Version bump

KEYCLOAK-977 Use reflection to find constructor for JBossGenericPrincipal to support EAP 6.4
Conflicts: integration/as7-eap6/adapter/src/main/java/org/keycloak/adapters/as7/CatalinaSecurityContextHelper.java
2015-01-22 19:04:46 +01:00 · 2015-01-22 16:24:07 +01:00 · 2015-01-22 16:15:21 +01:00 · 2015-01-22 16:09:01 +01:00 · 2014-10-31 12:33:36 +01:00 · 2014-10-31 11:44:25 +01:00
230 changed files with 2072 additions and 882 deletions
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>
    <name>Connections Parent</name>
    <description/>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -1,12 +1,15 @@
 package org.keycloak.util;

 import java.net.URI;
+import java.util.regex.Pattern;

 /**
 * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
 */
 public class UriUtils {

+    private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w-]+(\\.[\\w-]+)*(:[\\d]{2,5})?");
+
    public static String getOrigin(URI uri) {
        return getOrigin(uri.toString());
    }
@@ -16,4 +19,8 @@ public class UriUtils {
        return u.substring(0, u.indexOf('/', 8));
    }

+    public static boolean isOrigin(String url) {
+        return originPattern.matcher(url).matches();
+    }
+
 }
@@ -0,0 +1,46 @@
+package org.keycloak.util;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UriUtilsTest {
+
+    @Test
+    public void testOrigins() {
+        assertValid("http://test");
+        assertValid("http://test:8080");
+        assertValid("https://test");
+        assertValid("http://test.com");
+        assertValid("https://test.com");
+        assertValid("https://test.com:8080");
+        assertValid("http://sub.test.com");
+        assertValid("https://sub.test.com");
+        assertValid("https://sub.test.com:8080");
+        assertValid("http://192.168.123.123");
+        assertValid("https://192.168.123.123");
+        assertValid("https://192.168.123.123:8080");
+        assertValid("https://sub-sub.test.com");
+        assertValid("https://sub.test-test.com");
+
+        assertInvalid("https://test/");
+        assertInvalid("{");
+        assertInvalid("https://{}");
+        assertInvalid("https://)");
+        assertInvalid("http://test:test");
+        assertInvalid("http://test:8080:8080");
+    }
+
+    public void assertValid(String origin) {
+        assertTrue(UriUtils.isOrigin(origin));
+    }
+
+    public void assertInvalid(String origin) {
+        assertFalse(UriUtils.isOrigin(origin));
+    }
+
+}
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -30,7 +30,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Distribution</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -31,6 +31,7 @@
                <!ENTITY UserFederation SYSTEM "modules/user-federation.xml">
                <!ENTITY ExportImport SYSTEM "modules/export-import.xml">
                <!ENTITY ServerCache SYSTEM "modules/cache.xml">
+                <!ENTITY SecurityVulnerabilities SYSTEM "modules/security-vulnerabilities.xml">
                ]>

 <book>
@@ -119,6 +120,7 @@ This one is short
    &UserFederation;
    &ExportImport;
    &ServerCache;
+    &SecurityVulnerabilities;
    &Migration;

 </book>
@@ -44,7 +44,7 @@
                <listitem>
                    <para>
                        For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
-                        This switch is for oauth clients that only use the  <link linkend='direct-access-grant'>Direct Access Grant</link>
+                        This switch is for oauth clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
@@ -0,0 +1,155 @@
+<chapter id="security_vulnerabilities">
+    <title>Security Vulnerabilities</title>
+    <para>
+        This chapter discusses possible security vulnerabilities Keycloak could have, how Keycloak mitigates those
+        vulnerabilities, and what steps you need to do to configure Keycloak to mitigate some vulnerabilities.  A good list
+        of potential vulnerabilities and what security implementations should do to mitigate them can be found in the
+        <ulink url="http://tools.ietf.org/html/rfc6819">OAuth 2.0 Thread Model</ulink> document put out by the IETF.  Many of those vulnerabilities are discussed here.
+    </para>
+    <section>
+        <title>SSL/HTTPS Requirement</title>
+        <para>
+            If you do not use SSL/HTTPS for all communication between the Keycloak auth server and the clients it secures
+            you will be very vulnerable to man in the middle attacks.  OAuth 2.0/OpenID Connect uses access tokens for
+            security.  Without SSL/HTTPS, attackers can sniff your network and obtain an access token.  Once they have an
+            access token they can do any operation that the token has been given permission for.
+        </para>
+        <para>
+            Keycloak has <link linkend="ssl_modes">three modes for SSL/HTTPS</link>.  SSL can be hard to set up, so out of the box, Keycloak allows
+            non-HTTPS communication over private IP addresses like localhost, 192.168.x.x, and other private IP addresses.
+            In production, you should make sure SSL is enabled and required across the board.
+        </para>
+        <para>
+            On the adapter/client side, Keycloak allows you to turn off the SSL trust manager.  The trust manager ensures
+            identity the client is talking to.  It checks the DNS domain name against the server's certificate.  In production
+            you should make sure that each of your client adapters is configured to use a truststore.  Otherwise you are vulnerable
+            to DNS man in the middle attacks.
+        </para>
+    </section>
+    <section>
+        <title>CSRF Attacks</title>
+        <para>
+            Cross-site request forgery (CSRF) is a web-based attack whereby HTTP
+            requests are transmitted from a user that the web site trusts or has
+            authenticated (e.g., via HTTP redirects or HTML forms).  Any site that uses
+            cookie based authentication is vulnerable for these types of attacks.  These attacks are mitigated
+            by matching a state cookie against a posted form or query parameter.
+        </para>
+        <para>
+            OAuth 2.0 login specification requires that a state cookie be used and matched against a transmitted state
+            parameter.  Keycloak fully implements this part of the specification so all logins are protected.
+        </para>
+        <para>
+            The Keycloak adminstration console is a pure Javascript/HTML5 application that makes REST calls to the
+            backend Keycloak admin API.  These calls all require bearer token authentication and are made via Javascript
+            Ajax calls.  CSRF does not apply here.  The admin REST API can also be configured to validate CORS origins
+            as well.
+        </para>
+        <para>
+            The only part of Keycloak that really falls into CSRF is the user account management pages.  To mitigate this
+            Keycloak sets a state cookie and also embeds the value of this state cookie within hidden form fields or
+            query parameters in action links.  This query or form parameter is checked against the state cookie to verify
+            that the call was made by the user.
+        </para>
+    </section>
+    <section>
+        <title>Clickjacking</title>
+        <para>
+            With clickjacking, a malicious site loads the target site in a
+            transparent iFrame overlaid on top of a set of dummy
+            buttons that are carefully constructed to be placed directly under
+            important buttons on the target site.  When a user clicks a visible
+            button, they are actually clicking a button (such as an "Authorize"
+            button) on the hidden page.  An attacker can steal a user's authentication credentials and
+            access their resources.
+        </para>
+        <para>
+            By default, every response by Keycloak sets some specific browser headers that can prevent this from happening
+            specifically <ulink url="http://tools.ietf.org/html/rfc7034">X-FRAME_OPTIONS</ulink> and <ulink url="http://www.w3.org/TR/CSP/">Content-Security-Policy</ulink>.  You
+            should take a look at both of these headers.  In the admin console you can specify the values these headers will
+            have.  By default, Keycloak only sets up a same-origin policy for iframes.
+        </para>
+    </section>
+    <section>
+        <title>Compromised Access Codes</title>
+        <para>
+            It would be very hard for an attacker to compromise Keycloak access codes.  Keycloak generates a cryptographically
+            strong random value for its access codes so it would be very hard to guess an access token.
+            An access code can only be turned into an access token once so it can't be replayed.  In the admin console
+            you can specify how long an access token is valid for.  This value should be really short.  Like a seconds.
+            Just long enough for the client to make the request to turn the code into an token.
+        </para>
+    </section>
+    <section>
+        <title>Compromised access and refresh tokens</title>
+        <para>
+            There's a few things you can do to mitigate access tokens and refresh tokens from being stolen.
+            Most importantly is to enforce SSL/HTTPS communication between Keycloak and its clients and applications.
+            Short lifespans (minutes) for access tokens allows Keycloak to check the validity of a refresh token.  Making
+            sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.
+        </para>
+        <para>
+            If an access token or refresh token is compromised, the first thing you should do is go to the admin console
+            and push a not-before revocation policy to all applications.  This will enforce that any tokens issued
+            prior to that date are now invalid.  You can also disable specific applications, clients, and users if you
+            feel that any one of those entities is completely compromised.
+        </para>
+    </section>
+    <section>
+        <title>Open redirectors</title>
+        <para>
+            An attacker could use the end-user authorization endpoint and the
+            redirect URI parameter to abuse the authorization server as an open
+            redirector.  An open redirector is an endpoint using a parameter to
+            automatically redirect a user agent to the location specified by the
+            parameter value without any validation.  An attacker could utilize a user's trust in an authorization
+            server to launch a phishing attack.
+        </para>
+        <para>
+            Keycloak requires that all registered applications and clients register at least one redirection uri pattern.
+            Any time a client asks Keycloak to perform a redirect (on login or logout for example), Keycloak will
+            check the redirect uri vs. the list of valid registered uri patterns.  It is important that clients and
+            applications register as specific a URI pattern as possible to mitigate open redirector attacks.
+        </para>
+    </section>
+    <section>
+        <title>Password guess: brute force attacks</title>
+        <para>
+            A brute force attack happens when an attacker is trying to guess a user's password.  Keycloak has some
+            limited brute force detection capabilities.  If turned on, a user account will be temporarily disabled
+            if a threshold of login failures is reached.  The downside of this is that this makes Keycloak vulnerable
+            to denial of service attacks.  Eventually we will expand this functionality to take client IP address into
+            account when deciding whether to block a user.
+        </para>
+        <para>
+            Another thing you can do to prevent password guessing is to point a tool like <ulink url="http://fail2ban.org">Fail2Ban</ulink> to the Keycloak
+            server's log file.  Keycloak logs every login failure and client IP address that had the failure.
+        </para>
+        <para>
+            In the admin console, per realm, you can set up a password policy to enforce that users pick hard to guess passwords.
+        </para>
+        <para>
+            Finally, the best way to mitigate against brute force attacks is to require user to set up a one-time-password (OTP).
+        </para>
+    </section>
+    <section>
+        <title>Password database compromised</title>
+        <para>
+            Keycloak does not store passwords in raw text.  It stores a hash of them.  Because of performance reasons,
+            Keycloak only hashes passwords once.  While a human could probably never crack a hashed password, it is very
+            possible that a computer could.  The security community suggests around 20,000 (yes thousand!) hashing iterations
+            to be done to each password.  This number grows every year due to increasing computing power (It was 1000 12 years ago).
+            The problem with this is that password hashing is a huge performance hit as each login would require the entered
+            password to be hashed that many times and compared to the stored hash.  So, its up to the admin to configure the
+            password hash iterations.  This can be done in the admin console password policy configuration.  Again, the default
+            value is 1 as we thought it might be more important for Keycloak to scale out of the box.  There's a lot of
+            other measures admins can do to protect their password databases.
+        </para>
+    </section>
+    <section>
+        <title>SQL Injection attacks</title>
+        <para>
+            At this point in time, there is no knowledge of any SQL injection vulnerabilities in Keycloak
+        </para>
+    </section>
+</chapter>
@@ -404,7 +404,7 @@ keycloak-war-dist-all-&project.version;/
 ]]>
 </programlisting>
        </section>
-        <section>
+        <section id="ssl_modes">
            <title>SSL/HTTPS Requirement/Modes</title>
            <warning>
                <para>
@@ -625,29 +625,74 @@ keycloak-war-dist-all-&project.version;/
                    <literal>X-Forwarded-Proto</literal> headers on the requests made to Keycloak. Next you need to enable
                    <literal>proxy-address-forwarding</literal> on the Keycloak http connector. Assuming that your reverse
                    proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to.
-                    This is done by editing <literal>standalone/configuration/standalone.xml</literal>.
                </para>
-                First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to the <literal>http-listener</literal>
-                element:
-                <para>
+
+                <section>
+                    <title>WildFly</title>
+
+                    <para>
+                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
+                    </para>
+
+                    <para>
+                        First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to
+                        the <literal>http-listener</literal> element:
 <programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:undertow:1.1">
    ...
-    <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
+    <http-listener name="default" socket-binding="http"
+        proxy-address-forwarding="true" redirect-socket="proxy-https"/>
    ...
 </subsystem>
 ]]></programlisting>
-                Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
+                    </para>
+                    <para>
+                        Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
 <programlisting><![CDATA[
-<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
+<socket-binding-group name="standard-sockets" default-interface="public"
+    port-offset="${jboss.socket.binding.port-offset:0}">
    ...
    <socket-binding name="proxy-https" port="443"/>
    ...
 </socket-binding-group>
 ]]></programlisting>
-                </para>
-                <para>
-                    Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
-                </para>
+                    </para>
+                    <para>
+                        Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
+                    </para>
+                </section>
+
+                <section>
+                    <title>AS7/EAP</title>
+
+                    <para>
+                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
+                    </para>
+
+                    <para>
+                        You need to add <literal>redirect-port</literal> to http <literal>connector</literal> element and
+                        add the <literal>RemoteIpValve</literal> valve:
+<programlisting><![CDATA[
+<subsystem xmlns="urn:jboss:domain:web:1.5"
+    default-virtual-server="default-host" native="false">
+    <connector name="http" protocol="HTTP/1.1" scheme="http"
+        socket-binding="http"
+        redirect-port="443"/>
+    <virtual-server name="default-host" enable-welcome-root="true">
+        <alias name="localhost"/>
+        <alias name="example.com"/>
+    </virtual-server>
+    <valve name="remoteipvalve" module="org.jboss.as.web"
+        class-name="org.apache.catalina.valves.RemoteIpValve">
+        <param param-name="protocolHeader" param-value="x-forwarded-proto"/>
+    </valve>
+</subsystem>
+]]></programlisting>
+                    </para>
+
+
+
+                </section>
+
            </section>

            <section>
@@ -6,12 +6,38 @@
        and feel of end-user facing pages so they can be integrated with your brand and applications.
    </para>

+    <section>
+        <title>Theme types</title>
+        <para>
+            There are several types of themes in Keycloak:
+            <itemizedlist>
+                <listitem>Account - Account management</listitem>
+                <listitem>Admin - Admin console</listitem>
+                <listitem>Common - Shared resources for themes</listitem>
+                <listitem>Email - Emails</listitem>
+                <listitem>Login - Login forms</listitem>
+                <listitem>Welcome - Welcome pages</listitem>
+            </itemizedlist>
+        </para>
+    </section>
+
    <section>
        <title>Configure theme</title>
        <para>
-            To configure the theme used by a realm open the <literal>Keycloak Admin Console</literal>, select your realm
+            All theme types, except welcome, is configured through <literal>Keycloak Admin Console</literal>. To change
+            the theme used for a realm open the open the <literal>Keycloak Admin Console</literal>, select your realm
            from the drop-down box in the top left corner. Under <literal>Settings</literal> click on <literal>Theme</literal>.
        </para>
+        <para>
+            To change the welcome theme you need to edit <literal>standalone/configuration/keycloak-server.json</literal>
+            and add <literal>welcomeTheme</literal> to the theme element, for example:
+<programlisting>
+"theme": {
+    ...
+    "welcomeTheme": "custom-theme"
+}
+</programlisting>
+        </para>
    </section>

    <section>
@@ -25,26 +51,15 @@

    <section>
        <title>Creating a theme</title>
-        <para>
-            There are several types of themes in Keycloak:
-            <itemizedlist>
-                <listitem>Account - Account management</listitem>
-                <listitem>Admin - Admin console</listitem>
-                <listitem>Common - Shared resources for themes</listitem>
-                <listitem>Email - Emails</listitem>
-                <listitem>Login - Login forms</listitem>
-            </itemizedlist>
-        </para>
-
        <para>
            A theme consists of:
            <itemizedlist>
-                <listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
-                <listitem><para>Stylesheets</para></listitem>
-                <listitem><para>Scripts</para></listitem>
-                <listitem><para>Images</para></listitem>
-                <listitem><para>Message bundles</para></listitem>
-                <listitem><para>Theme properties</para></listitem>
+                <listitem><ulink url="http://freemarker.org">FreeMarker</ulink> templates</listitem>
+                <listitem>Stylesheets</listitem>
+                <listitem>Scripts</listitem>
+                <listitem>Images</listitem>
+                <listitem>Message bundles</listitem>
+                <listitem>Theme properties</listitem>
            </itemizedlist>
        </para>
        <para>
@@ -132,10 +147,9 @@
        <section>
            <title>Theme SPI</title>
            <para>
-                The Theme SPI allows creating different mechanisms to providing themes for the default FreeMarker based
+                The Theme SPI allows creating different mechanisms to load themes for the default FreeMarker based
                implementations of login forms and account management. To create a theme provider you will need to implement
-                <literal>org.keycloak.freemarker.ThemeProvider</literal> and <literal>org.keycloak.freemarker.Theme</literal> in
-                <literal>forms/common-freemarker</literal>.
+                <literal>org.keycloak.freemarker.ThemeProviderFactory</literal> and <literal>org.keycloak.freemarker.ThemeProvider</literal>.
            </para>
            <para>
                Keycloak comes with two theme providers, one that loads themes from the classpath (used by default themes)
@@ -149,12 +163,15 @@
            <para>
                The Account SPI allows implementing the account management pages using whatever web framework or templating
                engine you want. To create an Account provider implement <literal>org.keycloak.account.AccountProviderFactory</literal>
-                and <literal>org.keycloak.account.AccountProvider</literal> in <literal>forms/account-api</literal>.
+                and <literal>org.keycloak.account.AccountProvider</literal>.
            </para>
            <para>
-                Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-&project.version;.jar</literal>
-                or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
+                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
+<programlisting>
+"account": {
+    "provider": "custom-provider"
+}
+</programlisting>
            </para>
        </section>
        <section>
@@ -165,9 +182,12 @@
                and <literal>org.keycloak.login.LoginFormsProvider</literal> in <literal>forms/login-api</literal>.
            </para>
            <para>
-                Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-&project.version;.jar</literal>
-                or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
+                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
+<programlisting>
+"login": {
+    "provider": "custom-provider"
+}
+</programlisting>
            </para>
        </section>
    </section>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -35,12 +35,6 @@
            }
        ]
    },
-    "roleMappings": [
-        {
-            "username": "user",
-            "roles": ["user"]
-        }
-    ],
    "scopeMappings": [
        {
            "client": "cordova",
@@ -52,17 +46,10 @@
            "name": "cordova",
            "enabled": true,
            "publicClient": true,
-            "redirectUris": []
+            "redirectUris": ["http://localhost"],
+            "webOrigins": ["localhost"]
        }
    ],
-    "applicationRoleMappings": {
-        "account": [
-            {
-                "username": "user",
-                "roles": ["view-profile", "manage-account"]
-            }
-        ]
-    },
    "applicationScopeMappings": {
        "account": [
            {
@@ -10,5 +10,5 @@

    <gap:plugin name="org.apache.cordova.inappbrowser" />

-    <access origin="http://*"/>
+    <access origin="*"/>
 </widget>
@@ -28,7 +28,7 @@
        }

        document.addEventListener("deviceready", function() {
-            keycloak.init({ onLoad: 'check-sso' });
+            keycloak.init({ onLoad: 'check-sso' }).success(updateState);
        }, false);
    </script>
 </head>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -112,7 +112,7 @@ Next thing you have to do is import the test realm for the demo.  Clicking on th
 create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
 create a new admin password before you can go to the create realm page.

-[http://localhost:8080/auth/admin/index.html#/create/realm](http://localhost:8080/auth/admin/index.html#/create/realm)
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)

 Import the testrealm.json file that is in the preconfigured-demo/ example directory.

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath> 
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Listener System.out Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Store In-Mem Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Properties Authentication Provider Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Provider Examples</name>
@@ -12,8 +12,22 @@ To use the theme copy `login/sunrise` to `standalone/configuration/themes/login/
 Change Logo Theme
 -----------------

-Example themes for login forms, account management and admin console that changes the Keycloak logo. 
+Example themes for login forms, account management, admin console and welcome pages that changes the Keycloak logo.

-To use the themes copy `account/logo-example` to `standalone/configuration/themes/account/`, `login/logo-example` to `standalone/configuration/themes/login/` and `admin/logo-example` to `standalone/configuration/themes/admin/`. Open the admin console, select your realm, click on `Theme`. In the dropdowns for `Login Theme`, `Account Theme` and `Admin Console Theme` select `logo-example`. Click `Save` and login to the realm to see the new theme in action. 
+To use the themes copy:
+
+* `account/logo-example` to `standalone/configuration/themes/account/`
+* `login/logo-example` to `standalone/configuration/themes/login/`
+* `admin/logo-example` to `standalone/configuration/themes/admin/`
+* `welcome/logo-example` to `standalone/configuration/themes/welcome/`
+
+Open the admin console, select your realm, click on `Theme`. In the dropdowns for `Login Theme`, `Account Theme` and `Admin Console Theme` select `logo-example`. Click `Save` and login to the realm to see the new theme in action.
+
+To change the theme for the welcome pages open `standalone/configuration/keycloak-server.json` find the config for `theme` and add 'welcomeTheme':
+
+    "theme": {
+        ...
+        "welcomeTheme": "logo-example"
+    },

 One thing to note is that to change the admin console for the master admin console (`/auth/admin`) you need to change the theme for the master realm. Changing the admin console theme for any other realms will only change the admin console for that specific realm (for example `/auth/admin/myrealm/console`).
@@ -0,0 +1,50 @@
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+    <title>Welcome to Keycloak</title>
+    <link rel="shortcut icon" href="welcome-content/favicon.ico" type="image/x-icon">
+    <link rel="StyleSheet" href="welcome-content/keycloak.css" type="text/css">
+</head>
+
+<body>
+<div class="wrapper">
+    <div class="content">
+        <div class="logo">
+                <img src="welcome-content/red-hat-logo.png" alt="Red Hat" border="0" />
+        </div>
+        <h1>Welcome to Keycloak</h1>
+
+        <h3>Your Keycloak is running.</h3>
+
+        <p><a href="http://www.keycloak.org/docs">Documentation</a> | <a href="admin/">Administration Console</a> </p>
+
+        <p><a href="http://www.keycloak.org">Keycloak Project</a> |
+            <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">Mailing List</a> |
+            <a href="https://issues.jboss.org/browse/KEYCLOAK">Report an issue</a></p>
+        <p class="logos"><a href="http://www.jboss.org"><img src="welcome-content/jboss_community.png" alt="JBoss and JBoss Community" width="254" height="31" border="0"></a></p>
+    </div>
+</div>
+</body>
+</html>
@@ -0,0 +1 @@
+parent=keycloak
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -45,7 +45,7 @@ import java.util.Set;
 public class ExportUtils {

    public static RealmRepresentation exportRealm(KeycloakSession session, RealmModel realm, boolean includeUsers) {
-        RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm);
+        RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm, true);

        // Audit
        rep.setEventsEnabled(realm.isEventsEnabled());
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0-final</version>
+        <version>1.0.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -6,6 +6,7 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.provider.Provider;

+import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
 import java.util.List;
@@ -27,6 +28,8 @@ public interface AccountProvider extends Provider {

    AccountProvider setUser(UserModel user);

+    AccountProvider setProfileFormData(MultivaluedMap<String, String> formData);
+
    AccountProvider setStatus(Response.Status status);

    AccountProvider setRealm(RealmModel realm);
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -25,6 +25,7 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;

 import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
@@ -43,6 +44,7 @@ public class FreeMarkerAccountProvider implements AccountProvider {
    private static final Logger logger = Logger.getLogger(FreeMarkerAccountProvider.class);

    private UserModel user;
+    private MultivaluedMap<String, String> profileFormData;
    private Response.Status status = Response.Status.OK;
    private RealmModel realm;
    private String[] referrer;
@@ -126,7 +128,7 @@ public class FreeMarkerAccountProvider implements AccountProvider {

        switch (page) {
            case ACCOUNT:
-                attributes.put("account", new AccountBean(user));
+                attributes.put("account", new AccountBean(user, profileFormData));
                break;
            case TOTP:
                attributes.put("totp", new TotpBean(user, baseUri));
@@ -187,6 +189,12 @@ public class FreeMarkerAccountProvider implements AccountProvider {
        return this;
    }

+    @Override
+    public AccountProvider setProfileFormData(MultivaluedMap<String, String> formData) {
+        this.profileFormData = formData;
+        return this;
+    }
+
    @Override
    public AccountProvider setRealm(RealmModel realm) {
        this.realm = realm;
@@ -1,5 +1,7 @@
 package org.keycloak.account.freemarker.model;

+import javax.ws.rs.core.MultivaluedMap;
+
 import org.keycloak.models.UserModel;

 /**
@@ -7,18 +9,20 @@ import org.keycloak.models.UserModel;
 */
 public class AccountBean {

-    private UserModel user;
+    private final UserModel user;
+    private final MultivaluedMap<String, String> profileFormData;

-    public AccountBean(UserModel user) {
+    public AccountBean(UserModel user, MultivaluedMap<String, String> profileFormData) {
        this.user = user;
+        this.profileFormData = profileFormData;
    }

    public String getFirstName() {
-        return user.getFirstName();
+        return profileFormData != null ?  profileFormData.getFirst("firstName") : user.getFirstName();
    }

    public String getLastName() {
-        return user.getLastName();
+        return profileFormData != null ?  profileFormData.getFirst("lastName") :user.getLastName();
    }

    public String getUsername() {
@@ -26,7 +30,7 @@ public class AccountBean {
    }

    public String getEmail() {
-        return user.getEmail();
+        return profileFormData != null ?  profileFormData.getFirst("email") :user.getEmail();
    }

 }
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -1,5 +1,6 @@
 package org.keycloak.freemarker;

+import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;

@@ -21,17 +22,17 @@ import java.util.concurrent.ConcurrentHashMap;
 */
 public class ExtendingThemeManager implements ThemeProvider {

+    private static final Logger log = Logger.getLogger(ExtendingThemeManager.class);
+
    private final KeycloakSession session;
    private final ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache;
    private List<ThemeProvider> providers;
    private String defaultTheme;
-    private int staticMaxAge;

    public ExtendingThemeManager(KeycloakSession session, ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache) {
        this.session = session;
        this.themeCache = themeCache;
        this.defaultTheme = Config.scope("theme").get("default", "keycloak");
-        this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge", -1);
    }

    private List<ThemeProvider> getProviders() {
@@ -57,10 +58,6 @@ public class ExtendingThemeManager implements ThemeProvider {
        return providers;
    }

-    public int getStaticMaxAge() {
-        return staticMaxAge;
-    }
-
    @Override
    public int getProviderPriority() {
        return 0;
@@ -77,7 +74,13 @@ public class ExtendingThemeManager implements ThemeProvider {
            Theme theme = themeCache.get(key);
            if (theme == null) {
                theme = loadTheme(name, type);
-                if (themeCache.putIfAbsent(key, theme) != null) {
+                if (theme == null) {
+                    theme = loadTheme("keycloak", type);
+                    if (theme == null) {
+                        theme = loadTheme("base", type);
+                    }
+                    log.errorv("Failed to find {0} theme {1}, using built-in themes", type, name);
+                } else if (themeCache.putIfAbsent(key, theme) != null) {
                    theme = themeCache.get(key);
                }
            }
@@ -89,7 +92,7 @@ public class ExtendingThemeManager implements ThemeProvider {

    private Theme loadTheme(String name, Theme.Type type) throws IOException {
        Theme theme = findTheme(name, type);
-        if (theme.getParentName() != null) {
+        if (theme != null && theme.getParentName() != null) {
            List<Theme> themes = new LinkedList<Theme>();
            themes.add(theme);

@@ -144,11 +147,11 @@ public class ExtendingThemeManager implements ThemeProvider {
                try {
                    return p.getTheme(name, type);
                } catch (IOException e) {
-                    throw new RuntimeException("Failed to create " + type.toString().toLowerCase() + " theme", e);
+                    log.errorv(e, p.getClass() + " failed to load theme, type={0}, name={1}", type, name);
                }
            }
        }
-        throw new RuntimeException(type.toString().toLowerCase() + " theme '" + name + "' not found");
+        return null;
    }

    public static class ExtendingTheme implements Theme {
@@ -10,7 +10,7 @@ import java.util.Properties;
 */
 public interface Theme {

-    public enum Type { LOGIN, ACCOUNT, ADMIN, EMAIL, COMMON };
+    public enum Type { LOGIN, ACCOUNT, ADMIN, EMAIL, WELCOME, COMMON };

    public String getName();

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0-final</version>
+		<version>1.0.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,6 +21,7 @@ public class DefaultKeycloakThemeProvider implements ThemeProvider {
    private static Set<String> LOGIN_THEMES = new HashSet<String>();
    private static Set<String> ADMIN_THEMES = new HashSet<String>();
    private static Set<String> EMAIL_THEMES = new HashSet<String>();
+    private static Set<String> WELCOME_THEMES = new HashSet<String>();
    private static Set<String> COMMON_THEMES = new HashSet<String>();

    static {
@@ -28,6 +29,7 @@ public class DefaultKeycloakThemeProvider implements ThemeProvider {
        Collections.addAll(LOGIN_THEMES, BASE, PATTERNFLY, KEYCLOAK);
        Collections.addAll(ADMIN_THEMES, BASE, PATTERNFLY, KEYCLOAK);
        Collections.addAll(EMAIL_THEMES, KEYCLOAK);
+        Collections.addAll(WELCOME_THEMES, KEYCLOAK);
        Collections.addAll(COMMON_THEMES, KEYCLOAK);
    }

@@ -56,6 +58,8 @@ public class DefaultKeycloakThemeProvider implements ThemeProvider {
                return ADMIN_THEMES;
            case EMAIL:
                return EMAIL_THEMES;
+            case WELCOME:
+                return WELCOME_THEMES;
            case COMMON:
                return COMMON_THEMES;
            default:
@@ -20,7 +20,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${account.username!''}"/>
+                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${(account.username!'')?html}"/>
            </div>
        </div>

@@ -30,7 +30,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="email" name="email" autofocus value="${account.email!''}"/>
+                <input type="text" class="form-control" id="email" name="email" autofocus value="${(account.email!'')?html}"/>
            </div>
        </div>

@@ -41,7 +41,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="lastName" name="lastName" value="${account.lastName!''}"/>
+                <input type="text" class="form-control" id="lastName" name="lastName" value="${(account.lastName!'')?html}"/>
            </div>
        </div>

@@ -51,7 +51,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="firstName" name="firstName" value="${account.firstName!''}"/>
+                <input type="text" class="form-control" id="firstName" name="firstName" value="${(account.firstName!'')?html}"/>
            </div>
        </div>

@@ -10,6 +10,7 @@ successHeader=Success!
 username=Username

 missingFirstName=Please specify first name
+invalidEmail=Invalid email address
 missingLastName=Please specify last name
 missingEmail=Please specify email
 missingPassword=Please specify password.
@@ -37,4 +38,6 @@ socialRedirectError=Failed to redirect to social provider
 socialProviderRemoved=Social provider removed successfully

 accountDisabled=Account is disabled, contact admin\
-accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
+accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
+
+logOutAllSessions=Log out all sessions
@@ -42,6 +42,6 @@

    </table>

-    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">Logout all sessions</a>
+    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">${rb.logOutAllSessions}</a>

-</@layout.mainLayout>
+</@layout.mainLayout>
@@ -71,6 +71,7 @@
            <span>Loading...</span>
        </div>
    </div>
+    <div id="serverInfo">Keycloak {{serverInfo.version}}</div>
 </div>

 </body>
@@ -1121,6 +1121,24 @@ module.directive('kcNavigation', function ($compile, Notifications) {
    }
 });

+module.directive('kcNavigationApplication', function () {
+    return {
+        scope: true,
+        restrict: 'E',
+        replace: true,
+        templateUrl: 'templates/kc-navigation-application.html',
+    }
+});
+
+module.directive('kcNavigationOauthClient', function () {
+    return {
+        scope: true,
+        restrict: 'E',
+        replace: true,
+        templateUrl: 'templates/kc-navigation-oauth-client.html',
+    }
+});
+
 /*
 *  Used to select the element (invoke $(elem).select()) on specified action list.
 *  Usages kc-select-action="click mouseover"
@@ -246,7 +246,6 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
        }
    } else {
        $scope.application = { enabled: true };
-        $scope.application.webOrigins = [];
        $scope.application.redirectUris = [];
        $scope.accessType = $scope.accessTypes[0];
    }
@@ -296,10 +295,6 @@ module.controller('ApplicationDetailCtrl', function($scope, realm, application,
            Notifications.error("You must specify at least one redirect uri");
        } else {
            if ($scope.create) {
-                if ($scope.application.webOrigins.length == 0) {
-                    // let rest api put in default webOrigins
-                    $scope.application.webOrigins = null;
-                }
                Application.save({
                    realm: realm.realm,
                    application: ''
@@ -1,10 +1,11 @@
-module.controller('GlobalCtrl', function($scope, $http, Auth, WhoAmI, Current, $location, Notifications) {
+module.controller('GlobalCtrl', function($scope, $http, Auth, WhoAmI, Current, $location, Notifications, ServerInfo) {
    $scope.addMessage = function() {
        Notifications.success("test");
    };

    $scope.authUrl = authUrl;
    $scope.auth = Auth;
+    $scope.serverInfo = ServerInfo.get();

    WhoAmI.get(function (data) {
        Auth.user = data;
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,16 +1,7 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">

-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-show="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,16 +1,7 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">

-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,16 +1,7 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">

-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li data-ng-show="!application.bearerOnly"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,15 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}">Settings</a></li>
-        <li data-ng-show="!application.bearerOnly && !application.publicClient"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/roles">Roles</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/revocation">Revocation</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/sessions">Sessions</a></li>
-        <li><a href="#/realms/{{realm.realm}}/applications/{{application.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-application></kc-navigation-application>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/applications">Applications</a></li>
@@ -1,13 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/credentials">Credentials</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/revocation">Revocation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-oauth-client></kc-navigation-oauth-client>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
@@ -1,13 +1,6 @@
 <div class="bs-sidebar col-sm-3" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-sm-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}">Settings</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/revocation">Revocation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-oauth-client></kc-navigation-oauth-client>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
@@ -1,13 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf" data-ng-show="!create">
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/revocation">Revocation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-oauth-client></kc-navigation-oauth-client>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
@@ -1,13 +1,6 @@
 <div class="bs-sidebar col-sm-3" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/scope-mappings">Scope</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/revocation">Revocation</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-oauth-client></kc-navigation-oauth-client>
    <div id="content">
        <ol class="breadcrumb" data-ng-hide="create">
            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
@@ -1,13 +1,6 @@
 <div class="bs-sidebar col-md-3 clearfix" data-ng-include data-src="'partials/realm-menu.html'"></div>
 <div id="content-area" class="col-md-9" role="main">
-    <ul class="nav nav-tabs nav-tabs-pf"  data-ng-show="!create">
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}">Settings</a></li>
-        <li data-ng-show="!oauth.publicClient"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/credentials">Credentials</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/claims">Claims</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/scope-mappings">Scope</a></li>
-        <li class="active"><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/revocation">Revocation</a></li>
-        <li><a href="#/realms/{{realm.realm}}/oauth-clients/{{oauth.name}}/installation">Installation</a></li>
-    </ul>
+    <kc-navigation-oauth-client></kc-navigation-oauth-client>
    <div id="content">
        <ol class="breadcrumb">
            <li><a href="#/realms/{{realm.realm}}/oauth-clients">OAuth Clients</a></li>
Author	SHA1	Message	Date
Stian Thorgersen	3b071b83aa	Version bump	2015-01-22 19:04:46 +01:00
Stian Thorgersen	eef6e94923	KEYCLOAK-977 Use reflection to find constructor for JBossGenericPrincipal to support EAP 6.4 Conflicts: integration/as7-eap6/adapter/src/main/java/org/keycloak/adapters/as7/CatalinaSecurityContextHelper.java	2015-01-22 16:24:07 +01:00
Stian Thorgersen	f6d50245ac	KEYCLOAK-820 Don't expose realm private key through admin endpoints Conflicts: model/api/src/main/java/org/keycloak/models/utils/ModelToRepresentation.java	2015-01-22 16:15:21 +01:00
Stian Thorgersen	f3940bf78c	Fix broken symbol	2015-01-22 16:09:01 +01:00
Stian Thorgersen	62bcf17a1e	Merge pull request #825 from matzew/ReducingLogLevel setting 'Bearer role' loglevel to debug	2014-10-31 12:33:36 +01:00
Matthias Wessendorf	44f9b28618	setting 'Bearer role' loglevel to debug	2014-10-31 11:44:25 +01:00
Stian Thorgersen	9ec0409a46	Merge pull request #814 from stianst/Branch_1_0 Version bump	2014-10-29 14:32:49 +01:00
Stian Thorgersen	cd5e191b18	Version bump	2014-10-29 14:32:23 +01:00
Stian Thorgersen	a14b3753da	Merge pull request #813 from stianst/Branch_1_0 Branch 1 0	2014-10-29 14:22:15 +01:00
Stian Thorgersen	41b8701d51	KEYCLOAK-763 Document reverse proxy setup on AS7/EAP	2014-10-29 14:04:43 +01:00
Stian Thorgersen	d84e7eb38b	KEYCLOAK-797 login-status-iframe.html fails if domain contains hyphen	2014-10-29 14:03:48 +01:00
Stian Thorgersen	d40b256557	Version bump	2014-10-29 14:03:40 +01:00
Stian Thorgersen	5304e197e5	KEYCLOAK-747	2014-10-27 15:02:36 +01:00
Stian Thorgersen	623e28b9c2	Fixes to testsuite for db cleanup	2014-10-27 13:46:03 +01:00
Stian Thorgersen	274bc4e33a	Added liquibase to clean db for testsuite only	2014-10-27 08:33:24 +01:00
Stian Thorgersen	42b44ed3b0	Version bump	2014-10-27 08:33:18 +01:00
Stian Thorgersen	b0c99e6111	KEYCLOAK-786 Value in input fields should be escaped	2014-10-27 08:33:13 +01:00
Stian Thorgersen	fe73feee34	Merge pull request #788 from stianst/Branch_1_0 KEYCLOAK-711 HttpServletReqest.logout() does not work with relative URI	2014-10-21 12:43:03 +02:00
Stian Thorgersen	629d3ce4aa	KEYCLOAK-711 HttpServletReqest.logout() does not work with relative URI	2014-10-21 12:36:46 +02:00
Stian Thorgersen	ed6c290bbc	Merge pull request #785 from stianst/Branch_1_0 KEYCLOAK-710 Ignore missing roles in access-code	2014-10-21 11:24:50 +02:00
Stian Thorgersen	9dde3f60d6	KEYCLOAK-710 Ignore missing roles in access-code	2014-10-21 11:09:43 +02:00
Stian Thorgersen	1bcc8c9110	Merge pull request #781 from stianst/Branch_1_0 Fixes	2014-10-21 10:02:12 +02:00
Stian Thorgersen	bb132e1aa0	KEYCLOAK-765 Check signature on state in social callback	2014-10-20 13:29:45 +02:00
Stian Thorgersen	5e4b843eb7	KEYCLOAK-700 Check path is valid in account/login-redirect	2014-10-20 13:12:23 +02:00
Stian Thorgersen	85cc63c7ce	KEYCLOAK-703 Check valid origin is passed to login-status-iframe Conflicts: services/src/main/java/org/keycloak/services/resources/TokenService.java	2014-10-20 13:12:08 +02:00
Stian Thorgersen	a697f4bd41	KEYCLOAK-699 Set maximum size of qr-code	2014-10-20 13:03:05 +02:00
Stian Thorgersen	7e03c74bc3	KEYCLOAK-747 Fix onUserRemoved in user session providers Conflicts: model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UsernameLoginFailureAdapter.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/LoginFailureEntity.java testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java	2014-10-17 13:34:12 +02:00
Stian Thorgersen	67f7bcec99	Version bump	2014-10-08 15:36:53 +02:00
Stian Thorgersen	267b80c2fa	Fix adding attributes to users over rest	2014-10-08 12:11:28 +02:00
Stian Thorgersen	66e848710e	Merge pull request #748 from stianst/Branch_1_0 Version bump	2014-10-08 11:11:37 +02:00
Stian Thorgersen	93f48ecb6c	Version bump	2014-10-08 09:30:30 +02:00
Stian Thorgersen	ecace349f5	Merge pull request #740 from stianst/Branch_1_0 KEYCLOAK-729	2014-10-03 14:12:10 +02:00
Stian Thorgersen	4a5b313816	KEYCLOAK-729 Update themes documentation	2014-10-03 14:11:27 +02:00
Stian Thorgersen	c79506a34f	Merge pull request #738 from stianst/Branch_1_0 Fixes	2014-10-03 13:24:45 +02:00
Stian Thorgersen	5e97051c07	KEYCLOAK-722 Refreshing token throws RuntimeException if realm keys have changed Conflicts: testsuite/integration/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java Backport changes to AssertEvents	2014-10-03 13:23:07 +02:00
Stian Thorgersen	562aa24ebf	KEYCLOAK-662 NPE when using direct grant API with email as username	2014-10-03 13:23:07 +02:00
Stian Thorgersen	4a66687304	Merge pull request #735 from stianst/Branch_1_0 KEYCLOAK-701 Use built-in themes if specified theme is not found	2014-10-03 11:27:48 +02:00
Stian Thorgersen	42c2066fd8	KEYCLOAK-701 Use built-in themes if specified theme is not found	2014-10-03 11:16:50 +02:00
Stian Thorgersen	161b3293dc	Merge pull request #732 from stianst/Branch_1_0 KEYCLOAK-732 AuthenticationManager.logout should logout just current use...	2014-10-03 11:02:29 +02:00
mposolda	a9608904d0	KEYCLOAK-732 AuthenticationManager.logout should logout just current userSession Backport multi-session tests to 1.0.x	2014-10-03 11:01:47 +02:00
mposolda	1b9358c4c6	KEYCLOAK-709 ResourceAdminManager.logoutApplication shouldn't immediatelly fail with RuntimeException	2014-10-02 13:34:00 +02:00
Stian Thorgersen	70ff6c7209	Merge pull request #726 from lfryc/KEYCLOAK-727-log-out-all-sessions KEYCLOAK-727: 'logout'->'log out' + moved message to bundle	2014-10-02 10:54:02 +02:00
Lukas Fryc	3133e30265	KEYCLOAK-727: 'logout'->'log out' + moved message to bundle	2014-10-02 09:54:45 +02:00
Stian Thorgersen	d0c2e80949	KEYCLOAK-725 Add realm update to the Admin Client	2014-10-01 14:53:08 +02:00
Stian Thorgersen	89e1937501	Update version	2014-10-01 14:50:35 +02:00
Stian Thorgersen	c05f83c9b3	Merge pull request #709 from stianst/master Add test to add/remove attributes to user through admin endpoints	2014-09-25 19:36:43 +02:00
Stian Thorgersen	f2e97ff9d6	Add test to add/remove attributes to user through admin endpoints	2014-09-25 19:35:57 +02:00
Stian Thorgersen	ca4ed6d528	Merge pull request #708 from stianst/master Fix cordova example	2014-09-25 19:00:45 +02:00
Stian Thorgersen	8006ea073b	Fix cordova example	2014-09-25 19:00:13 +02:00
Stian Thorgersen	f8b4a91fa8	Merge pull request #707 from sebastienblanc/all_origins change origin to * so it will work even if KC is behind https (like on OpenShift)	2014-09-25 18:49:36 +02:00
Sebastien Blanc	e17d6c81f9	change origin to *	2014-09-25 17:43:10 +02:00
Stian Thorgersen	f77de41b2e	Merge pull request #706 from stianst/master Fix welcome-theme for testsuite	2014-09-25 11:54:21 +02:00
Stian Thorgersen	c12577e886	Fix welcome-theme for testsuite	2014-09-25 11:53:28 +02:00
Stian Thorgersen	5daec20a6e	Merge pull request #705 from cvasilak/doc-link fix docbook link	2014-09-24 12:05:11 +01:00
Christos Vasilakis	6d3aaa0560	fix docbook link	2014-09-24 12:58:18 +03:00
Stian Thorgersen	2e11e71453	Merge pull request #704 from cvasilak/link.fix fix create-realm link	2014-09-24 10:03:21 +01:00
Christos Vasilakis	fb561b8fd6	fix create-realm link	2014-09-24 11:40:22 +03:00
Bill Burke	a26ac1758c	Merge pull request #703 from patriot1burke/master KEYCLOAK-705 and 687	2014-09-19 11:37:25 -04:00
Bill Burke	ef60e17641	security vulnerability doc	2014-09-19 11:35:15 -04:00
Bill Burke	53943f8246	KEYCLOAK-705	2014-09-19 11:03:08 -04:00
Bill Burke	0b8b31a3ea	KEYCLOAK-705	2014-09-19 10:00:47 -04:00
Stian Thorgersen	6f3132eafd	Merge pull request #701 from stianst/master KEYCLOAK-696 Display Keycloak version in admin console	2014-09-18 13:24:38 +02:00
Stian Thorgersen	dcb5717154	KEYCLOAK-696 Display Keycloak version in admin console	2014-09-18 13:24:03 +02:00
Stian Thorgersen	bfdb8d4e2d	Merge pull request #700 from stianst/master Removed info log statement	2014-09-18 12:38:48 +02:00
Stian Thorgersen	91fced3b87	Removed info log statement	2014-09-18 12:37:51 +02:00
Marek Posolda	825c475c7f	Merge pull request #699 from mposolda/master Admin console fixes, KEYCLOAK_REMEMBER_ME life changed to 1 year	2014-09-18 11:15:09 +02:00
mposolda	89471b7db1	KEYCLOAK-695 Let KEYCLOAK_REMEMBER_ME cookie to be valid for 1 year	2014-09-18 11:03:44 +02:00
mposolda	95233af485	KEYCLOAK-694 Fix JS error which could happen when creating application	2014-09-18 10:51:10 +02:00
mposolda	fc37398235	KEYCLOAK-693 Hide top navigation when creating OAuth client	2014-09-18 10:50:18 +02:00
Marek Posolda	16ea18370d	Merge pull request #698 from mposolda/master Prefill login form just if rememberMe enabled for the realm	2014-09-17 08:59:00 +02:00
mposolda	1049bca433	Prefill login form just if rememberMe enabled for the realm	2014-09-17 08:54:29 +02:00
Marek Posolda	364174fb7e	Merge pull request #697 from mposolda/master Cookie & rememberMe fix. Fixing testsuite with mongo	2014-09-16 22:15:27 +02:00
mposolda	5352872b4b	Use KEYCLOAK_REMEMBER_ME as hint to prefill login form. Change lifespan of KEYCLOAK_IDENTITY to maxSsoSessionLifespan	2014-09-16 22:09:27 +02:00
mposolda	bd0887d18e	Fixing testsuite for mongo	2014-09-16 20:02:30 +02:00
Marek Posolda	9a5f42039d	Merge pull request #696 from mposolda/master Added directive kcNavigationApplication and kcNavigationOauthClient. Hide Scope and Claims for bearer-only apps	2014-09-12 20:16:52 +02:00
mposolda	ce8dd136bd	Added directive kcNavigationApplication and kcNavigationOauthClient. Hide Scope and Claims for bearer-only apps	2014-09-12 20:15:11 +02:00
mposolda	1be2bff95f	Typo	2014-09-12 16:57:02 +02:00
Stian Thorgersen	485ca9c90f	Merge pull request #695 from stianst/master KEYCLOAK-657 Set cache-control for keycloak.js and login-iframe	2014-09-12 13:47:20 +02:00
Stian Thorgersen	811cfd52c9	KEYCLOAK-657 Set cache-control for keycloak.js and login-iframe	2014-09-12 13:46:56 +02:00
Stian Thorgersen	5c1807eb2d	Merge pull request #694 from stianst/master Fixes to KEYCLOAK-682	2014-09-12 12:27:31 +02:00
Stian Thorgersen	7c15a70f53	Fixes to KEYCLOAK-682	2014-09-12 12:26:52 +02:00
Stian Thorgersen	c9c525e942	Merge pull request #693 from stianst/master KEYCLOAK-682 Only send logout admin action to clients associated with us...	2014-09-12 11:47:30 +02:00
Stian Thorgersen	5d141d4d8a	KEYCLOAK-682 Only send logout admin action to clients associated with user session	2014-09-12 11:47:11 +02:00
Stian Thorgersen	e96d6f0dfd	Merge pull request #692 from stianst/master Change version schema to match JBoss	2014-09-12 09:36:27 +02:00
Stian Thorgersen	423dc1b8a7	Change version schema to match JBoss	2014-09-12 09:35:08 +02:00
Marek Posolda	ab080dcdd8	Merge pull request #691 from mposolda/master Preserve form values in account mgmt after error. Allow valid email during registration or account mgmt	2014-09-11 20:57:27 +02:00
mposolda	6f173d4554	KEYCLOAK-678 Preserve form values in account mgmt after error	2014-09-11 20:54:48 +02:00
mposolda	649a40f58c	KEYCLOAK-676 Validate email address format during registration or account mgmt	2014-09-11 20:05:00 +02:00
Stian Thorgersen	d06668d39b	Merge pull request #690 from stianst/master KEYCLOAK-653 Add theme support to welcome-pages	2014-09-11 15:58:51 +02:00
Stian Thorgersen	b23463a1d2	KEYCLOAK-653 Add theme support to welcome-pages	2014-09-11 15:58:29 +02:00
Stian Thorgersen	7f81032577	Merge pull request #689 from stianst/master KEYCLOAK-680 Add/remove social-links through admin api	2014-09-11 12:10:23 +02:00
Stian Thorgersen	280cbf2174	KEYCLOAK-680 Add/remove social-links through admin api	2014-09-11 12:09:55 +02:00
Stian Thorgersen	228bb297c2	Merge pull request #688 from stianst/master Added KEYCLOAK_DEV_PORT env variable for KeycloakServer	2014-09-11 11:05:53 +02:00
Stian Thorgersen	f96e59d085	Added KEYCLOAK_DEV_PORT env variable for KeycloakServer	2014-09-11 11:05:29 +02:00
Stian Thorgersen	86300e7e86	Merge pull request #687 from stianst/master Version bump	2014-09-11 09:29:37 +02:00
Stian Thorgersen	5dea07793b	Version bump	2014-09-11 09:27:58 +02:00