Merge pull request #814 from stianst/Branch_1_0

Version bump
2014-10-29 14:32:49 +01:00 · 2014-10-29 14:32:23 +01:00 · 2014-10-29 14:22:15 +01:00 · 2014-10-29 14:04:43 +01:00 · 2014-10-29 14:03:48 +01:00 · 2014-10-29 14:03:40 +01:00
161 changed files with 989 additions and 230 deletions
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>
    <name>Connections Parent</name>
    <description/>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -1,12 +1,15 @@
 package org.keycloak.util;

 import java.net.URI;
+import java.util.regex.Pattern;

 /**
 * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
 */
 public class UriUtils {

+    private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w-]+(\\.[\\w-]+)*(:[\\d]{2,5})?");
+
    public static String getOrigin(URI uri) {
        return getOrigin(uri.toString());
    }
@@ -16,4 +19,8 @@ public class UriUtils {
        return u.substring(0, u.indexOf('/', 8));
    }

+    public static boolean isOrigin(String url) {
+        return originPattern.matcher(url).matches();
+    }
+
 }
@@ -0,0 +1,46 @@
+package org.keycloak.util;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UriUtilsTest {
+
+    @Test
+    public void testOrigins() {
+        assertValid("http://test");
+        assertValid("http://test:8080");
+        assertValid("https://test");
+        assertValid("http://test.com");
+        assertValid("https://test.com");
+        assertValid("https://test.com:8080");
+        assertValid("http://sub.test.com");
+        assertValid("https://sub.test.com");
+        assertValid("https://sub.test.com:8080");
+        assertValid("http://192.168.123.123");
+        assertValid("https://192.168.123.123");
+        assertValid("https://192.168.123.123:8080");
+        assertValid("https://sub-sub.test.com");
+        assertValid("https://sub.test-test.com");
+
+        assertInvalid("https://test/");
+        assertInvalid("{");
+        assertInvalid("https://{}");
+        assertInvalid("https://)");
+        assertInvalid("http://test:test");
+        assertInvalid("http://test:8080:8080");
+    }
+
+    public void assertValid(String origin) {
+        assertTrue(UriUtils.isOrigin(origin));
+    }
+
+    public void assertInvalid(String origin) {
+        assertFalse(UriUtils.isOrigin(origin));
+    }
+
+}
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -30,7 +30,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Distribution</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -31,6 +31,7 @@
                <!ENTITY UserFederation SYSTEM "modules/user-federation.xml">
                <!ENTITY ExportImport SYSTEM "modules/export-import.xml">
                <!ENTITY ServerCache SYSTEM "modules/cache.xml">
+                <!ENTITY SecurityVulnerabilities SYSTEM "modules/security-vulnerabilities.xml">
                ]>

 <book>
@@ -119,6 +120,7 @@ This one is short
    &UserFederation;
    &ExportImport;
    &ServerCache;
+    &SecurityVulnerabilities;
    &Migration;

 </book>
@@ -44,7 +44,7 @@
                <listitem>
                    <para>
                        For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
-                        This switch is for oauth clients that only use the  <link linkend='direct-access-grant'>Direct Access Grant</link>
+                        This switch is for oauth clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
@@ -0,0 +1,155 @@
+<chapter id="security_vulnerabilities">
+    <title>Security Vulnerabilities</title>
+    <para>
+        This chapter discusses possible security vulnerabilities Keycloak could have, how Keycloak mitigates those
+        vulnerabilities, and what steps you need to do to configure Keycloak to mitigate some vulnerabilities.  A good list
+        of potential vulnerabilities and what security implementations should do to mitigate them can be found in the
+        <ulink url="http://tools.ietf.org/html/rfc6819">OAuth 2.0 Thread Model</ulink> document put out by the IETF.  Many of those vulnerabilities are discussed here.
+    </para>
+    <section>
+        <title>SSL/HTTPS Requirement</title>
+        <para>
+            If you do not use SSL/HTTPS for all communication between the Keycloak auth server and the clients it secures
+            you will be very vulnerable to man in the middle attacks.  OAuth 2.0/OpenID Connect uses access tokens for
+            security.  Without SSL/HTTPS, attackers can sniff your network and obtain an access token.  Once they have an
+            access token they can do any operation that the token has been given permission for.
+        </para>
+        <para>
+            Keycloak has <link linkend="ssl_modes">three modes for SSL/HTTPS</link>.  SSL can be hard to set up, so out of the box, Keycloak allows
+            non-HTTPS communication over private IP addresses like localhost, 192.168.x.x, and other private IP addresses.
+            In production, you should make sure SSL is enabled and required across the board.
+        </para>
+        <para>
+            On the adapter/client side, Keycloak allows you to turn off the SSL trust manager.  The trust manager ensures
+            identity the client is talking to.  It checks the DNS domain name against the server's certificate.  In production
+            you should make sure that each of your client adapters is configured to use a truststore.  Otherwise you are vulnerable
+            to DNS man in the middle attacks.
+        </para>
+    </section>
+    <section>
+        <title>CSRF Attacks</title>
+        <para>
+            Cross-site request forgery (CSRF) is a web-based attack whereby HTTP
+            requests are transmitted from a user that the web site trusts or has
+            authenticated (e.g., via HTTP redirects or HTML forms).  Any site that uses
+            cookie based authentication is vulnerable for these types of attacks.  These attacks are mitigated
+            by matching a state cookie against a posted form or query parameter.
+        </para>
+        <para>
+            OAuth 2.0 login specification requires that a state cookie be used and matched against a transmitted state
+            parameter.  Keycloak fully implements this part of the specification so all logins are protected.
+        </para>
+        <para>
+            The Keycloak adminstration console is a pure Javascript/HTML5 application that makes REST calls to the
+            backend Keycloak admin API.  These calls all require bearer token authentication and are made via Javascript
+            Ajax calls.  CSRF does not apply here.  The admin REST API can also be configured to validate CORS origins
+            as well.
+        </para>
+        <para>
+            The only part of Keycloak that really falls into CSRF is the user account management pages.  To mitigate this
+            Keycloak sets a state cookie and also embeds the value of this state cookie within hidden form fields or
+            query parameters in action links.  This query or form parameter is checked against the state cookie to verify
+            that the call was made by the user.
+        </para>
+    </section>
+    <section>
+        <title>Clickjacking</title>
+        <para>
+            With clickjacking, a malicious site loads the target site in a
+            transparent iFrame overlaid on top of a set of dummy
+            buttons that are carefully constructed to be placed directly under
+            important buttons on the target site.  When a user clicks a visible
+            button, they are actually clicking a button (such as an "Authorize"
+            button) on the hidden page.  An attacker can steal a user's authentication credentials and
+            access their resources.
+        </para>
+        <para>
+            By default, every response by Keycloak sets some specific browser headers that can prevent this from happening
+            specifically <ulink url="http://tools.ietf.org/html/rfc7034">X-FRAME_OPTIONS</ulink> and <ulink url="http://www.w3.org/TR/CSP/">Content-Security-Policy</ulink>.  You
+            should take a look at both of these headers.  In the admin console you can specify the values these headers will
+            have.  By default, Keycloak only sets up a same-origin policy for iframes.
+        </para>
+    </section>
+    <section>
+        <title>Compromised Access Codes</title>
+        <para>
+            It would be very hard for an attacker to compromise Keycloak access codes.  Keycloak generates a cryptographically
+            strong random value for its access codes so it would be very hard to guess an access token.
+            An access code can only be turned into an access token once so it can't be replayed.  In the admin console
+            you can specify how long an access token is valid for.  This value should be really short.  Like a seconds.
+            Just long enough for the client to make the request to turn the code into an token.
+        </para>
+    </section>
+    <section>
+        <title>Compromised access and refresh tokens</title>
+        <para>
+            There's a few things you can do to mitigate access tokens and refresh tokens from being stolen.
+            Most importantly is to enforce SSL/HTTPS communication between Keycloak and its clients and applications.
+            Short lifespans (minutes) for access tokens allows Keycloak to check the validity of a refresh token.  Making
+            sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.
+        </para>
+        <para>
+            If an access token or refresh token is compromised, the first thing you should do is go to the admin console
+            and push a not-before revocation policy to all applications.  This will enforce that any tokens issued
+            prior to that date are now invalid.  You can also disable specific applications, clients, and users if you
+            feel that any one of those entities is completely compromised.
+        </para>
+    </section>
+    <section>
+        <title>Open redirectors</title>
+        <para>
+            An attacker could use the end-user authorization endpoint and the
+            redirect URI parameter to abuse the authorization server as an open
+            redirector.  An open redirector is an endpoint using a parameter to
+            automatically redirect a user agent to the location specified by the
+            parameter value without any validation.  An attacker could utilize a user's trust in an authorization
+            server to launch a phishing attack.
+        </para>
+        <para>
+            Keycloak requires that all registered applications and clients register at least one redirection uri pattern.
+            Any time a client asks Keycloak to perform a redirect (on login or logout for example), Keycloak will
+            check the redirect uri vs. the list of valid registered uri patterns.  It is important that clients and
+            applications register as specific a URI pattern as possible to mitigate open redirector attacks.
+        </para>
+    </section>
+    <section>
+        <title>Password guess: brute force attacks</title>
+        <para>
+            A brute force attack happens when an attacker is trying to guess a user's password.  Keycloak has some
+            limited brute force detection capabilities.  If turned on, a user account will be temporarily disabled
+            if a threshold of login failures is reached.  The downside of this is that this makes Keycloak vulnerable
+            to denial of service attacks.  Eventually we will expand this functionality to take client IP address into
+            account when deciding whether to block a user.
+        </para>
+        <para>
+            Another thing you can do to prevent password guessing is to point a tool like <ulink url="http://fail2ban.org">Fail2Ban</ulink> to the Keycloak
+            server's log file.  Keycloak logs every login failure and client IP address that had the failure.
+        </para>
+        <para>
+            In the admin console, per realm, you can set up a password policy to enforce that users pick hard to guess passwords.
+        </para>
+        <para>
+            Finally, the best way to mitigate against brute force attacks is to require user to set up a one-time-password (OTP).
+        </para>
+    </section>
+    <section>
+        <title>Password database compromised</title>
+        <para>
+            Keycloak does not store passwords in raw text.  It stores a hash of them.  Because of performance reasons,
+            Keycloak only hashes passwords once.  While a human could probably never crack a hashed password, it is very
+            possible that a computer could.  The security community suggests around 20,000 (yes thousand!) hashing iterations
+            to be done to each password.  This number grows every year due to increasing computing power (It was 1000 12 years ago).
+            The problem with this is that password hashing is a huge performance hit as each login would require the entered
+            password to be hashed that many times and compared to the stored hash.  So, its up to the admin to configure the
+            password hash iterations.  This can be done in the admin console password policy configuration.  Again, the default
+            value is 1 as we thought it might be more important for Keycloak to scale out of the box.  There's a lot of
+            other measures admins can do to protect their password databases.
+        </para>
+    </section>
+    <section>
+        <title>SQL Injection attacks</title>
+        <para>
+            At this point in time, there is no knowledge of any SQL injection vulnerabilities in Keycloak
+        </para>
+    </section>
+</chapter>
@@ -404,7 +404,7 @@ keycloak-war-dist-all-&project.version;/
 ]]>
 </programlisting>
        </section>
-        <section>
+        <section id="ssl_modes">
            <title>SSL/HTTPS Requirement/Modes</title>
            <warning>
                <para>
@@ -625,29 +625,74 @@ keycloak-war-dist-all-&project.version;/
                    <literal>X-Forwarded-Proto</literal> headers on the requests made to Keycloak. Next you need to enable
                    <literal>proxy-address-forwarding</literal> on the Keycloak http connector. Assuming that your reverse
                    proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to.
-                    This is done by editing <literal>standalone/configuration/standalone.xml</literal>.
                </para>
-                First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to the <literal>http-listener</literal>
-                element:
-                <para>
+
+                <section>
+                    <title>WildFly</title>
+
+                    <para>
+                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
+                    </para>
+
+                    <para>
+                        First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to
+                        the <literal>http-listener</literal> element:
 <programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:undertow:1.1">
    ...
-    <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
+    <http-listener name="default" socket-binding="http"
+        proxy-address-forwarding="true" redirect-socket="proxy-https"/>
    ...
 </subsystem>
 ]]></programlisting>
-                Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
+                    </para>
+                    <para>
+                        Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
 <programlisting><![CDATA[
-<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
+<socket-binding-group name="standard-sockets" default-interface="public"
+    port-offset="${jboss.socket.binding.port-offset:0}">
    ...
    <socket-binding name="proxy-https" port="443"/>
    ...
 </socket-binding-group>
 ]]></programlisting>
-                </para>
-                <para>
-                    Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
-                </para>
+                    </para>
+                    <para>
+                        Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
+                    </para>
+                </section>
+
+                <section>
+                    <title>AS7/EAP</title>
+
+                    <para>
+                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
+                    </para>
+
+                    <para>
+                        You need to add <literal>redirect-port</literal> to http <literal>connector</literal> element and
+                        add the <literal>RemoteIpValve</literal> valve:
+<programlisting><![CDATA[
+<subsystem xmlns="urn:jboss:domain:web:1.5"
+    default-virtual-server="default-host" native="false">
+    <connector name="http" protocol="HTTP/1.1" scheme="http"
+        socket-binding="http"
+        redirect-port="443"/>
+    <virtual-server name="default-host" enable-welcome-root="true">
+        <alias name="localhost"/>
+        <alias name="example.com"/>
+    </virtual-server>
+    <valve name="remoteipvalve" module="org.jboss.as.web"
+        class-name="org.apache.catalina.valves.RemoteIpValve">
+        <param param-name="protocolHeader" param-value="x-forwarded-proto"/>
+    </valve>
+</subsystem>
+]]></programlisting>
+                    </para>
+
+
+
+                </section>
+
            </section>

            <section>
@@ -6,12 +6,38 @@
        and feel of end-user facing pages so they can be integrated with your brand and applications.
    </para>

+    <section>
+        <title>Theme types</title>
+        <para>
+            There are several types of themes in Keycloak:
+            <itemizedlist>
+                <listitem>Account - Account management</listitem>
+                <listitem>Admin - Admin console</listitem>
+                <listitem>Common - Shared resources for themes</listitem>
+                <listitem>Email - Emails</listitem>
+                <listitem>Login - Login forms</listitem>
+                <listitem>Welcome - Welcome pages</listitem>
+            </itemizedlist>
+        </para>
+    </section>
+
    <section>
        <title>Configure theme</title>
        <para>
-            To configure the theme used by a realm open the <literal>Keycloak Admin Console</literal>, select your realm
+            All theme types, except welcome, is configured through <literal>Keycloak Admin Console</literal>. To change
+            the theme used for a realm open the open the <literal>Keycloak Admin Console</literal>, select your realm
            from the drop-down box in the top left corner. Under <literal>Settings</literal> click on <literal>Theme</literal>.
        </para>
+        <para>
+            To change the welcome theme you need to edit <literal>standalone/configuration/keycloak-server.json</literal>
+            and add <literal>welcomeTheme</literal> to the theme element, for example:
+<programlisting>
+"theme": {
+    ...
+    "welcomeTheme": "custom-theme"
+}
+</programlisting>
+        </para>
    </section>

    <section>
@@ -25,26 +51,15 @@

    <section>
        <title>Creating a theme</title>
-        <para>
-            There are several types of themes in Keycloak:
-            <itemizedlist>
-                <listitem>Account - Account management</listitem>
-                <listitem>Admin - Admin console</listitem>
-                <listitem>Common - Shared resources for themes</listitem>
-                <listitem>Email - Emails</listitem>
-                <listitem>Login - Login forms</listitem>
-            </itemizedlist>
-        </para>
-
        <para>
            A theme consists of:
            <itemizedlist>
-                <listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
-                <listitem><para>Stylesheets</para></listitem>
-                <listitem><para>Scripts</para></listitem>
-                <listitem><para>Images</para></listitem>
-                <listitem><para>Message bundles</para></listitem>
-                <listitem><para>Theme properties</para></listitem>
+                <listitem><ulink url="http://freemarker.org">FreeMarker</ulink> templates</listitem>
+                <listitem>Stylesheets</listitem>
+                <listitem>Scripts</listitem>
+                <listitem>Images</listitem>
+                <listitem>Message bundles</listitem>
+                <listitem>Theme properties</listitem>
            </itemizedlist>
        </para>
        <para>
@@ -132,10 +147,9 @@
        <section>
            <title>Theme SPI</title>
            <para>
-                The Theme SPI allows creating different mechanisms to providing themes for the default FreeMarker based
+                The Theme SPI allows creating different mechanisms to load themes for the default FreeMarker based
                implementations of login forms and account management. To create a theme provider you will need to implement
-                <literal>org.keycloak.freemarker.ThemeProvider</literal> and <literal>org.keycloak.freemarker.Theme</literal> in
-                <literal>forms/common-freemarker</literal>.
+                <literal>org.keycloak.freemarker.ThemeProviderFactory</literal> and <literal>org.keycloak.freemarker.ThemeProvider</literal>.
            </para>
            <para>
                Keycloak comes with two theme providers, one that loads themes from the classpath (used by default themes)
@@ -149,12 +163,15 @@
            <para>
                The Account SPI allows implementing the account management pages using whatever web framework or templating
                engine you want. To create an Account provider implement <literal>org.keycloak.account.AccountProviderFactory</literal>
-                and <literal>org.keycloak.account.AccountProvider</literal> in <literal>forms/account-api</literal>.
+                and <literal>org.keycloak.account.AccountProvider</literal>.
            </para>
            <para>
-                Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-&project.version;.jar</literal>
-                or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
+                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
+<programlisting>
+"account": {
+    "provider": "custom-provider"
+}
+</programlisting>
            </para>
        </section>
        <section>
@@ -165,9 +182,12 @@
                and <literal>org.keycloak.login.LoginFormsProvider</literal> in <literal>forms/login-api</literal>.
            </para>
            <para>
-                Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
-                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-&project.version;.jar</literal>
-                or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
+                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
+<programlisting>
+"login": {
+    "provider": "custom-provider"
+}
+</programlisting>
            </para>
        </section>
    </section>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -35,12 +35,6 @@
            }
        ]
    },
-    "roleMappings": [
-        {
-            "username": "user",
-            "roles": ["user"]
-        }
-    ],
    "scopeMappings": [
        {
            "client": "cordova",
@@ -52,17 +46,10 @@
            "name": "cordova",
            "enabled": true,
            "publicClient": true,
-            "redirectUris": []
+            "redirectUris": ["http://localhost"],
+            "webOrigins": ["localhost"]
        }
    ],
-    "applicationRoleMappings": {
-        "account": [
-            {
-                "username": "user",
-                "roles": ["view-profile", "manage-account"]
-            }
-        ]
-    },
    "applicationScopeMappings": {
        "account": [
            {
@@ -10,5 +10,5 @@

    <gap:plugin name="org.apache.cordova.inappbrowser" />

-    <access origin="http://*"/>
+    <access origin="*"/>
 </widget>
@@ -28,7 +28,7 @@
        }

        document.addEventListener("deviceready", function() {
-            keycloak.init({ onLoad: 'check-sso' });
+            keycloak.init({ onLoad: 'check-sso' }).success(updateState);
        }, false);
    </script>
 </head>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -112,7 +112,7 @@ Next thing you have to do is import the test realm for the demo.  Clicking on th
 create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
 create a new admin password before you can go to the create realm page.

-[http://localhost:8080/auth/admin/index.html#/create/realm](http://localhost:8080/auth/admin/index.html#/create/realm)
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)

 Import the testrealm.json file that is in the preconfigured-demo/ example directory.

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath> 
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Listener System.out Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Store In-Mem Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Properties Authentication Provider Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Provider Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -1,5 +1,6 @@
 package org.keycloak.freemarker;

+import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;

@@ -21,17 +22,17 @@ import java.util.concurrent.ConcurrentHashMap;
 */
 public class ExtendingThemeManager implements ThemeProvider {

+    private static final Logger log = Logger.getLogger(ExtendingThemeManager.class);
+
    private final KeycloakSession session;
    private final ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache;
    private List<ThemeProvider> providers;
    private String defaultTheme;
-    private int staticMaxAge;

    public ExtendingThemeManager(KeycloakSession session, ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache) {
        this.session = session;
        this.themeCache = themeCache;
        this.defaultTheme = Config.scope("theme").get("default", "keycloak");
-        this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge", -1);
    }

    private List<ThemeProvider> getProviders() {
@@ -57,10 +58,6 @@ public class ExtendingThemeManager implements ThemeProvider {
        return providers;
    }

-    public int getStaticMaxAge() {
-        return staticMaxAge;
-    }
-
    @Override
    public int getProviderPriority() {
        return 0;
@@ -77,7 +74,13 @@ public class ExtendingThemeManager implements ThemeProvider {
            Theme theme = themeCache.get(key);
            if (theme == null) {
                theme = loadTheme(name, type);
-                if (themeCache.putIfAbsent(key, theme) != null) {
+                if (theme == null) {
+                    theme = loadTheme("keycloak", type);
+                    if (theme == null) {
+                        theme = loadTheme("base", type);
+                    }
+                    log.errorv("Failed to find {0} theme {1}, using built-in themes", type, name);
+                } else if (themeCache.putIfAbsent(key, theme) != null) {
                    theme = themeCache.get(key);
                }
            }
@@ -89,7 +92,7 @@ public class ExtendingThemeManager implements ThemeProvider {

    private Theme loadTheme(String name, Theme.Type type) throws IOException {
        Theme theme = findTheme(name, type);
-        if (theme.getParentName() != null) {
+        if (theme != null && theme.getParentName() != null) {
            List<Theme> themes = new LinkedList<Theme>();
            themes.add(theme);

@@ -144,11 +147,11 @@ public class ExtendingThemeManager implements ThemeProvider {
                try {
                    return p.getTheme(name, type);
                } catch (IOException e) {
-                    throw new RuntimeException("Failed to create " + type.toString().toLowerCase() + " theme", e);
+                    log.errorv(e, p.getClass() + " failed to load theme, type={0}, name={1}", type, name);
                }
            }
        }
-        throw new RuntimeException(type.toString().toLowerCase() + " theme '" + name + "' not found");
+        return null;
    }

    public static class ExtendingTheme implements Theme {
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${account.username!''}"/>
+                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${(account.username!'')?html}"/>
            </div>
        </div>

@@ -30,7 +30,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="email" name="email" autofocus value="${account.email!''}"/>
+                <input type="text" class="form-control" id="email" name="email" autofocus value="${(account.email!'')?html}"/>
            </div>
        </div>

@@ -41,7 +41,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="lastName" name="lastName" value="${account.lastName!''}"/>
+                <input type="text" class="form-control" id="lastName" name="lastName" value="${(account.lastName!'')?html}"/>
            </div>
        </div>

@@ -51,7 +51,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="firstName" name="firstName" value="${account.firstName!''}"/>
+                <input type="text" class="form-control" id="firstName" name="firstName" value="${(account.firstName!'')?html}"/>
            </div>
        </div>

@@ -38,4 +38,6 @@ socialRedirectError=Failed to redirect to social provider
 socialProviderRemoved=Social provider removed successfully

 accountDisabled=Account is disabled, contact admin\
-accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
+accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
+
+logOutAllSessions=Log out all sessions
@@ -42,6 +42,6 @@

    </table>

-    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">Logout all sessions</a>
+    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">${rb.logOutAllSessions}</a>

-</@layout.mainLayout>
+</@layout.mainLayout>
@@ -11,7 +11,7 @@
                    <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" name="email" value="${user.email!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="email" name="email" value="${(user.email!'')?html}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -20,7 +20,7 @@
                    <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" name="firstName" value="${user.firstName!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="firstName" name="firstName" value="${(user.firstName!'')?html}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -29,7 +29,7 @@
                    <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" name="lastName" value="${user.lastName!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="lastName" name="lastName" value="${(user.lastName!'')?html}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -21,7 +21,7 @@
                    </div>

                    <div class="${properties.kcInputWrapperClass!}">
-                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${login.username!''}" type="text" autofocus />
+                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')?html}" type="text" autofocus />
                    </div>
                </div>

@@ -11,7 +11,7 @@
                    <label for="username" class="${properties.kcLabelClass!}">${rb.username}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${register.formData.username!''}" />
+                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${(register.formData.username!'')?html}" />
                </div>
            </div>

@@ -20,7 +20,7 @@
                    <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${register.formData.firstName!''}" />
+                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${(register.formData.firstName!'')?html}" />
                </div>
            </div>

@@ -29,7 +29,7 @@
                    <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${register.formData.lastName!''}" />
+                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${(register.formData.lastName!'')?html}" />
                </div>
            </div>

@@ -38,7 +38,7 @@
                    <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${register.formData.email!''}" />
+                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${(register.formData.email!'')?html}" />
                </div>
            </div>

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-forms-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -2,8 +2,10 @@ package org.keycloak.admin.client.resource;

 import org.keycloak.representations.idm.RealmRepresentation;

+import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
 import javax.ws.rs.GET;
+import javax.ws.rs.PUT;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
@@ -17,6 +19,10 @@ public interface RealmResource {
    @Produces(MediaType.APPLICATION_JSON)
    public RealmRepresentation toRepresentation();

+    @PUT
+    @Consumes(MediaType.APPLICATION_JSON)
+    public void update(RealmRepresentation realmRepresentation);
+
    @Path("applications")
    public ApplicationsResource applications();

@@ -20,7 +20,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -64,7 +64,8 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
            if (session != null) {
                session.removeNote(KeycloakSecurityContext.class.getName());
                if (ksc instanceof RefreshableKeycloakSecurityContext) {
-                    ((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.getDeployment());
+                    CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
+                    ((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.resolveDeployment(facade));
                }
            }
        }
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Integration</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.1.0-Alpha1-SNAPSHOT</version>
+		<version>1.0.4.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -69,7 +69,8 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
            if (session != null) {
                session.removeNote(KeycloakSecurityContext.class.getName());
                try {
-                    ServerRequest.invokeLogout(deploymentContext.getDeployment(), ksc.getToken().getSessionState());
+                    CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
+                    ServerRequest.invokeLogout(deploymentContext.resolveDeployment(facade), ksc.getToken().getSessionState());
                } catch (Exception e) {
                	log.severe("failed to invoke remote logout. " + e.getMessage());
                }
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -79,7 +79,8 @@ public class ServletKeycloakAuthMech extends UndertowKeycloakAuthMech {
                session.removeAttribute(KeycloakSecurityContext.class.getName());
                session.removeAttribute(KeycloakUndertowAccount.class.getName());
                if (account.getKeycloakSecurityContext() != null) {
-                    account.getKeycloakSecurityContext().logout(deploymentContext.getDeployment());
+                    UndertowHttpFacade facade = new UndertowHttpFacade(notification.getExchange());
+                    account.getKeycloakSecurityContext().logout(deploymentContext.resolveDeployment(facade));
                }
            }
        };
@@ -66,7 +66,8 @@ public abstract class UndertowKeycloakAuthMech implements AuthenticationMechanis
                if (account == null) return;
                session.removeAttribute(KeycloakUndertowAccount.class.getName());
                if (account.getKeycloakSecurityContext() != null) {
-                    account.getKeycloakSecurityContext().logout(deploymentContext.getDeployment());
+                    UndertowHttpFacade facade = new UndertowHttpFacade(notification.getExchange());
+                    account.getKeycloakSecurityContext().logout(deploymentContext.resolveDeployment(facade));
                }
            }
        };
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <version>1.0.4.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
Author	SHA1	Message	Date
Stian Thorgersen	9ec0409a46	Merge pull request #814 from stianst/Branch_1_0 Version bump	2014-10-29 14:32:49 +01:00
Stian Thorgersen	cd5e191b18	Version bump	2014-10-29 14:32:23 +01:00
Stian Thorgersen	a14b3753da	Merge pull request #813 from stianst/Branch_1_0 Branch 1 0	2014-10-29 14:22:15 +01:00
Stian Thorgersen	41b8701d51	KEYCLOAK-763 Document reverse proxy setup on AS7/EAP	2014-10-29 14:04:43 +01:00
Stian Thorgersen	d84e7eb38b	KEYCLOAK-797 login-status-iframe.html fails if domain contains hyphen	2014-10-29 14:03:48 +01:00
Stian Thorgersen	d40b256557	Version bump	2014-10-29 14:03:40 +01:00
Stian Thorgersen	5304e197e5	KEYCLOAK-747	2014-10-27 15:02:36 +01:00
Stian Thorgersen	623e28b9c2	Fixes to testsuite for db cleanup	2014-10-27 13:46:03 +01:00
Stian Thorgersen	274bc4e33a	Added liquibase to clean db for testsuite only	2014-10-27 08:33:24 +01:00
Stian Thorgersen	42b44ed3b0	Version bump	2014-10-27 08:33:18 +01:00
Stian Thorgersen	b0c99e6111	KEYCLOAK-786 Value in input fields should be escaped	2014-10-27 08:33:13 +01:00
Stian Thorgersen	fe73feee34	Merge pull request #788 from stianst/Branch_1_0 KEYCLOAK-711 HttpServletReqest.logout() does not work with relative URI	2014-10-21 12:43:03 +02:00
Stian Thorgersen	629d3ce4aa	KEYCLOAK-711 HttpServletReqest.logout() does not work with relative URI	2014-10-21 12:36:46 +02:00
Stian Thorgersen	ed6c290bbc	Merge pull request #785 from stianst/Branch_1_0 KEYCLOAK-710 Ignore missing roles in access-code	2014-10-21 11:24:50 +02:00
Stian Thorgersen	9dde3f60d6	KEYCLOAK-710 Ignore missing roles in access-code	2014-10-21 11:09:43 +02:00
Stian Thorgersen	1bcc8c9110	Merge pull request #781 from stianst/Branch_1_0 Fixes	2014-10-21 10:02:12 +02:00
Stian Thorgersen	bb132e1aa0	KEYCLOAK-765 Check signature on state in social callback	2014-10-20 13:29:45 +02:00
Stian Thorgersen	5e4b843eb7	KEYCLOAK-700 Check path is valid in account/login-redirect	2014-10-20 13:12:23 +02:00
Stian Thorgersen	85cc63c7ce	KEYCLOAK-703 Check valid origin is passed to login-status-iframe Conflicts: services/src/main/java/org/keycloak/services/resources/TokenService.java	2014-10-20 13:12:08 +02:00
Stian Thorgersen	a697f4bd41	KEYCLOAK-699 Set maximum size of qr-code	2014-10-20 13:03:05 +02:00
Stian Thorgersen	7e03c74bc3	KEYCLOAK-747 Fix onUserRemoved in user session providers Conflicts: model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProvider.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/InfinispanUserSessionProviderFactory.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UsernameLoginFailureAdapter.java model/sessions-infinispan/src/main/java/org/keycloak/models/sessions/infinispan/entities/LoginFailureEntity.java testsuite/integration/src/test/java/org/keycloak/testsuite/model/UserSessionProviderTest.java	2014-10-17 13:34:12 +02:00
Stian Thorgersen	67f7bcec99	Version bump	2014-10-08 15:36:53 +02:00
Stian Thorgersen	267b80c2fa	Fix adding attributes to users over rest	2014-10-08 12:11:28 +02:00
Stian Thorgersen	66e848710e	Merge pull request #748 from stianst/Branch_1_0 Version bump	2014-10-08 11:11:37 +02:00
Stian Thorgersen	93f48ecb6c	Version bump	2014-10-08 09:30:30 +02:00
Stian Thorgersen	ecace349f5	Merge pull request #740 from stianst/Branch_1_0 KEYCLOAK-729	2014-10-03 14:12:10 +02:00
Stian Thorgersen	4a5b313816	KEYCLOAK-729 Update themes documentation	2014-10-03 14:11:27 +02:00
Stian Thorgersen	c79506a34f	Merge pull request #738 from stianst/Branch_1_0 Fixes	2014-10-03 13:24:45 +02:00
Stian Thorgersen	5e97051c07	KEYCLOAK-722 Refreshing token throws RuntimeException if realm keys have changed Conflicts: testsuite/integration/src/test/java/org/keycloak/testsuite/oauth/RefreshTokenTest.java Backport changes to AssertEvents	2014-10-03 13:23:07 +02:00
Stian Thorgersen	562aa24ebf	KEYCLOAK-662 NPE when using direct grant API with email as username	2014-10-03 13:23:07 +02:00
Stian Thorgersen	4a66687304	Merge pull request #735 from stianst/Branch_1_0 KEYCLOAK-701 Use built-in themes if specified theme is not found	2014-10-03 11:27:48 +02:00
Stian Thorgersen	42c2066fd8	KEYCLOAK-701 Use built-in themes if specified theme is not found	2014-10-03 11:16:50 +02:00
Stian Thorgersen	161b3293dc	Merge pull request #732 from stianst/Branch_1_0 KEYCLOAK-732 AuthenticationManager.logout should logout just current use...	2014-10-03 11:02:29 +02:00
mposolda	a9608904d0	KEYCLOAK-732 AuthenticationManager.logout should logout just current userSession Backport multi-session tests to 1.0.x	2014-10-03 11:01:47 +02:00
mposolda	1b9358c4c6	KEYCLOAK-709 ResourceAdminManager.logoutApplication shouldn't immediatelly fail with RuntimeException	2014-10-02 13:34:00 +02:00
Stian Thorgersen	70ff6c7209	Merge pull request #726 from lfryc/KEYCLOAK-727-log-out-all-sessions KEYCLOAK-727: 'logout'->'log out' + moved message to bundle	2014-10-02 10:54:02 +02:00
Lukas Fryc	3133e30265	KEYCLOAK-727: 'logout'->'log out' + moved message to bundle	2014-10-02 09:54:45 +02:00
Stian Thorgersen	d0c2e80949	KEYCLOAK-725 Add realm update to the Admin Client	2014-10-01 14:53:08 +02:00
Stian Thorgersen	89e1937501	Update version	2014-10-01 14:50:35 +02:00
Stian Thorgersen	c05f83c9b3	Merge pull request #709 from stianst/master Add test to add/remove attributes to user through admin endpoints	2014-09-25 19:36:43 +02:00
Stian Thorgersen	f2e97ff9d6	Add test to add/remove attributes to user through admin endpoints	2014-09-25 19:35:57 +02:00
Stian Thorgersen	ca4ed6d528	Merge pull request #708 from stianst/master Fix cordova example	2014-09-25 19:00:45 +02:00
Stian Thorgersen	8006ea073b	Fix cordova example	2014-09-25 19:00:13 +02:00
Stian Thorgersen	f8b4a91fa8	Merge pull request #707 from sebastienblanc/all_origins change origin to * so it will work even if KC is behind https (like on OpenShift)	2014-09-25 18:49:36 +02:00
Sebastien Blanc	e17d6c81f9	change origin to *	2014-09-25 17:43:10 +02:00
Stian Thorgersen	f77de41b2e	Merge pull request #706 from stianst/master Fix welcome-theme for testsuite	2014-09-25 11:54:21 +02:00
Stian Thorgersen	c12577e886	Fix welcome-theme for testsuite	2014-09-25 11:53:28 +02:00
Stian Thorgersen	5daec20a6e	Merge pull request #705 from cvasilak/doc-link fix docbook link	2014-09-24 12:05:11 +01:00
Christos Vasilakis	6d3aaa0560	fix docbook link	2014-09-24 12:58:18 +03:00
Stian Thorgersen	2e11e71453	Merge pull request #704 from cvasilak/link.fix fix create-realm link	2014-09-24 10:03:21 +01:00
Christos Vasilakis	fb561b8fd6	fix create-realm link	2014-09-24 11:40:22 +03:00
Bill Burke	a26ac1758c	Merge pull request #703 from patriot1burke/master KEYCLOAK-705 and 687	2014-09-19 11:37:25 -04:00
Bill Burke	ef60e17641	security vulnerability doc	2014-09-19 11:35:15 -04:00
Bill Burke	53943f8246	KEYCLOAK-705	2014-09-19 11:03:08 -04:00
Bill Burke	0b8b31a3ea	KEYCLOAK-705	2014-09-19 10:00:47 -04:00