! ID from provider: " + userExternalId + ", ID from authentication link: " + authLinkModel.getAuthUserId());
-        }
-    }
-}

authentication/authentication-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -1 +0,0 @@
-org.keycloak.authentication.AuthenticationSpi

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java

@@ -1,84 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Map;
-
-import org.jboss.logging.Logger;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.representations.idm.CredentialRepresentation;
-import org.keycloak.authentication.AuthProviderStatus;
-import org.keycloak.authentication.AuthUser;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderException;
-
-/**
- * Authentication provider, which delegates calling of all methods to specified realm
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public abstract class AbstractModelAuthenticationProvider implements AuthenticationProvider {
-
-    private static final Logger logger = Logger.getLogger(AbstractModelAuthenticationProvider.class);
-
-    @Override
-    public AuthUser getUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
-        return user == null ? null : createAuthenticatedUserInstance(user);
-    }
-
-    @Override
-    public String registerUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = currentRealm.addUser(username);
-        user.setEnabled(true);
-        return user.getId();
-    }
-
-    @Override
-    public AuthProviderStatus validatePassword(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
-
-        boolean result = realm.validatePassword(user, password);
-        return result ? AuthProviderStatus.SUCCESS : AuthProviderStatus.INVALID_CREDENTIALS;
-    }
-
-    @Override
-    public boolean updateCredential(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
-        RealmModel realm = getRealm(currentRealm, config);
-
-        // Validate password policy
-        String error = realm.getPasswordPolicy().validate(password);
-        if (error != null) {
-            throw new AuthenticationProviderException(error);
-        }
-
-        UserModel user = realm.getUser(username);
-        if (user == null) {
-            logger.warnf("User '%s' doesn't exists. Skip password update", username);
-            return false;
-        }
-
-        UserCredentialModel cred = new UserCredentialModel();
-        cred.setType(CredentialRepresentation.PASSWORD);
-        cred.setValue(password);
-
-        user.updateCredential(cred);
-        return true;
-    }
-
-    @Override
-    public void close() {
-    }
-
-    protected abstract RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) throws AuthenticationProviderException;
-
-    protected AuthUser createAuthenticatedUserInstance(UserModel user) {
-        return new AuthUser(user.getId(), user.getLoginName(), getName())
-                .setName(user.getFirstName(), user.getLastName())
-                .setEmail(user.getEmail());
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java

@@ -1,53 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import org.jboss.resteasy.spi.ResteasyProviderFactory;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.RealmModel;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProviderException;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * AbstractModelAuthenticationProvider, which delegates authentication operations to different (external) realm
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ExternalModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
-
-    public ExternalModelAuthenticationProvider(ProviderSession providerSession) {
-    }
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Arrays.asList(AuthProviderConstants.EXTERNAL_REALM_ID);
-    }
-
-    @Override
-    public RealmModel getRealm(RealmModel currentRealm, Map<String, String> configuration) throws AuthenticationProviderException {
-        String realmId = configuration.get(AuthProviderConstants.EXTERNAL_REALM_ID);
-        if (realmId == null) {
-            throw new AuthenticationProviderException("Option '" + AuthProviderConstants.EXTERNAL_REALM_ID + "' not specified in configuration");
-        }
-
-        // TODO: This won't be needed when KeycloakSession is available from ProviderSession
-        KeycloakSession session = ResteasyProviderFactory.getContextData(KeycloakSession.class);
-        if (session == null) {
-            throw new AuthenticationProviderException("KeycloakSession not available");
-        }
-
-        RealmModel realm = session.getRealm(realmId);
-        if (realm == null) {
-            throw new AuthenticationProviderException("Realm with id '" + realmId + "' doesn't exists");
-        }
-        return realm;
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java

@@ -1,32 +0,0 @@
-package org.keycloak.authentication.model;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ExternalModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new ExternalModelAuthenticationProvider(providerSession);
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_EXTERNAL_MODEL;
-    }
-
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java

@@ -1,31 +0,0 @@
-package org.keycloak.authentication.model;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.models.RealmModel;
-import org.keycloak.authentication.AuthProviderConstants;
-
-/**
- * AbstractModelAuthenticationProvider, which uses current realm to call operations on
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_MODEL;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Collections.EMPTY_LIST;
-    }
-
-    @Override
-    protected RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) {
-        return currentRealm;
-    }
-}

authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java

@@ -1,32 +0,0 @@
-package org.keycloak.authentication.model;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class ModelAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new ModelAuthenticationProvider();
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_MODEL;
-    }
-
-}

authentication/authentication-model/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -1,2 +0,0 @@
-org.keycloak.authentication.model.ModelAuthenticationProviderFactory
-org.keycloak.authentication.model.ExternalModelAuthenticationProviderFactory

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java

@@ -1,134 +0,0 @@
-package org.keycloak.authentication.picketlink;
-
-import org.jboss.logging.Logger;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthProviderStatus;
-import org.keycloak.authentication.AuthUser;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderException;
-import org.keycloak.models.RealmModel;
-import org.keycloak.picketlink.IdentityManagerProvider;
-import org.picketlink.idm.IdentityManagementException;
-import org.picketlink.idm.IdentityManager;
-import org.picketlink.idm.credential.Credentials;
-import org.picketlink.idm.credential.Password;
-import org.picketlink.idm.credential.UsernamePasswordCredentials;
-import org.picketlink.idm.model.basic.BasicModel;
-import org.picketlink.idm.model.basic.User;
-
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-/**
- * AuthenticationProvider, which delegates authentication to picketlink
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class PicketlinkAuthenticationProvider implements AuthenticationProvider {
-
-    private static final Logger logger = Logger.getLogger(PicketlinkAuthenticationProvider.class);
-
-    private final IdentityManagerProvider identityManagerProvider;
-
-    public PicketlinkAuthenticationProvider(IdentityManagerProvider identityManagerProvider) {
-        this.identityManagerProvider = identityManagerProvider;
-    }
-
-    @Override
-    public String getName() {
-        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
-    }
-
-    @Override
-    public List<String> getAvailableOptions() {
-        return Collections.EMPTY_LIST;
-    }
-
-    @Override
-    public AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = BasicModel.getUser(identityManager, username);
-            return picketlinkUser == null ? null : new AuthUser(picketlinkUser.getId(), picketlinkUser.getLoginName(), getName())
-                    .setName(picketlinkUser.getFirstName(), picketlinkUser.getLastName())
-                    .setEmail(picketlinkUser.getEmail())
-                    .setProviderName(getName());
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = new User(username);
-            identityManager.add(picketlinkUser);
-
-            // Hack needed due to ActiveDirectory bug in Picketlink TODO: Remove once https://issues.jboss.org/browse/PLINK-485 fixed and updated in keycloak master
-            picketlinkUser = BasicModel.getUser(identityManager, picketlinkUser.getLoginName());
-
-            return picketlinkUser.getId();
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            UsernamePasswordCredentials credential = new UsernamePasswordCredentials();
-            credential.setUsername(username);
-            credential.setPassword(new Password(password.toCharArray()));
-            identityManager.validateCredentials(credential);
-            if (credential.getStatus() == Credentials.Status.VALID) {
-                return AuthProviderStatus.SUCCESS;
-            } else {
-                return AuthProviderStatus.INVALID_CREDENTIALS;
-            }
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
-        IdentityManager identityManager = getIdentityManager(realm);
-
-        try {
-            User picketlinkUser = BasicModel.getUser(identityManager, username);
-            if (picketlinkUser == null) {
-                logger.debugf("User '%s' doesn't exists. Skip password update", username);
-                return false;
-            }
-
-            identityManager.updateCredential(picketlinkUser, new Password(password.toCharArray()));
-            return true;
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
-        }
-    }
-
-    @Override
-    public void close() {
-    }
-
-    public IdentityManager getIdentityManager(RealmModel realm) throws AuthenticationProviderException {
-        return identityManagerProvider.getIdentityManager(realm);
-    }
-
-    private AuthenticationProviderException convertIDMException(IdentityManagementException ie) {
-        Throwable realCause = ie;
-        while (realCause.getCause() != null) {
-            realCause = realCause.getCause();
-        }
-
-        // Use the message from the realCause
-        return new AuthenticationProviderException(realCause.getMessage(), ie);
-    }
-}

authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProviderFactory.java

@@ -1,33 +0,0 @@
-package org.keycloak.authentication.picketlink;
-
-import org.keycloak.Config;
-import org.keycloak.authentication.AuthProviderConstants;
-import org.keycloak.authentication.AuthenticationProvider;
-import org.keycloak.authentication.AuthenticationProviderFactory;
-import org.keycloak.picketlink.IdentityManagerProvider;
-import org.keycloak.provider.ProviderSession;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class PicketlinkAuthenticationProviderFactory implements AuthenticationProviderFactory {
-
-    @Override
-    public AuthenticationProvider create(ProviderSession providerSession) {
-        return new PicketlinkAuthenticationProvider(providerSession.getProvider(IdentityManagerProvider.class));
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-    }
-
-    @Override
-    public void close() {
-    }
-
-    @Override
-    public String getId() {
-        return AuthProviderConstants.PROVIDER_NAME_PICKETLINK;
-    }
-
-}

authentication/authentication-picketlink/src/main/resources/META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory

@@ -1 +0,0 @@
-org.keycloak.authentication.picketlink.PicketlinkAuthenticationProviderFactory

connections/infinispan/pom.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.1.0.Beta2</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-infinispan</artifactId>
+    <name>Keycloak Connections Infinispan</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.infinispan</groupId>
+            <artifactId>infinispan-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

connections/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProvider.java

@@ -0,0 +1,26 @@
+package org.keycloak.connections.infinispan;
+
+import org.infinispan.Cache;
+import org.infinispan.manager.EmbeddedCacheManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultInfinispanConnectionProvider implements InfinispanConnectionProvider {
+
+    private EmbeddedCacheManager cacheManager;
+
+    public DefaultInfinispanConnectionProvider(EmbeddedCacheManager cacheManager) {
+        this.cacheManager = cacheManager;
+    }
+
+    @Override
+    public <K, V> Cache<K, V> getCache(String name) {
+        return cacheManager.getCache(name);
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

connections/infinispan/src/main/java/org/keycloak/connections/infinispan/DefaultInfinispanConnectionProviderFactory.java

@@ -0,0 +1,123 @@
+package org.keycloak.connections.infinispan;
+
+import org.infinispan.configuration.cache.CacheMode;
+import org.infinispan.configuration.cache.Configuration;
+import org.infinispan.configuration.cache.ConfigurationBuilder;
+import org.infinispan.configuration.global.GlobalConfigurationBuilder;
+import org.infinispan.manager.DefaultCacheManager;
+import org.infinispan.manager.EmbeddedCacheManager;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+import javax.naming.InitialContext;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultInfinispanConnectionProviderFactory implements InfinispanConnectionProviderFactory {
+
+    protected static final Logger logger = Logger.getLogger(DefaultInfinispanConnectionProviderFactory.class);
+
+    private Config.Scope config;
+
+    private EmbeddedCacheManager cacheManager;
+
+    private boolean containerManaged;
+
+    @Override
+    public InfinispanConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        return new DefaultInfinispanConnectionProvider(cacheManager);
+    }
+
+    @Override
+    public void close() {
+        if (cacheManager != null && !containerManaged) {
+            cacheManager.stop();
+        }
+        cacheManager = null;
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (cacheManager == null) {
+            synchronized (this) {
+                if (cacheManager == null) {
+                    String cacheContainer = config.get("cacheContainer");
+                    if (cacheContainer != null) {
+                        initContainerManaged(cacheContainer);
+                    } else {
+                        initEmbedded();
+                    }
+                }
+            }
+        }
+    }
+
+    private void initContainerManaged(String cacheContainerLookup) {
+        try {
+            cacheManager = (EmbeddedCacheManager) new InitialContext().lookup(cacheContainerLookup);
+            containerManaged = true;
+
+            logger.debugv("Using container managed Infinispan cache container, lookup={1}", cacheContainerLookup);
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to retrieve cache container", e);
+        }
+    }
+
+    private void initEmbedded() {
+        GlobalConfigurationBuilder gcb = new GlobalConfigurationBuilder();
+
+        boolean clustered = config.getBoolean("clustered", false);
+        boolean async = config.getBoolean("async", true);
+
+        if (clustered) {
+            gcb.transport().defaultTransport();
+        }
+        cacheManager = new DefaultCacheManager(gcb.build());
+        containerManaged = false;
+
+        logger.debug("Started embedded Infinispan cache container");
+
+        ConfigurationBuilder invalidationConfigBuilder = new ConfigurationBuilder();
+        if (clustered) {
+            invalidationConfigBuilder.clustering().cacheMode(async ? CacheMode.INVALIDATION_ASYNC : CacheMode.INVALIDATION_SYNC);
+        }
+        Configuration invalidationCacheConfiguration = invalidationConfigBuilder.build();
+
+        cacheManager.defineConfiguration(InfinispanConnectionProvider.REALM_CACHE_NAME, invalidationCacheConfiguration);
+        cacheManager.defineConfiguration(InfinispanConnectionProvider.USER_CACHE_NAME, invalidationCacheConfiguration);
+
+        ConfigurationBuilder sessionConfigBuilder = new ConfigurationBuilder();
+        if (clustered) {
+            String sessionsMode = config.get("sessionsMode", "distributed");
+            if (sessionsMode.equalsIgnoreCase("replicated")) {
+                sessionConfigBuilder.clustering().cacheMode(async ? CacheMode.REPL_ASYNC : CacheMode.REPL_SYNC);
+            } else if (sessionsMode.equalsIgnoreCase("distributed")) {
+                sessionConfigBuilder.clustering().cacheMode(async ? CacheMode.DIST_ASYNC : CacheMode.DIST_SYNC);
+            } else {
+                throw new RuntimeException("Invalid value for sessionsMode");
+            }
+
+            sessionConfigBuilder.clustering().hash()
+                    .numOwners(config.getInt("sessionsOwners", 2))
+                    .numSegments(config.getInt("sessionsSegments", 60)).build();
+        }
+
+        Configuration sessionCacheConfiguration = sessionConfigBuilder.build();
+        cacheManager.defineConfiguration(InfinispanConnectionProvider.SESSION_CACHE_NAME, sessionCacheConfiguration);
+        cacheManager.defineConfiguration(InfinispanConnectionProvider.LOGIN_FAILURE_CACHE_NAME, sessionCacheConfiguration);
+    }
+
+}

connections/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProvider.java

@@ -0,0 +1,18 @@
+package org.keycloak.connections.infinispan;
+
+import org.infinispan.Cache;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface InfinispanConnectionProvider extends Provider {
+
+    static final String REALM_CACHE_NAME = "realms";
+    static final String USER_CACHE_NAME = "users";
+    static final String SESSION_CACHE_NAME = "sessions";
+    static final String LOGIN_FAILURE_CACHE_NAME = "loginFailures";
+
+    <K, V> Cache<K, V> getCache(String name);
+
+}

connections/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.infinispan;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface InfinispanConnectionProviderFactory extends ProviderFactory<InfinispanConnectionProvider> {
+}

connections/infinispan/src/main/java/org/keycloak/connections/infinispan/InfinispanConnectionSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.connections.infinispan;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class InfinispanConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsInfinispan";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return InfinispanConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return InfinispanConnectionProviderFactory.class;
+    }
+
+}

connections/infinispan/src/main/resources/META-INF/services/org.keycloak.connections.infinispan.InfinispanConnectionProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory

connections/infinispan/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1 @@
+org.keycloak.connections.infinispan.InfinispanConnectionSpi

connections/jpa-liquibase/pom.xml

@@ -0,0 +1,72 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.1.0.Beta2</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-jpa-liquibase</artifactId>
+    <name>Keycloak Connections JPA Liquibase Updater</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-connections-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.liquibase</groupId>
+            <artifactId>liquibase-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.liquibase</groupId>
+                <artifactId>liquibase-maven-plugin</artifactId>
+                <configuration>
+                    <changeLogFile>META-INF/jpa-changelog-master.xml</changeLogFile>
+
+                    <url>${url}</url>
+                    <driver>${driver}</driver>
+                    <username>${username}</username>
+                    <password>${password}</password>
+
+                    <referenceUrl>${referenceUrl}</referenceUrl>
+                    <referenceDriver>${driver}</referenceDriver>
+                    <referenceUsername>${username}</referenceUsername>
+                    <referencePassword>${password}</referencePassword>
+                </configuration>
+                <dependencies>
+                    <dependency>
+                        <groupId>com.h2database</groupId>
+                        <artifactId>h2</artifactId>
+                        <version>${h2.version}</version>
+                    </dependency>
+                </dependencies>
+            </plugin>
+        </plugins>
+    </build>
+
+    <properties>
+        <username>sa</username>
+        <password></password>
+        <driver>org.h2.Driver</driver>
+    </properties>
+</project>

connections/jpa-liquibase/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProvider.java

@@ -0,0 +1,224 @@
+package org.keycloak.connections.jpa.updater.liquibase;
+
+import liquibase.Contexts;
+import liquibase.Liquibase;
+import liquibase.changelog.ChangeSet;
+import liquibase.changelog.DatabaseChangeLog;
+import liquibase.changelog.RanChangeSet;
+import liquibase.database.Database;
+import liquibase.database.DatabaseFactory;
+import liquibase.database.core.DB2Database;
+import liquibase.database.core.DerbyDatabase;
+import liquibase.database.core.FirebirdDatabase;
+import liquibase.database.core.H2Database;
+import liquibase.database.core.HsqlDatabase;
+import liquibase.database.core.InformixDatabase;
+import liquibase.database.core.MSSQLDatabase;
+import liquibase.database.core.MySQLDatabase;
+import liquibase.database.core.OracleDatabase;
+import liquibase.database.core.PostgresDatabase;
+import liquibase.database.core.SQLiteDatabase;
+import liquibase.database.core.SybaseASADatabase;
+import liquibase.database.core.SybaseDatabase;
+import liquibase.database.jvm.JdbcConnection;
+import liquibase.exception.LiquibaseException;
+import liquibase.logging.LogFactory;
+import liquibase.logging.LogLevel;
+import liquibase.resource.ClassLoaderResourceAccessor;
+import liquibase.servicelocator.ServiceLocator;
+import org.jboss.logging.Logger;
+import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
+
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class LiquibaseJpaUpdaterProvider implements JpaUpdaterProvider {
+
+    private static final Logger logger = Logger.getLogger(LiquibaseJpaUpdaterProvider.class);
+
+    private static final String CHANGELOG = "META-INF/jpa-changelog-master.xml";
+
+    @Override
+    public String getCurrentVersionSql() {
+        return "SELECT ID from DATABASECHANGELOG ORDER BY DATEEXECUTED DESC LIMIT 1";
+    }
+
+    @Override
+    public void update(Connection connection) {
+        logger.debug("Starting database update");
+
+        try {
+            Liquibase liquibase = getLiquibase(connection);
+
+            List<ChangeSet> changeSets = liquibase.listUnrunChangeSets((Contexts) null);
+            if (!changeSets.isEmpty()) {
+                if (changeSets.get(0).getId().equals(FIRST_VERSION)) {
+                    Statement statement = connection.createStatement();
+                    try {
+                        statement.executeQuery("SELECT id FROM REALM");
+
+                        logger.infov("Updating database from {0} to {1}", FIRST_VERSION, changeSets.get(changeSets.size() - 1).getId());
+                        liquibase.markNextChangeSetRan((Contexts) null);
+                    } catch (SQLException e) {
+                        logger.info("Initializing database schema");
+                    }
+                } else {
+                    if (logger.isDebugEnabled()) {
+                        List<RanChangeSet> ranChangeSets = liquibase.getDatabase().getRanChangeSetList();
+                        logger.debugv("Updating database from {0} to {1}", ranChangeSets.get(ranChangeSets.size() - 1).getId(), changeSets.get(changeSets.size() - 1).getId());
+                    } else {
+                        logger.infov("Updating database");
+                    }
+                }
+
+                liquibase.update((Contexts) null);
+            }
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to update database", e);
+        }
+        logger.debug("Completed database update");
+    }
+
+    @Override
+    public void validate(Connection connection) {
+        try {
+            Liquibase liquibase = getLiquibase(connection);
+
+            liquibase.validate();
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to validate database", e);
+        }
+    }
+
+    private Liquibase getLiquibase(Connection connection) throws Exception {
+        ServiceLocator sl = ServiceLocator.getInstance();
+
+        if (!System.getProperties().containsKey("liquibase.scan.packages")) {
+            if (sl.getPackages().remove("liquibase.core")) {
+                sl.addPackageToScan("liquibase.core.xml");
+            }
+
+            if (sl.getPackages().remove("liquibase.parser")) {
+                sl.addPackageToScan("liquibase.parser.core.xml");
+            }
+
+            if (sl.getPackages().remove("liquibase.serializer")) {
+                sl.addPackageToScan("liquibase.serializer.core.xml");
+            }
+
+            sl.getPackages().remove("liquibase.ext");
+            sl.getPackages().remove("liquibase.sdk");
+        }
+
+        LogFactory.setInstance(new LogWrapper());
+        Database database = DatabaseFactory.getInstance().findCorrectDatabaseImplementation(new JdbcConnection(connection));
+        return new Liquibase(CHANGELOG, new ClassLoaderResourceAccessor(getClass().getClassLoader()), database);
+    }
+
+    @Override
+    public void close() {
+    }
+
+    private static class LogWrapper extends LogFactory {
+
+        private liquibase.logging.Logger logger = new liquibase.logging.Logger() {
+            @Override
+            public void setName(String name) {
+            }
+
+            @Override
+            public void setLogLevel(String level) {
+            }
+
+            @Override
+            public void setLogLevel(LogLevel level) {
+            }
+
+            @Override
+            public void setLogLevel(String logLevel, String logFile) {
+            }
+
+            @Override
+            public void severe(String message) {
+                LiquibaseJpaUpdaterProvider.logger.error(message);
+            }
+
+            @Override
+            public void severe(String message, Throwable e) {
+                LiquibaseJpaUpdaterProvider.logger.error(message, e);
+            }
+
+            @Override
+            public void warning(String message) {
+                LiquibaseJpaUpdaterProvider.logger.warn(message);
+            }
+
+            @Override
+            public void warning(String message, Throwable e) {
+                LiquibaseJpaUpdaterProvider.logger.warn(message, e);
+            }
+
+            @Override
+            public void info(String message) {
+                LiquibaseJpaUpdaterProvider.logger.debug(message);
+            }
+
+            @Override
+            public void info(String message, Throwable e) {
+                LiquibaseJpaUpdaterProvider.logger.debug(message, e);
+            }
+
+            @Override
+            public void debug(String message) {
+                LiquibaseJpaUpdaterProvider.logger.trace(message);
+            }
+
+            @Override
+            public LogLevel getLogLevel() {
+                if (LiquibaseJpaUpdaterProvider.logger.isTraceEnabled()) {
+                    return LogLevel.DEBUG;
+                } else if (LiquibaseJpaUpdaterProvider.logger.isDebugEnabled()) {
+                    return LogLevel.INFO;
+                } else {
+                    return LogLevel.WARNING;
+                }
+            }
+
+            @Override
+            public void debug(String message, Throwable e) {
+                LiquibaseJpaUpdaterProvider.logger.trace(message, e);
+            }
+
+            @Override
+            public void setChangeLog(DatabaseChangeLog databaseChangeLog) {
+            }
+
+            @Override
+            public void setChangeSet(ChangeSet changeSet) {
+            }
+
+            @Override
+            public int getPriority() {
+                return 0;
+            }
+        };
+
+        @Override
+        public liquibase.logging.Logger getLog(String name) {
+            return logger;
+        }
+
+        @Override
+        public liquibase.logging.Logger getLog() {
+            return logger;
+        }
+
+    }
+
+}

connections/jpa-liquibase/src/main/java/org/keycloak/connections/jpa/updater/liquibase/LiquibaseJpaUpdaterProviderFactory.java

@@ -0,0 +1,31 @@
+package org.keycloak.connections.jpa.updater.liquibase;
+
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
+import org.keycloak.connections.jpa.updater.JpaUpdaterProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class LiquibaseJpaUpdaterProviderFactory implements JpaUpdaterProviderFactory {
+
+    @Override
+    public JpaUpdaterProvider create(KeycloakSession session) {
+        return new LiquibaseJpaUpdaterProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "liquibase";
+    }
+
+}

connections/jpa-liquibase/src/main/java/org/keycloak/connections/jpa/updater/liquibase/custom/AddRealmCodeSecret.java

@@ -0,0 +1,79 @@
+package org.keycloak.connections.jpa.updater.liquibase.custom;
+
+import liquibase.change.custom.CustomSqlChange;
+import liquibase.database.Database;
+import liquibase.database.jvm.JdbcConnection;
+import liquibase.exception.CustomChangeException;
+import liquibase.exception.SetupException;
+import liquibase.exception.ValidationErrors;
+import liquibase.resource.ResourceAccessor;
+import liquibase.statement.SqlStatement;
+import liquibase.statement.core.UpdateStatement;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.sql.Connection;
+import java.sql.ResultSet;
+import java.util.ArrayList;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class AddRealmCodeSecret implements CustomSqlChange {
+
+    private String confirmationMessage;
+
+    @Override
+    public SqlStatement[] generateStatements(Database database) throws CustomChangeException {
+        try {
+            StringBuilder sb = new StringBuilder();
+            sb.append("Generated codeSecret for realms: ");
+
+            Connection connection = ((JdbcConnection) (database.getConnection())).getWrappedConnection();
+            ResultSet resultSet = connection.createStatement().executeQuery("SELECT ID FROM REALM WHERE CODE_SECRET IS NULL");
+
+            ArrayList<SqlStatement> statements = new ArrayList<SqlStatement>();
+            while (resultSet.next()) {
+                String id = resultSet.getString(1);
+
+                UpdateStatement statement = new UpdateStatement(null, null, "REALM")
+                        .addNewColumnValue("CODE_SECRET", KeycloakModelUtils.generateCodeSecret())
+                        .setWhereClause("ID='" + id + "'");
+                statements.add(statement);
+
+                if (!resultSet.isFirst()) {
+                    sb.append(", ");
+                }
+                sb.append(id);
+            }
+
+            if (!statements.isEmpty()) {
+                confirmationMessage = sb.toString();
+            }
+
+            return statements.toArray(new SqlStatement[statements.size()]);
+        } catch (Exception e) {
+            throw new CustomChangeException("Failed to add realm code secret", e);
+        }
+    }
+
+    @Override
+    public String getConfirmationMessage() {
+        return confirmationMessage;
+    }
+
+    @Override
+    public void setUp() throws SetupException {
+
+    }
+
+    @Override
+    public void setFileOpener(ResourceAccessor resourceAccessor) {
+
+    }
+
+    @Override
+    public ValidationErrors validate(Database database) {
+        return null;
+    }
+
+}

connections/jpa-liquibase/src/main/resources/META-INF/jpa-changelog-1.0.0.Final.xml

@@ -0,0 +1,420 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.2.xsd">
+    <changeSet author="sthorger@redhat.com" id="1.0.0.Final">
+        <createTable tableName="APPLICATION_DEFAULT_ROLES">
+            <column name="APPLICATION_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ROLE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="CLIENT">
+            <column name="DTYPE" type="VARCHAR(31)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ALLOWED_CLAIMS_MASK" type="BIGINT"/>
+            <column name="ENABLED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="FULL_SCOPE_ALLOWED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="NAME" type="VARCHAR(255)"/>
+            <column name="NOT_BEFORE" type="INT"/>
+            <column name="PUBLIC_CLIENT" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SECRET" type="VARCHAR(255)"/>
+            <column name="BASE_URL" type="VARCHAR(255)"/>
+            <column name="BEARER_ONLY" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="MANAGEMENT_URL" type="VARCHAR(255)"/>
+            <column name="SURROGATE_AUTH_REQUIRED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="DIRECT_GRANTS_ONLY" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="REALM_ID" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="CLIENT_SESSION">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ACTION" type="INT"/>
+            <column name="CLIENT_ID" type="VARCHAR(36)"/>
+            <column name="REDIRECT_URI" type="VARCHAR(255)"/>
+            <column name="STATE" type="VARCHAR(255)"/>
+            <column name="TIMESTAMP" type="INT"/>
+            <column name="SESSION_ID" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="CLIENT_SESSION_ROLE">
+            <column name="ROLE_ID" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="CLIENT_SESSION" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="COMPOSITE_ROLE">
+            <column name="COMPOSITE" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="CHILD_ROLE" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="CREDENTIAL">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="DEVICE" type="VARCHAR(255)"/>
+            <column name="HASH_ITERATIONS" type="INT"/>
+            <column name="SALT" type="BLOB(16)"/>
+            <column name="TYPE" type="VARCHAR(255)"/>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="USER_ID" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="EVENT_ENTITY">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="CLIENT_ID" type="VARCHAR(255)"/>
+            <column name="DETAILS_JSON" type="VARCHAR(2550)"/>
+            <column name="ERROR" type="VARCHAR(255)"/>
+            <column name="IP_ADDRESS" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+            <column name="SESSION_ID" type="VARCHAR(255)"/>
+            <column name="TIME" type="BIGINT"/>
+            <column name="TYPE" type="VARCHAR(255)"/>
+            <column name="USER_ID" type="VARCHAR(255)"/>
+        </createTable>
+        <createTable tableName="FED_PROVIDERS">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="USERFEDERATIONPROVIDERS_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="KEYCLOAK_ROLE">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="APP_REALM_CONSTRAINT" type="VARCHAR(36)"/>
+            <column name="APPLICATION_ROLE" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="DESCRIPTION" type="VARCHAR(255)"/>
+            <column name="NAME" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+            <column name="APPLICATION" type="VARCHAR(36)"/>
+            <column name="REALM" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="REALM">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ACCESS_CODE_LIFESPAN" type="INT"/>
+            <column name="USER_ACTION_LIFESPAN" type="INT"/>
+            <column name="ACCESS_TOKEN_LIFESPAN" type="INT"/>
+            <column name="ACCOUNT_THEME" type="VARCHAR(255)"/>
+            <column name="ADMIN_THEME" type="VARCHAR(255)"/>
+            <column name="EMAIL_THEME" type="VARCHAR(255)"/>
+            <column name="ENABLED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="EVENTS_ENABLED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="EVENTS_EXPIRATION" type="BIGINT"/>
+            <column name="LOGIN_THEME" type="VARCHAR(255)"/>
+            <column name="NAME" type="VARCHAR(255)"/>
+            <column name="NOT_BEFORE" type="INT"/>
+            <column name="PASSWORD_CRED_GRANT_ALLOWED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="PASSWORD_POLICY" type="VARCHAR(255)"/>
+            <column name="PRIVATE_KEY" type="VARCHAR(2048)"/>
+            <column name="PUBLIC_KEY" type="VARCHAR(2048)"/>
+            <column name="REGISTRATION_ALLOWED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="REMEMBER_ME" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="RESET_PASSWORD_ALLOWED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SOCIAL" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SSL_REQUIRED" type="VARCHAR(255)"/>
+            <column name="SSO_IDLE_TIMEOUT" type="INT"/>
+            <column name="SSO_MAX_LIFESPAN" type="INT"/>
+            <column name="UPDATE_PROFILE_ON_SOC_LOGIN" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VERIFY_EMAIL" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="MASTER_ADMIN_APP" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="REALM_APPLICATION">
+            <column name="APPLICATION_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REALM_ATTRIBUTE">
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REALM_DEFAULT_ROLES">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ROLE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REALM_EVENTS_LISTENERS">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+        </createTable>
+        <createTable tableName="REALM_REQUIRED_CREDENTIAL">
+            <column name="TYPE" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="FORM_LABEL" type="VARCHAR(255)"/>
+            <column name="INPUT" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="SECRET" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REALM_SMTP_CONFIG">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REALM_SOCIAL_CONFIG">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="REDIRECT_URIS">
+            <column name="CLIENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+        </createTable>
+        <createTable tableName="SCOPE_MAPPING">
+            <column name="CLIENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ROLE_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="USERNAME_LOGIN_FAILURE">
+            <column name="REALM_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="USERNAME" type="VARCHAR(200)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="FAILED_LOGIN_NOT_BEFORE" type="INT"/>
+            <column name="LAST_FAILURE" type="BIGINT"/>
+            <column name="LAST_IP_FAILURE" type="VARCHAR(255)"/>
+            <column name="NUM_FAILURES" type="INT"/>
+        </createTable>
+        <createTable tableName="USER_ATTRIBUTE">
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="USER_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="USER_ENTITY">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="EMAIL" type="VARCHAR(255)"/>
+            <column name="EMAIL_CONSTRAINT" type="VARCHAR(255)"/>
+            <column name="EMAIL_VERIFIED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="ENABLED" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="FEDERATION_LINK" type="VARCHAR(255)"/>
+            <column name="FIRST_NAME" type="VARCHAR(255)"/>
+            <column name="LAST_NAME" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+            <column name="TOTP" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="USERNAME" type="VARCHAR(255)"/>
+        </createTable>
+        <createTable tableName="USER_FEDERATION_CONFIG">
+            <column name="USER_FEDERATION_PROVIDER_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="USER_FEDERATION_PROVIDER">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="CHANGED_SYNC_PERIOD" type="INT"/>
+            <column name="DISPLAY_NAME" type="VARCHAR(255)"/>
+            <column name="FULL_SYNC_PERIOD" type="INT"/>
+            <column name="LAST_SYNC" type="INT"/>
+            <column name="PRIORITY" type="INT"/>
+            <column name="PROVIDER_NAME" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(36)"/>
+        </createTable>
+        <createTable tableName="USER_REQUIRED_ACTION">
+            <column name="ACTION" type="INT">
+                <constraints nullable="false"/>
+            </column>
+            <column name="USER_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="USER_ROLE_MAPPING">
+            <column name="ROLE_ID" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="USER_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="USER_SESSION">
+            <column name="ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="AUTH_METHOD" type="VARCHAR(255)"/>
+            <column name="IP_ADDRESS" type="VARCHAR(255)"/>
+            <column name="LAST_SESSION_REFRESH" type="INT"/>
+            <column name="LOGIN_USERNAME" type="VARCHAR(255)"/>
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+            <column name="REMEMBER_ME" type="BOOLEAN" defaultValueBoolean="false">
+                <constraints nullable="false"/>
+            </column>
+            <column name="STARTED" type="INT"/>
+            <column name="USER_ID" type="VARCHAR(255)"/>
+        </createTable>
+        <createTable tableName="USER_SOCIAL_LINK">
+            <column name="SOCIAL_PROVIDER" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+            <column name="SOCIAL_USER_ID" type="VARCHAR(255)"/>
+            <column name="SOCIAL_USERNAME" type="VARCHAR(255)"/>
+            <column name="USER_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="WEB_ORIGINS">
+            <column name="CLIENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+        </createTable>
+        <addPrimaryKey columnNames="REALM_ID, NAME" constraintName="CONSTRAINT_1" tableName="REALM_SOCIAL_CONFIG"/>
+        <addPrimaryKey columnNames="REALM_ID, USERNAME" constraintName="CONSTRAINT_17" tableName="USERNAME_LOGIN_FAILURE"/>
+        <addPrimaryKey columnNames="ACTION, USER_ID" constraintName="CONSTRAINT_2" tableName="USER_REQUIRED_ACTION"/>
+        <addPrimaryKey columnNames="SOCIAL_PROVIDER, USER_ID" constraintName="CONSTRAINT_3" tableName="USER_SOCIAL_LINK"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_4" tableName="EVENT_ENTITY"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_4A" tableName="REALM"/>
+        <addPrimaryKey columnNames="CLIENT_SESSION, ROLE_ID" constraintName="CONSTRAINT_5" tableName="CLIENT_SESSION_ROLE"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_57" tableName="USER_SESSION"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_5C" tableName="USER_FEDERATION_PROVIDER"/>
+        <addPrimaryKey columnNames="NAME, USER_ID" constraintName="CONSTRAINT_6" tableName="USER_ATTRIBUTE"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_7" tableName="CLIENT"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_8" tableName="CLIENT_SESSION"/>
+        <addPrimaryKey columnNames="CLIENT_ID, ROLE_ID" constraintName="CONSTRAINT_81" tableName="SCOPE_MAPPING"/>
+        <addPrimaryKey columnNames="NAME, REALM_ID" constraintName="CONSTRAINT_9" tableName="REALM_ATTRIBUTE"/>
+        <addPrimaryKey columnNames="REALM_ID, TYPE" constraintName="CONSTRAINT_92" tableName="REALM_REQUIRED_CREDENTIAL"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_A" tableName="KEYCLOAK_ROLE"/>
+        <addPrimaryKey columnNames="ROLE_ID, USER_ID" constraintName="CONSTRAINT_C" tableName="USER_ROLE_MAPPING"/>
+        <addPrimaryKey columnNames="REALM_ID, NAME" constraintName="CONSTRAINT_E" tableName="REALM_SMTP_CONFIG"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_F" tableName="CREDENTIAL"/>
+        <addPrimaryKey columnNames="USER_FEDERATION_PROVIDER_ID, NAME" constraintName="CONSTRAINT_F9" tableName="USER_FEDERATION_CONFIG"/>
+        <addPrimaryKey columnNames="ID" constraintName="CONSTRAINT_FB" tableName="USER_ENTITY"/>
+        <addUniqueConstraint columnNames="ROLE_ID" constraintName="UK_8AELWNIBJI49AVXSRTUF6XJOW" tableName="APPLICATION_DEFAULT_ROLES"/>
+        <addUniqueConstraint columnNames="REALM_ID,NAME" constraintName="UK_B71CJLBENV945RB6GCON438AT" tableName="CLIENT"/>
+        <addUniqueConstraint columnNames="USERFEDERATIONPROVIDERS_ID" constraintName="UK_DCCIRJLIPU1478VQC89DID88C" tableName="FED_PROVIDERS"/>
+        <addUniqueConstraint columnNames="REALM_ID,EMAIL_CONSTRAINT" constraintName="UK_DYKN684SL8UP1CRFEI6ECKHD7" tableName="USER_ENTITY"/>
+        <addUniqueConstraint columnNames="ROLE_ID" constraintName="UK_H4WPD7W4HSOOLNI3H0SW7BTJE" tableName="REALM_DEFAULT_ROLES"/>
+        <addUniqueConstraint columnNames="NAME,APP_REALM_CONSTRAINT" constraintName="UK_J3RWUVD56ONTGSUHOGM184WW2" tableName="KEYCLOAK_ROLE"/>
+        <addUniqueConstraint columnNames="REALM_ID" constraintName="UK_L5QGA3RFME47335JY8JXYXH3I" tableName="REALM_APPLICATION"/>
+        <addUniqueConstraint columnNames="NAME" constraintName="UK_ORVSDMLA56612EAEFIQ6WL5OI" tableName="REALM"/>
+        <addUniqueConstraint columnNames="REALM_ID,USERNAME" constraintName="UK_RU8TT6T700S9V50BU18WS5HA6" tableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_SESSION" baseTableName="CLIENT_SESSION_ROLE" constraintName="FK_11B7SGQW18I532811V7O2DV76" referencedColumnNames="ID" referencedTableName="CLIENT_SESSION"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_ID" baseTableName="REDIRECT_URIS" constraintName="FK_1BURS8PB4OUJ97H5WUPPAHV9F" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="USER_FEDERATION_PROVIDER" constraintName="FK_1FJ32F6PTOLW2QY60CD8N01E8" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="FED_PROVIDERS" constraintName="FK_213LYQ09FKXQ8K8NY8DY3737T" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_REQUIRED_CREDENTIAL" constraintName="FK_5HG65LYBEVAVKQFKI3KPONH9V" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="USER_ID" baseTableName="USER_ATTRIBUTE" constraintName="FK_5HRM2VLF9QL5FU043KQEPOVBR" referencedColumnNames="ID" referencedTableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="USER_ID" baseTableName="USER_SOCIAL_LINK" constraintName="FK_68CJYS5UWM55UY823Y75XG4OM" referencedColumnNames="ID" referencedTableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="USER_ID" baseTableName="USER_REQUIRED_ACTION" constraintName="FK_6QJ3W1JW9CVAFHE19BWSIUVMD" referencedColumnNames="ID" referencedTableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="REALM" baseTableName="KEYCLOAK_ROLE" constraintName="FK_6VYQFE4CN4WLQ8R6KT5VDSJ5C" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_SMTP_CONFIG" constraintName="FK_70EJ8XDXGXD0B9HH6180IRR0O" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="APPLICATION_ID" baseTableName="REALM_APPLICATION" constraintName="FK_71S3P0DIUXAWWQQSA528UBY2Q" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="ROLE_ID" baseTableName="APPLICATION_DEFAULT_ROLES" constraintName="FK_8AELWNIBJI49AVXSRTUF6XJOW" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_ATTRIBUTE" constraintName="FK_8SHXD6L3E9ATQUKACXGPFFPTW" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="COMPOSITE" baseTableName="COMPOSITE_ROLE" constraintName="FK_A63WVEKFTU8JO1PNJ81E7MCE2" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+        <addForeignKeyConstraint baseColumnNames="SESSION_ID" baseTableName="CLIENT_SESSION" constraintName="FK_B4AO2VCVAT6UKAU74WBWTFQO1" referencedColumnNames="ID" referencedTableName="USER_SESSION"/>
+        <addForeignKeyConstraint baseColumnNames="USER_ID" baseTableName="USER_ROLE_MAPPING" constraintName="FK_C4FQV34P1MBYLLOXANG7B1Q3L" referencedColumnNames="ID" referencedTableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="USERFEDERATIONPROVIDERS_ID" baseTableName="FED_PROVIDERS" constraintName="FK_DCCIRJLIPU1478VQC89DID88C" referencedColumnNames="ID" referencedTableName="USER_FEDERATION_PROVIDER"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_DEFAULT_ROLES" constraintName="FK_EVUDB1PPW84OXFAX2DRS03ICC" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="CHILD_ROLE" baseTableName="COMPOSITE_ROLE" constraintName="FK_GR7THLLB9LU8Q4VQA4524JJY8" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+        <addForeignKeyConstraint baseColumnNames="ROLE_ID" baseTableName="REALM_DEFAULT_ROLES" constraintName="FK_H4WPD7W4HSOOLNI3H0SW7BTJE" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_EVENTS_LISTENERS" constraintName="FK_H846O4H0W8EPX5NXEV9F5Y69J" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_APPLICATION" constraintName="FK_L5QGA3RFME47335JY8JXYXH3I" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_ID" baseTableName="WEB_ORIGINS" constraintName="FK_LOJPHO213XCX4WNKOG82SSRFY" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="APPLICATION_ID" baseTableName="APPLICATION_DEFAULT_ROLES" constraintName="FK_MAYLTS7KLWQW2H8M2B5JOYTKY" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_ID" baseTableName="SCOPE_MAPPING" constraintName="FK_OUSE064PLMLR732LXJCN1Q5F1" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="ROLE_ID" baseTableName="SCOPE_MAPPING" constraintName="FK_P3RH9GRKU11KQFRS4FLTT7RNQ" referencedColumnNames="ID" referencedTableName="KEYCLOAK_ROLE"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="CLIENT" constraintName="FK_P56CTINXXB9GSK57FO49F9TAC" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="USER_ID" baseTableName="CREDENTIAL" constraintName="FK_PFYR0GLASQYL0DEI3KL69R6V0" referencedColumnNames="ID" referencedTableName="USER_ENTITY"/>
+        <addForeignKeyConstraint baseColumnNames="APPLICATION" baseTableName="KEYCLOAK_ROLE" constraintName="FK_PIMO5LE2C0RAL09FL8CM9WFW9" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="MASTER_ADMIN_APP" baseTableName="REALM" constraintName="FK_RSAF444KK6QRKMS7N56AIWQ5Y" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="REALM_ID" baseTableName="REALM_SOCIAL_CONFIG" constraintName="FK_SV5I3C2TI7G0G922FGE683SOV" referencedColumnNames="ID" referencedTableName="REALM"/>
+        <addForeignKeyConstraint baseColumnNames="USER_FEDERATION_PROVIDER_ID" baseTableName="USER_FEDERATION_CONFIG" constraintName="FK_T13HPU1J94R2EBPEKR39X5EU5" referencedColumnNames="ID" referencedTableName="USER_FEDERATION_PROVIDER"/>
+    </changeSet>
+</databaseChangeLog>

connections/jpa-liquibase/src/main/resources/META-INF/jpa-changelog-1.1.0.Beta1.xml

@@ -0,0 +1,59 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.2.xsd">
+    <changeSet author="sthorger@redhat.com" id="1.1.0.Beta1">
+        <delete tableName="CLIENT_SESSION_ROLE"/>
+        <delete tableName="CLIENT_SESSION"/>
+        <delete tableName="USER_SESSION"/>
+
+        <createTable tableName="CLIENT_ATTRIBUTES">
+            <column name="CLIENT_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(2048)"/>
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="CLIENT_SESSION_NOTE">
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="VARCHAR(255)"/>
+            <column name="CLIENT_SESSION" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <createTable tableName="APP_NODE_REGISTRATIONS">
+            <column name="APPLICATION_ID" type="VARCHAR(36)">
+                <constraints nullable="false"/>
+            </column>
+            <column name="VALUE" type="INT"/>
+            <column name="NAME" type="VARCHAR(255)">
+                <constraints nullable="false"/>
+            </column>
+        </createTable>
+        <addColumn tableName="CLIENT_SESSION">
+            <column name="AUTH_METHOD" type="VARCHAR(255)"/>
+        </addColumn>
+        <addColumn tableName="CLIENT">
+            <column name="PROTOCOL" type="VARCHAR(255)"/>
+        </addColumn>
+        <addColumn tableName="CLIENT_SESSION">
+            <column name="REALM_ID" type="VARCHAR(255)"/>
+        </addColumn>
+        <addColumn tableName="REALM">
+            <column name="CERTIFICATE" type="VARCHAR(2048)"/>
+            <column name="CODE_SECRET" type="VARCHAR(255)"/>
+        </addColumn>
+        <addColumn tableName="CLIENT">
+            <column name="NODE_REREG_TIMEOUT" type="INT" defaultValueNumeric="0"/>
+        </addColumn>
+        <addPrimaryKey columnNames="CLIENT_ID, NAME" constraintName="CONSTRAINT_3C" tableName="CLIENT_ATTRIBUTES"/>
+        <addPrimaryKey columnNames="CLIENT_SESSION, NAME" constraintName="CONSTRAINT_5E" tableName="CLIENT_SESSION_NOTE"/>
+        <addPrimaryKey columnNames="APPLICATION_ID, NAME" constraintName="CONSTRAINT_84" tableName="APP_NODE_REGISTRATIONS"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_ID" baseTableName="CLIENT_ATTRIBUTES" constraintName="FK3C47C64BEACCA966" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <addForeignKeyConstraint baseColumnNames="CLIENT_SESSION" baseTableName="CLIENT_SESSION_NOTE" constraintName="FK5EDFB00FF51C2736" referencedColumnNames="ID" referencedTableName="CLIENT_SESSION"/>
+        <addForeignKeyConstraint baseColumnNames="APPLICATION_ID" baseTableName="APP_NODE_REGISTRATIONS" constraintName="FK8454723BA992F594" referencedColumnNames="ID" referencedTableName="CLIENT"/>
+        <customChange class="org.keycloak.connections.jpa.updater.liquibase.custom.AddRealmCodeSecret"/>
+    </changeSet>
+</databaseChangeLog>

connections/jpa-liquibase/src/main/resources/META-INF/jpa-changelog-master.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.2.xsd">
+    <include file="META-INF/jpa-changelog-1.0.0.Final.xml"/>
+    <include file="META-INF/jpa-changelog-1.1.0.Beta1.xml"/>
+</databaseChangeLog>

connections/jpa-liquibase/src/main/resources/META-INF/services/org.keycloak.connections.jpa.updater.JpaUpdaterProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.jpa.updater.liquibase.LiquibaseJpaUpdaterProviderFactory

connections/jpa/pom.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.1.0.Beta2</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-jpa</artifactId>
+    <name>Keycloak Connections JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProvider.java

@@ -0,0 +1,26 @@
+package org.keycloak.connections.jpa;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProvider implements JpaConnectionProvider {
+
+    private final EntityManager em;
+
+    public DefaultJpaConnectionProvider(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public EntityManager getEntityManager() {
+        return em;
+    }
+
+    @Override
+    public void close() {
+        em.close();
+    }
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java

@@ -0,0 +1,178 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.ejb.AvailableSettings;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.updater.JpaUpdaterProvider;
+import org.keycloak.models.KeycloakSession;
+
+import javax.naming.InitialContext;
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import javax.sql.DataSource;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProviderFactory implements JpaConnectionProviderFactory {
+
+    private static final Logger logger = Logger.getLogger(DefaultJpaConnectionProviderFactory.class);
+
+    private volatile EntityManagerFactory emf;
+
+    private Config.Scope config;
+
+    @Override
+    public JpaConnectionProvider create(KeycloakSession session) {
+        lazyInit(session);
+
+        EntityManager em = emf.createEntityManager();
+        em = PersistenceExceptionConverter.create(em);
+        session.getTransaction().enlist(new JpaKeycloakTransaction(em));
+        return new DefaultJpaConnectionProvider(em);
+    }
+
+    @Override
+    public void close() {
+        if (emf != null) {
+            emf.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit(KeycloakSession session) {
+        if (emf == null) {
+            synchronized (this) {
+                if (emf == null) {
+                    logger.debug("Initializing JPA connections");
+
+                    Connection connection = null;
+
+                    String unitName = config.get("unitName");
+                    String databaseSchema = config.get("databaseSchema");
+
+                    Map<String, Object> properties = new HashMap<String, Object>();
+
+                    // Only load config from keycloak-server.json if unitName is not specified
+                    if (unitName == null) {
+                        unitName = "keycloak-default";
+
+                        String dataSource = config.get("dataSource");
+                        if (dataSource != null) {
+                            if (config.getBoolean("jta", false)) {
+                                properties.put(AvailableSettings.JTA_DATASOURCE, dataSource);
+                            } else {
+                                properties.put(AvailableSettings.NON_JTA_DATASOURCE, dataSource);
+                            }
+                        } else {
+                            properties.put(AvailableSettings.JDBC_URL, config.get("url"));
+                            properties.put(AvailableSettings.JDBC_DRIVER, config.get("driver"));
+
+                            String user = config.get("user");
+                            if (user != null) {
+                                properties.put(AvailableSettings.JDBC_USER, user);
+                            }
+                            String password = config.get("password");
+                            if (password != null) {
+                                properties.put(AvailableSettings.JDBC_PASSWORD, password);
+                            }
+                        }
+
+                        String driverDialect = config.get("driverDialect");
+                        if (driverDialect != null && driverDialect.length() > 0) {
+                            properties.put("hibernate.dialect", driverDialect);
+                        }
+
+                        if (databaseSchema != null) {
+                            if (databaseSchema.equals("development-update")) {
+                                properties.put("hibernate.hbm2ddl.auto", "update");
+                                databaseSchema = null;
+                            } else if (databaseSchema.equals("development-validate")) {
+                                properties.put("hibernate.hbm2ddl.auto", "validate");
+                                databaseSchema = null;
+                            }
+                        }
+
+                        properties.put("hibernate.show_sql", config.getBoolean("showSql", false));
+                        properties.put("hibernate.format_sql", config.getBoolean("formatSql", true));
+                    }
+
+                    if (databaseSchema != null) {
+                        logger.trace("Updating database");
+
+                        JpaUpdaterProvider updater = session.getProvider(JpaUpdaterProvider.class);
+                        connection = getConnection();
+
+                        if (databaseSchema.equals("update")) {
+                            String currentVersion = null;
+                            try {
+                                ResultSet resultSet = connection.createStatement().executeQuery(updater.getCurrentVersionSql());
+                                if (resultSet.next()) {
+                                    currentVersion = resultSet.getString(1);
+                                }
+                            } catch (SQLException e) {
+                            }
+
+                            if (currentVersion == null || !JpaUpdaterProvider.LAST_VERSION.equals(currentVersion)) {
+                                updater.update(connection);
+                            } else {
+                                logger.debug("Database is up to date");
+                            }
+                        } else if (databaseSchema.equals("validate")) {
+                            updater.validate(connection);
+                        } else {
+                            throw new RuntimeException("Invalid value for databaseSchema: " + databaseSchema);
+                        }
+
+                        logger.trace("Database update completed");
+                    }
+
+                    logger.trace("Creating EntityManagerFactory");
+                    emf = Persistence.createEntityManagerFactory(unitName, properties);
+                    logger.trace("EntityManagerFactory created");
+
+                    // Close after creating EntityManagerFactory to prevent in-mem databases from closing
+                    if (connection != null) {
+                        try {
+                            connection.close();
+                        } catch (SQLException e) {
+                            logger.warn(e);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private Connection getConnection() {
+        try {
+            String dataSourceLookup = config.get("dataSource");
+            if (dataSourceLookup != null) {
+                DataSource dataSource = (DataSource) new InitialContext().lookup(dataSourceLookup);
+                return dataSource.getConnection();
+            } else {
+                Class.forName(config.get("driver"));
+                return DriverManager.getConnection(config.get("url"), config.get("user"), config.get("password"));
+            }
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to connect to database", e);
+        }
+    }
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProvider.java

@@ -0,0 +1,14 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProvider extends Provider {
+
+    EntityManager getEntityManager();
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProviderFactory extends ProviderFactory<JpaConnectionProvider> {
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionSpi.java

@@ -1,4 +1,4 @@
-package org.keycloak.authentication;
+package org.keycloak.connections.jpa;
 
 import org.keycloak.provider.Provider;
 import org.keycloak.provider.ProviderFactory;
@@ -7,21 +7,21 @@ import org.keycloak.provider.Spi;
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
-public class AuthenticationSpi implements Spi {
+public class JpaConnectionSpi implements Spi {
 
     @Override
     public String getName() {
-        return "authentication";
+        return "connectionsJpa";
     }
 
     @Override
     public Class<? extends Provider> getProviderClass() {
-        return AuthenticationProvider.class;
+        return JpaConnectionProvider.class;
     }
 
     @Override
     public Class<? extends ProviderFactory> getProviderFactoryClass() {
-        return AuthenticationProviderFactory.class;
+        return JpaConnectionProviderFactory.class;
     }
 
 }

connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaKeycloakTransaction.java

@@ -0,0 +1,53 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java

@@ -0,0 +1,48 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/updater/JpaUpdaterProvider.java

@@ -0,0 +1,22 @@
+package org.keycloak.connections.jpa.updater;
+
+import org.keycloak.provider.Provider;
+
+import java.sql.Connection;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaUpdaterProvider extends Provider {
+
+    public String FIRST_VERSION = "1.0.0.Final";
+
+    public String LAST_VERSION = "1.1.0.Beta1";
+
+    public String getCurrentVersionSql();
+
+    public void update(Connection connection);
+
+    public void validate(Connection connection);
+
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/updater/JpaUpdaterProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.jpa.updater;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaUpdaterProviderFactory extends ProviderFactory<JpaUpdaterProvider> {
+}

connections/jpa/src/main/java/org/keycloak/connections/jpa/updater/JpaUpdaterSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.connections.jpa.updater;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaUpdaterSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsJpaUpdater";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return JpaUpdaterProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return JpaUpdaterProviderFactory.class;
+    }
+
+}

connections/jpa/src/main/resources/META-INF/persistence.xml

@@ -2,40 +2,36 @@
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/persistence http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd"
     version="1.0">
-    <persistence-unit name="jpa-keycloak-identity-store" transaction-type="RESOURCE_LOCAL">
-        <jta-data-source>java:jboss/datasources/ExampleDS</jta-data-source>
+    <persistence-unit name="keycloak-default" transaction-type="RESOURCE_LOCAL">
         <class>org.keycloak.models.jpa.entities.ApplicationEntity</class>
         <class>org.keycloak.models.jpa.entities.CredentialEntity</class>
         <class>org.keycloak.models.jpa.entities.OAuthClientEntity</class>
         <class>org.keycloak.models.jpa.entities.RealmEntity</class>
+        <class>org.keycloak.models.jpa.entities.RealmAttributeEntity</class>
         <class>org.keycloak.models.jpa.entities.RequiredCredentialEntity</class>
-        <class>org.keycloak.models.jpa.entities.AuthenticationProviderEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserFederationProviderEntity</class>
         <class>org.keycloak.models.jpa.entities.RoleEntity</class>
         <class>org.keycloak.models.jpa.entities.SocialLinkEntity</class>
-        <class>org.keycloak.models.jpa.entities.AuthenticationLinkEntity</class>
         <class>org.keycloak.models.jpa.entities.UserEntity</class>
-        <class>org.keycloak.models.jpa.entities.UserSessionEntity</class>
-        <class>org.keycloak.models.jpa.entities.ClientUserSessionAssociationEntity</class>
-        <class>org.keycloak.models.jpa.entities.UsernameLoginFailureEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserRequiredActionEntity</class>
+        <class>org.keycloak.models.jpa.entities.UserAttributeEntity</class>
         <class>org.keycloak.models.jpa.entities.UserRoleMappingEntity</class>
         <class>org.keycloak.models.jpa.entities.ScopeMappingEntity</class>
 
-        <exclude-unlisted-classes>true</exclude-unlisted-classes>
+        <!-- JpaUserSessionProvider -->
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionRoleEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.ClientSessionNoteEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UserSessionEntity</class>
+        <class>org.keycloak.models.sessions.jpa.entities.UsernameLoginFailureEntity</class>
 
-        <properties>
-            <property name="hibernate.hbm2ddl.auto" value="update" />
-        </properties>
-    </persistence-unit>
-	
-    <persistence-unit name="jpa-keycloak-audit-store" transaction-type="RESOURCE_LOCAL">
-        <jta-data-source>java:jboss/datasources/ExampleDS</jta-data-source>
-        <class>org.keycloak.audit.jpa.EventEntity</class>
+        <!-- JpaAuditProvider -->
+        <class>org.keycloak.events.jpa.EventEntity</class>
 
         <exclude-unlisted-classes>true</exclude-unlisted-classes>
-
+        
         <properties>
-            <property name="hibernate.hbm2ddl.auto" value="update" />
+            <property name="jboss.as.jpa.managed" value="false"/>
         </properties>
     </persistence-unit>
-	
 </persistence>

connections/jpa/src/main/resources/META-INF/services/org.keycloak.connections.jpa.JpaConnectionProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory

connections/jpa/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1,2 @@
+org.keycloak.connections.jpa.JpaConnectionSpi
+org.keycloak.connections.jpa.updater.JpaUpdaterSpi

connections/mongo/pom.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.1.0.Beta2</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-mongo</artifactId>
+    <name>Keycloak Connections Mongo</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+</project>

connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionFactoryProvider.java

@@ -0,0 +1,163 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoClientOptions;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.connections.mongo.impl.context.TransactionMongoStoreInvocationContext;
+import org.keycloak.connections.mongo.updater.DefaultMongoUpdaterProvider;
+import org.keycloak.models.KeycloakSession;
+
+import java.lang.reflect.Method;
+import java.util.Collections;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionFactoryProvider implements MongoConnectionProviderFactory {
+
+    // TODO Make configurable
+    private String[] entities = new String[]{
+            "org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoUserEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity",
+            "org.keycloak.models.entities.RequiredCredentialEntity",
+            "org.keycloak.models.entities.CredentialEntity",
+            "org.keycloak.models.entities.SocialLinkEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUsernameLoginFailureEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUserSessionEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoClientSessionEntity",
+            "org.keycloak.models.entities.UserFederationProviderEntity"
+    };
+
+    private static final Logger logger = Logger.getLogger(DefaultMongoConnectionFactoryProvider.class);
+
+    private volatile MongoClient client;
+
+    private MongoStore mongoStore;
+    private DB db;
+    private Config.Scope config;
+
+    @Override
+    public MongoConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        TransactionMongoStoreInvocationContext invocationContext = new TransactionMongoStoreInvocationContext(mongoStore);
+        session.getTransaction().enlist(new MongoKeycloakTransaction(invocationContext));
+        return new DefaultMongoConnectionProvider(db, mongoStore, invocationContext);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (client == null) {
+            synchronized (this) {
+                if (client == null) {
+                    try {
+                        String host = config.get("host", ServerAddress.defaultHost());
+                        int port = config.getInt("port", ServerAddress.defaultPort());
+                        String dbName = config.get("db", "keycloak");
+
+                        String user = config.get("user");
+                        String password = config.get("password");
+
+                        MongoClientOptions clientOptions = getClientOptions();
+                        if (user != null && password != null) {
+                            MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                            client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential), clientOptions);
+                        } else {
+                            client = new MongoClient(new ServerAddress(host, port), clientOptions);
+                        }
+
+                        this.db = client.getDB(dbName);
+
+                        String databaseSchema = config.get("databaseSchema");
+                        if (databaseSchema != null) {
+                            if (databaseSchema.equals("update")) {
+                                new DefaultMongoUpdaterProvider().update(db);
+                            } else {
+                                throw new RuntimeException("Invalid value for databaseSchema: " + databaseSchema);
+                            }
+                        }
+
+                        this.mongoStore = new MongoStoreImpl(db, getManagedEntities());
+
+                        logger.debugv("Initialized mongo model. host: %s, port: %d, db: %s", host, port, dbName);
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                }
+            }
+        }
+    }
+
+    private Class[] getManagedEntities() throws ClassNotFoundException {
+       Class[] entityClasses = new Class[entities.length];
+        for (int i = 0; i < entities.length; i++) {
+            entityClasses[i] = Thread.currentThread().getContextClassLoader().loadClass(entities[i]);
+        }
+        return entityClasses;
+    }
+
+    @Override
+    public void close() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    protected MongoClientOptions getClientOptions() {
+        MongoClientOptions.Builder builder = MongoClientOptions.builder();
+        checkIntOption("connectionsPerHost", builder);
+        checkIntOption("threadsAllowedToBlockForConnectionMultiplier", builder);
+        checkIntOption("maxWaitTime", builder);
+        checkIntOption("connectTimeout", builder);
+        checkIntOption("socketTimeout", builder);
+        checkBooleanOption("socketKeepAlive", builder);
+        checkBooleanOption("autoConnectRetry", builder);
+        if (config.getLong("maxAutoConnectRetryTime") != null) {
+            builder.maxAutoConnectRetryTime(config.getLong("maxAutoConnectRetryTime"));
+        }
+        return builder.build();
+    }
+
+    protected void checkBooleanOption(String optionName, MongoClientOptions.Builder builder) {
+        Boolean val = config.getBoolean(optionName);
+        if (val != null) {
+            try {
+                Method m = MongoClientOptions.Builder.class.getMethod(optionName, boolean.class);
+                m.invoke(builder, val);
+            } catch (Exception e) {
+                throw new IllegalStateException("Problem configuring boolean option " + optionName + " for mongo client. Ensure you used correct value true or false and if this option is supported by mongo driver", e);
+            }
+        }
+    }
+
+    protected void checkIntOption(String optionName, MongoClientOptions.Builder builder) {
+        Integer val = config.getInt(optionName);
+        if (val != null) {
+            try {
+                Method m = MongoClientOptions.Builder.class.getMethod(optionName, int.class);
+                m.invoke(builder, val);
+            } catch (Exception e) {
+                throw new IllegalStateException("Problem configuring int option " + optionName + " for mongo client. Ensure you used correct value (number) and if this option is supported by mongo driver", e);
+            }
+        }
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionProvider.java

@@ -0,0 +1,41 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionProvider implements MongoConnectionProvider {
+
+    private DB db;
+    private MongoStore mongoStore;
+    private MongoStoreInvocationContext invocationContext;
+
+    public DefaultMongoConnectionProvider(DB db, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.db = db;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public DB getDB() {
+        return db;
+    }
+
+    @Override
+    public MongoStore getMongoStore() {
+        return mongoStore;
+    }
+
+    @Override
+    public MongoStoreInvocationContext getInvocationContext() {
+        return invocationContext;
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProvider.java

@@ -0,0 +1,19 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProvider extends Provider {
+
+    DB getDB();
+
+    MongoStore getMongoStore();
+
+    MongoStoreInvocationContext getInvocationContext();
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProviderFactory extends ProviderFactory<MongoConnectionProvider> {
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsMongo";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MongoConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MongoConnectionProviderFactory.class;
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoKeycloakTransaction.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.keycloak.adapters;
+package org.keycloak.connections.mongo;
 
 import com.mongodb.MongoException;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
 import org.keycloak.models.KeycloakTransaction;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -42,11 +42,13 @@ public class MongoKeycloakTransaction implements KeycloakTransaction {
         } catch (MongoException e) {
             throw MongoStoreImpl.convertException(e);
         }
+        started = false;
     }
 
     @Override
     public void rollback() {
         invocationContext.rollback();
+        started = false;
     }
 
     @Override

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoCollection.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Inherited;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoEntity.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 /**
  * Base interface for object, which is persisted in Mongo

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoField.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoIdentifiableEntity.java

@@ -1,6 +1,6 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * Entity with Id

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/MongoStore.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api;
+package org.keycloak.connections.mongo.api;
 
 import com.mongodb.DBObject;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 
 import java.util.List;
 
@@ -31,6 +31,10 @@ public interface MongoStore {
 
     <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);
 
+    <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context);
+
+    <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context);
+
     boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context);
 
     boolean removeEntity(Class<? extends MongoIdentifiableEntity> type, String id, MongoStoreInvocationContext context);
@@ -41,8 +45,4 @@ public interface MongoStore {
 
     <S> boolean pullItemFromList(MongoIdentifiableEntity entity, String listPropertyName, S itemToPull, MongoStoreInvocationContext context);
 
-    /**
-     * Completely remove all data from DB
-     */
-    void removeAllEntities();
 }

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/context/MongoStoreInvocationContext.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;
 
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
 
 /**
  * Context, which provides callback methods to be invoked by MongoStore

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/context/MongoTask.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.context;
+package org.keycloak.connections.mongo.api.context;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/Mapper.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 /**
  * SPI object to convert object from application type to database type and vice versa. Shouldn't be directly used by application.

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/MapperContext.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 import java.util.List;
 

connections/mongo/src/main/java/org/keycloak/connections/mongo/api/types/MapperRegistry.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.api.types;
+package org.keycloak.connections.mongo.api.types;
 
 import java.util.HashMap;
 import java.util.Map;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/EntityInfo.java

@@ -1,6 +1,5 @@
-package org.keycloak.models.mongo.impl;
+package org.keycloak.connections.mongo.impl;
 
-import org.keycloak.models.mongo.api.MongoEntity;
 import org.keycloak.models.utils.reflection.Property;
 
 import java.util.Collection;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.mongo.impl;
+package org.keycloak.connections.mongo.impl;
 
 import com.mongodb.BasicDBList;
 import com.mongodb.BasicDBObject;
@@ -8,31 +8,27 @@ import com.mongodb.DBCursor;
 import com.mongodb.DBObject;
 import com.mongodb.MongoException;
 import org.jboss.logging.Logger;
-import org.keycloak.models.ModelException;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoEntity;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.types.BasicDBListMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBObjectToMapMapper;
+import org.keycloak.connections.mongo.impl.types.EnumToStringMapper;
+import org.keycloak.connections.mongo.impl.types.ListMapper;
+import org.keycloak.connections.mongo.impl.types.MapMapper;
+import org.keycloak.connections.mongo.impl.types.MongoEntityMapper;
+import org.keycloak.connections.mongo.impl.types.SimpleMapper;
+import org.keycloak.connections.mongo.impl.types.StringToEnumMapper;
 import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoField;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.MongoIndexes;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.types.BasicDBListMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectMapper;
-import org.keycloak.models.mongo.impl.types.BasicDBObjectToMapMapper;
-import org.keycloak.models.mongo.impl.types.EnumToStringMapper;
-import org.keycloak.models.mongo.impl.types.ListMapper;
-import org.keycloak.models.mongo.impl.types.MapMapper;
-import org.keycloak.models.mongo.impl.types.MongoEntityMapper;
-import org.keycloak.models.mongo.impl.types.SimpleMapper;
-import org.keycloak.models.mongo.impl.types.StringToEnumMapper;
+import org.keycloak.models.ModelException;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.reflection.AnnotatedPropertyCriteria;
 import org.keycloak.models.utils.reflection.Property;
 import org.keycloak.models.utils.reflection.PropertyQueries;
 
@@ -41,7 +37,6 @@ import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
@@ -60,7 +55,7 @@ public class MongoStoreImpl implements MongoStore {
             new ConcurrentHashMap<Class<?>, EntityInfo>();
 
 
-    public MongoStoreImpl(DB database, boolean clearCollectionsOnStartup, Class<?>[] managedEntityTypes) {
+    public MongoStoreImpl(DB database, Class<?>[] managedEntityTypes) {
         this.database = database;
 
         mapperRegistry = new MapperRegistry();
@@ -89,13 +84,6 @@ public class MongoStoreImpl implements MongoStore {
             mapperRegistry.addAppObjectMapper(new MongoEntityMapper(this, mapperRegistry, type));
             mapperRegistry.addDBObjectMapper(new BasicDBObjectMapper(this, mapperRegistry, type));
         }
-
-        if (clearCollectionsOnStartup) {
-            // dropDatabase();
-            clearManagedCollections(managedEntityTypes);
-        }
-
-        initManagedCollections(managedEntityTypes);
     }
 
     protected void dropDatabase() {
@@ -103,63 +91,6 @@ public class MongoStoreImpl implements MongoStore {
         logger.info("Database " + this.database.getName() + " dropped in MongoDB");
     }
 
-    // Don't drop database, but just clear all data in managed collections (useful for export/import or during development)
-    protected void clearManagedCollections(Class<?>[] managedEntityTypes) {
-        for (Class<?> clazz : managedEntityTypes) {
-            DBCollection dbCollection = getDBCollectionForType(clazz);
-            if (dbCollection != null) {
-                dbCollection.remove(new BasicDBObject());
-                logger.debug("Collection " + dbCollection.getName() + " cleared from " + this.database.getName());
-            }
-        }
-    }
-
-    protected void initManagedCollections(Class<?>[] managedEntityTypes) {
-        for (Class<?> clazz : managedEntityTypes) {
-            EntityInfo entityInfo = getEntityInfo(clazz);
-            String dbCollectionName = entityInfo.getDbCollectionName();
-            if (dbCollectionName != null && !database.collectionExists(dbCollectionName)) {
-                DBCollection dbCollection = database.getCollection(dbCollectionName);
-
-                logger.debug("Created collection " + dbCollection.getName() + " in " + this.database.getName());
-
-                MongoIndex index = clazz.getAnnotation(MongoIndex.class);
-                if (index != null) {
-                    createIndex(dbCollection, index);
-                }
-
-                MongoIndexes indexes = clazz.getAnnotation(MongoIndexes.class);
-                if (indexes != null) {
-                    for (MongoIndex i : indexes.value()) {
-                        createIndex(dbCollection, i);
-                    }
-                }
-            }
-        }
-    }
-
-    protected void createIndex(DBCollection dbCollection, MongoIndex index) {
-        BasicDBObject fields = new BasicDBObject();
-        for (String f : index.fields()) {
-            fields.put(f, 1);
-        }
-
-        boolean unique = index.unique();
-        boolean sparse = index.sparse();
-
-        BasicDBObject options = new BasicDBObject();
-        if (unique) {
-            options.put("unique", unique);
-        }
-        if (sparse) {
-            options.put("sparse", sparse);
-        }
-
-        dbCollection.ensureIndex(fields, options);
-
-        logger.debug("Created index " + fields + "(options: " + options + ") on " + dbCollection.getName() + " in " + this.database.getName());
-    }
-
     @Override
     public void insertEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
         Class<? extends MongoEntity> clazz = entity.getClass();
@@ -283,6 +214,35 @@ public class MongoStoreImpl implements MongoStore {
         return convertCursor(type, cursor, context);
     }
 
+    @Override
+    public <T extends MongoIdentifiableEntity> List<T> loadEntities(Class<T> type, DBObject query, DBObject sort, int firstResult, int maxResults, MongoStoreInvocationContext context) {
+        // First we should execute all pending tasks before searching DB
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        DBCursor cursor = dbCollection.find(query);
+        if (firstResult != -1) {
+            cursor.skip(firstResult);
+        }
+        if (maxResults != -1) {
+            cursor.limit(maxResults);
+        }
+        if (sort != null) {
+            cursor.sort(sort);
+        }
+
+        return convertCursor(type, cursor, context);
+    }
+
+    public <T extends MongoIdentifiableEntity> int countEntities(Class<T> type, DBObject query, MongoStoreInvocationContext context) {
+        context.beforeDBSearch(type);
+
+        DBCollection dbCollection = getDBCollectionForType(type);
+        Long count = dbCollection.count(query);
+
+        // For now, assume that int is sufficient
+        return count.intValue();
+    }
 
     @Override
     public boolean removeEntity(MongoIdentifiableEntity entity, MongoStoreInvocationContext context) {
@@ -299,7 +259,7 @@ public class MongoStoreImpl implements MongoStore {
             DBCollection dbCollection = getDBCollectionForType(type);
             BasicDBObject dbQuery = new BasicDBObject("_id", id);
             dbCollection.remove(dbQuery);
-            logger.info("Entity of type: " + type + ", id: " + id + " removed from MongoDB.");
+            //logger.debugf("Entity of type: %s , id: %s removed from MongoDB.", type,  id);
 
             context.addRemovedEntity(found);
             return true;
@@ -315,7 +275,7 @@ public class MongoStoreImpl implements MongoStore {
         } else {
             DBCollection dbCollection = getDBCollectionForType(type);
             dbCollection.remove(query);
-            logger.info("Removed " + foundObjects.size() + " entities of type: " + type + ", query: " + query);
+            //logger.debug("Removed %d" + foundObjects.size() + " entities of type: " + type + ", query: " + query);
 
             for (MongoIdentifiableEntity found : foundObjects) {
                 context.addRemovedEntity(found);;
@@ -417,13 +377,6 @@ public class MongoStoreImpl implements MongoStore {
         }
     }
 
-    @Override
-    public void removeAllEntities() {
-        Set<Class<?>> managedTypes = this.entityInfoCache.keySet();
-        Class<? extends MongoEntity>[] arrayTemplate = (Class<? extends MongoEntity>[])new Class<?>[0];
-        this.clearManagedCollections(managedTypes.toArray(arrayTemplate));
-    }
-
     // Possibility to add user-defined mappers
     public void addAppObjectConverter(Mapper<?, ?> mapper) {
         mapperRegistry.addAppObjectMapper(mapper);

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/context/SimpleMongoStoreInvocationContext.java

@@ -1,10 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;
 
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
 
 /**
  * Context, which is not doing any postponing of tasks and does not cache anything

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/context/TransactionMongoStoreInvocationContext.java

@@ -1,4 +1,9 @@
-package org.keycloak.models.mongo.impl.context;
+package org.keycloak.connections.mongo.impl.context;
+
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.context.MongoTask;
 
 import java.util.HashMap;
 import java.util.HashSet;
@@ -6,11 +11,6 @@ import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
 
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
-import org.keycloak.models.mongo.api.context.MongoTask;
-
 /**
  * Invocation context, which has some very basic support for transactions, and is able to cache loaded objects.
  * It always execute all pending update tasks before start searching for other objects

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
 import java.util.ArrayList;
 import java.util.List;

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBObjectMapper.java

@@ -1,22 +1,21 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.models.utils.reflection.Property;
+import org.keycloak.models.utils.reflection.Types;
 
 import java.lang.reflect.ParameterizedType;
 import java.lang.reflect.Type;
 import java.util.ArrayList;
 import java.util.List;
 
-import com.mongodb.BasicDBObject;
-import org.jboss.logging.Logger;
-import org.keycloak.models.mongo.api.MongoEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
-import org.keycloak.models.utils.reflection.Property;
-import org.keycloak.models.utils.reflection.Types;
-
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBObjectToMapMapper.java

@@ -1,14 +1,14 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 import java.util.HashMap;
 import java.util.Map;
 
-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
- * For now, there is support just for convert to Map<String, String>
+ * For now, there is support just for convert to Map<String, simpleType>
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -18,10 +18,15 @@ public class BasicDBObjectToMapMapper implements Mapper<BasicDBObject, Map> {
     public Map convertObject(MapperContext<BasicDBObject, Map> context) {
         BasicDBObject dbObjectToConvert = context.getObjectToConvert();
 
-        HashMap<String, String> result = new HashMap<String, String>();
+        HashMap<String, Object> result = new HashMap<String, Object>();
         for (Map.Entry<String, Object> entry : dbObjectToConvert.entrySet()) {
             String key = entry.getKey();
-            String value = (String)entry.getValue();
+            Object value = entry.getValue();
+
+            // Workaround as manually inserted numbers into mongo may be treated as "Double"
+            if (value instanceof Double && context.getGenericTypes().get(1) == Integer.class) {
+                value = ((Double)value).intValue();
+            }
 
             if (key.contains(MapMapper.DOT_PLACEHOLDER)) {
                 key = key.replaceAll(MapMapper.DOT_PLACEHOLDER, ".");

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/EnumToStringMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java

@@ -1,9 +1,9 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBList;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
 import java.util.List;
 

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/MapMapper.java

@@ -1,14 +1,14 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
+
+import com.mongodb.BasicDBObject;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 import java.util.Map;
 import java.util.Set;
 
-import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-
 /**
- * For now, we support just convert from Map<String, String>
+ * For now, we support just convert from Map<String, simpleType>
  *
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -31,7 +31,7 @@ public class MapMapper<T extends Map> implements Mapper<T, BasicDBObject> {
         Set<Map.Entry> entries = objectToConvert.entrySet();
         for (Map.Entry entry : entries) {
             String key = (String)entry.getKey();
-            String value = (String)entry.getValue();
+            Object value = entry.getValue();
 
             if (key.contains(".")) {
                 key = key.replaceAll("\\.", DOT_PLACEHOLDER);

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/MongoEntityMapper.java

@@ -1,11 +1,12 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
 import com.mongodb.BasicDBObject;
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
-import org.keycloak.models.mongo.api.types.MapperRegistry;
-import org.keycloak.models.mongo.impl.MongoStoreImpl;
-import org.keycloak.models.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+import org.keycloak.connections.mongo.impl.EntityInfo;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
 import org.keycloak.models.utils.reflection.Property;
 
 import java.util.Collection;
@@ -38,7 +39,7 @@ public class MongoEntityMapper<T> implements Mapper<T, BasicDBObject> {
             String propName = property.getName();
 
             // Ignore "id" property
-            if (!"id".equals(propName)) {
+            if (!"id".equals(propName) || !(applicationObject instanceof MongoIdentifiableEntity)) {
                 Object propValue = property.getValue(applicationObject);
                 if (propValue != null) {
                     Object dbValue = propValue == null ? null : mapperRegistry.convertApplicationObjectToDBObject(propValue, Object.class);

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/SimpleMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * Just returns input

connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/StringToEnumMapper.java

@@ -1,7 +1,7 @@
-package org.keycloak.models.mongo.impl.types;
+package org.keycloak.connections.mongo.impl.types;
 
-import org.keycloak.models.mongo.api.types.Mapper;
-import org.keycloak.models.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/DefaultMongoUpdaterProvider.java

@@ -0,0 +1,103 @@
+package org.keycloak.connections.mongo.updater;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DB;
+import com.mongodb.DBCollection;
+import com.mongodb.DBCursor;
+import com.mongodb.DBObject;
+import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.updater.updates.Update;
+import org.keycloak.connections.mongo.updater.updates.Update1_0_0_Final;
+import org.keycloak.connections.mongo.updater.updates.Update1_1_0_Beta1;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoUpdaterProvider implements MongoUpdaterProvider {
+
+    public static final Logger log = Logger.getLogger(DefaultMongoUpdaterProvider.class);
+
+    public static final String CHANGE_LOG_COLLECTION = "databaseChangeLog";
+
+    private Class<? extends Update>[] updates = new Class[]{
+            Update1_0_0_Final.class,
+            Update1_1_0_Beta1.class
+    };
+
+    @Override
+    public void update(DB db) {
+        log.debug("Starting database update");
+        try {
+            boolean changeLogExists = db.collectionExists(CHANGE_LOG_COLLECTION);
+            boolean realmExists = db.collectionExists("realms");
+
+            DBCollection changeLog = db.getCollection(CHANGE_LOG_COLLECTION);
+
+            List<String> executed = new LinkedList<String>();
+            if (!changeLogExists && realmExists) {
+                Update1_0_0_Final u = new Update1_0_0_Final();
+                executed.add(u.getId());
+                createLog(changeLog, u, 1);
+            } else if (changeLogExists) {
+                DBCursor cursor = changeLog.find().sort(new BasicDBObject("orderExecuted", 1));
+                while (cursor.hasNext()) {
+                    executed.add((String) cursor.next().get("_id"));
+                }
+            }
+
+            List<Update> updatesToRun = new LinkedList<Update>();
+            for (Class<? extends Update> updateClass : updates) {
+                Update u = updateClass.newInstance();
+                if (!executed.contains(u.getId())) {
+                    updatesToRun.add(u);
+                }
+            }
+
+            if (!updatesToRun.isEmpty()) {
+                if (executed.isEmpty()) {
+                    log.info("Initializing database schema");
+                } else {
+                    if (log.isDebugEnabled()) {
+                        log.infov("Updating database from {0} to {1}", executed.get(executed.size() - 1), updatesToRun.get(updatesToRun.size() - 1).getId());
+                    } else {
+                        log.debugv("Updating database");
+                    }
+                }
+
+                int order = executed.size();
+                for (Update u : updatesToRun) {
+                    log.debugv("Executing updates for {0}", u.getId());
+
+                    u.setLog(log);
+                    u.setDb(db);
+                    u.update();
+
+                    createLog(changeLog, u, ++order);
+
+                    log.debugv("Completed updates for {0}", u.getId());
+                }
+            }
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to update database", e);
+        }
+        log.debug("Completed database update");
+    }
+
+    private void createLog(DBCollection changeLog, Update update, int orderExecuted) {
+        changeLog.insert(new BasicDBObject("_id", update.getId()).append("dateExecuted", new Date()).append("orderExecuted", orderExecuted));
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/DefaultMongoUpdaterProviderFactory.java

@@ -0,0 +1,29 @@
+package org.keycloak.connections.mongo.updater;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoUpdaterProviderFactory implements MongoUpdaterProviderFactory {
+
+    @Override
+    public MongoUpdaterProvider create(KeycloakSession session) {
+        return new DefaultMongoUpdaterProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/MongoUpdaterProvider.java

@@ -0,0 +1,13 @@
+package org.keycloak.connections.mongo.updater;
+
+import com.mongodb.DB;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoUpdaterProvider extends Provider {
+
+    public void update(DB db);
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/MongoUpdaterProviderFactory.java

@@ -0,0 +1,9 @@
+package org.keycloak.connections.mongo.updater;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoUpdaterProviderFactory extends ProviderFactory<MongoUpdaterProvider> {
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/MongoUpdaterSpi.java

@@ -0,0 +1,27 @@
+package org.keycloak.connections.mongo.updater;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoUpdaterSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsMongoUpdater";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MongoUpdaterProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MongoUpdaterProviderFactory.class;
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/updates/Update.java

@@ -0,0 +1,62 @@
+package org.keycloak.connections.mongo.updater.updates;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DB;
+import com.mongodb.DBCollection;
+import org.jboss.logging.Logger;
+
+import java.util.Arrays;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public abstract class Update {
+
+    protected DB db;
+
+    protected Logger log;
+
+    public abstract String getId();
+
+    public abstract void update() throws ClassNotFoundException;
+
+    protected DBCollection createCollection(String name) {
+        if (db.collectionExists(name)) {
+            throw new RuntimeException("Failed to create collection {0}: collection already exists");
+        }
+
+        DBCollection col = db.getCollection(name);
+        log.debugv("Created collection {0}", name);
+        return col;
+    }
+
+    protected void ensureIndex(String name, String field, boolean unique, boolean sparse) {
+        ensureIndex(name, new String[]{field}, unique, sparse);
+    }
+
+    protected void ensureIndex(String name, String[] fields, boolean unique, boolean sparse) {
+        DBCollection col = db.getCollection(name);
+
+        BasicDBObject o = new BasicDBObject();
+        for (String f : fields) {
+            o.append(f, 1);
+        }
+
+        col.ensureIndex(o, new BasicDBObject("unique", unique).append("sparse", sparse));
+        log.debugv("Created index {0}, fields={1}, unique={2}, sparse={3}", name, Arrays.toString(fields), unique, sparse);
+    }
+
+    protected void deleteEntries(String collection) {
+        db.getCollection(collection).remove(new BasicDBObject());
+        log.debugv("Deleted entries from {0}", collection);
+    }
+
+    public void setLog(Logger log) {
+        this.log = log;
+    }
+
+    public void setDb(DB db) {
+        this.db = db;
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/updates/Update1_0_0_Final.java

@@ -0,0 +1,44 @@
+package org.keycloak.connections.mongo.updater.updates;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBCollection;
+import org.keycloak.connections.mongo.updater.DefaultMongoUpdaterProvider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Update1_0_0_Final extends Update {
+
+    @Override
+    public String getId() {
+        return "1.0.0.Final";
+    }
+
+    @Override
+    public void update() throws ClassNotFoundException {
+        DBCollection realmsCollection = db.getCollection("realms");
+        realmsCollection.ensureIndex(new BasicDBObject("name", 1), new BasicDBObject("unique", true));
+
+        DefaultMongoUpdaterProvider.log.debugv("Created collection {0}", "realms");
+
+        createCollection("users");
+        ensureIndex("users", new String[] { "realmId", "username"}, true, false);
+        ensureIndex("users", "emailIndex", true, true);
+
+        createCollection("roles");
+        ensureIndex("roles", "nameIndex", true, false);
+
+        createCollection("applications");
+        ensureIndex("applications", new String[]{"realmId", "name"}, true, false);
+
+        createCollection("oauthClients");
+        ensureIndex("oauthClients", new String[] { "realmId", "name"}, true, false);
+
+        createCollection("userFailures");
+
+        createCollection("sessions");
+
+        createCollection("clientSessions");
+    }
+
+}

connections/mongo/src/main/java/org/keycloak/connections/mongo/updater/updates/Update1_1_0_Beta1.java

@@ -0,0 +1,45 @@
+package org.keycloak.connections.mongo.updater.updates;
+
+import com.mongodb.DBCollection;
+import com.mongodb.DBCursor;
+import com.mongodb.DBObject;
+import com.mongodb.QueryBuilder;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.util.Arrays;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Update1_1_0_Beta1 extends Update {
+
+    @Override
+    public String getId() {
+        return "1.1.0.Beta1";
+    }
+
+    @Override
+    public void update() {
+        deleteEntries("clientSessions");
+        deleteEntries("sessions");
+
+        addRealmCodeSecret();
+    }
+
+    private void addRealmCodeSecret() {
+        DBCollection realms = db.getCollection("realms");
+
+        DBObject query = new QueryBuilder()
+                .and("codeSecret").is(null).get();
+
+        DBCursor objects = realms.find(query);
+        while (objects.hasNext()) {
+            DBObject object = objects.next();
+            object.put("codeSecret", KeycloakModelUtils.generateCodeSecret());
+            realms.save(object);
+
+            log.debugv("Added realm.codeSecret, id={0}", object.get("id"));
+        }
+    }
+
+}

connections/mongo/src/main/resources/META-INF/services/org.keycloak.connections.mongo.MongoConnectionProviderFactory

@@ -0,0 +1 @@
+org.keycloak.connections.mongo.DefaultMongoConnectionFactoryProvider

connections/mongo/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1 @@
+org.keycloak.connections.mongo.MongoConnectionSpi