Version bump

2014-09-01 10:14:35 +02:00
283 changed files with 1084 additions and 2403 deletions
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>
    <name>Connections Parent</name>
    <description/>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -14,7 +14,7 @@ public class Version {
    public static String VERSION;
    public static String BUILD_TIME;
    public static final String UNKNOWN = "UNKNOWN";
-    public static final Version SINGLETON;
+    public static final Version SINGLETON = new Version();

    private final String version = VERSION;
    private final String buildTime = BUILD_TIME;
@@ -30,8 +30,6 @@ public class Version {
            VERSION=UNKNOWN;
            BUILD_TIME=UNKNOWN;
        }
-
-        SINGLETON = new Version();
    }

    @JsonProperty("version")
@@ -1,26 +0,0 @@
-package org.keycloak.util;
-
-import java.net.URI;
-import java.util.regex.Pattern;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class UriUtils {
-
-    private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w]+(\\.[\\w]+)*(:[\\d]{2,5})?");
-
-    public static String getOrigin(URI uri) {
-        return getOrigin(uri.toString());
-    }
-
-    public static String getOrigin(String uri) {
-        String u = uri.toString();
-        return u.substring(0, u.indexOf('/', 8));
-    }
-
-    public static boolean isOrigin(String url) {
-        return originPattern.matcher(url).matches();
-    }
-
-}
@@ -1,44 +0,0 @@
-package org.keycloak.util;
-
-import org.junit.Test;
-
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class UriUtilsTest {
-
-    @Test
-    public void testOrigins() {
-        assertValid("http://test");
-        assertValid("http://test:8080");
-        assertValid("https://test");
-        assertValid("http://test.com");
-        assertValid("https://test.com");
-        assertValid("https://test.com:8080");
-        assertValid("http://sub.test.com");
-        assertValid("https://sub.test.com");
-        assertValid("https://sub.test.com:8080");
-        assertValid("http://192.168.123.123");
-        assertValid("https://192.168.123.123");
-        assertValid("https://192.168.123.123:8080");
-
-        assertInvalid("https://test/");
-        assertInvalid("{");
-        assertInvalid("https://{}");
-        assertInvalid("https://)");
-        assertInvalid("http://test:test");
-        assertInvalid("http://test:8080:8080");
-    }
-
-    public void assertValid(String origin) {
-        assertTrue(UriUtils.isOrigin(origin));
-    }
-
-    public void assertInvalid(String origin) {
-        assertFalse(UriUtils.isOrigin(origin));
-    }
-
-}
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.3.Final</version>
+		<version>1.0-rc-2</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.3.Final</version>
+		<version>1.0-rc-2</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -88,7 +88,6 @@
                                    <artifactId>keycloak-js-adapter</artifactId>
                                    <version>${project.version}</version>
                                    <outputDirectory>${project.build.directory}/unpacked/js-adapter</outputDirectory>
-                                    <includes>*.js</includes>                                    
                                </artifactItem>
                            </artifactItems>
                            <excludes>**/welcome-content/*</excludes>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -8,6 +8,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/cordova" overwrite="true">
@@ -16,6 +17,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/providers" overwrite="true">
@@ -24,6 +26,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/js-console" overwrite="true">
@@ -32,6 +35,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/themes" overwrite="true">
@@ -40,6 +44,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/preconfigured-demo" overwrite="true">
@@ -48,6 +53,7 @@
                <exclude name="**/*.iml"/>
                <exclude name="**/*.unconfigured"/>
                <exclude name="**/subsystem-config.xml"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
        <copy todir="target/examples/unconfigured-demo" overwrite="true">
@@ -59,9 +65,10 @@
                <exclude name="**/target/**"/>
                <exclude name="**/*.iml"/>
                <exclude name="**/README.md"/>
+                <exclude name="**/README.md.overview"/>
            </fileset>
        </copy>
-        <copy file="../../examples/README.md" tofile="target/examples/README.md"/>
+        <copy file="../../examples/demo-template/README.md.overview" tofile="target/examples/README.md"/>
        <move file="target/examples/unconfigured-demo/README.md.unconfigured" tofile="target/examples/unconfigured-demo/README.md"/>
        <move file="target/examples/unconfigured-demo/customer-app/src/main/webapp/WEB-INF/web.xml.unconfigured" tofile="target/examples/unconfigured-demo/customer-app/src/main/webapp/WEB-INF/web.xml"/>
        <move file="target/examples/unconfigured-demo/product-app/src/main/webapp/WEB-INF/web.xml.unconfigured" tofile="target/examples/unconfigured-demo/product-app/src/main/webapp/WEB-INF/web.xml"/>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -30,7 +30,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Distribution</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -89,7 +89,6 @@
                                    <artifactId>keycloak-js-adapter</artifactId>
                                    <version>${project.version}</version>
                                    <outputDirectory>${project.build.directory}/unpacked/js-adapter</outputDirectory>
-                                    <includes>*.js</includes>                                    
                                </artifactItem>
                            </artifactItems>
                        </configuration>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -1,19 +1,15 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <parent>
-        <artifactId>keycloak-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
-        <relativePath>../pom.xml</relativePath>
-    </parent>

+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.keycloak</groupId>
    <artifactId>keycloak-reference-guide-${translation}</artifactId>
+    <version>1.0-rc-2</version>
    <packaging>jdocbook</packaging>
    <name>Keycloak Reference Guide (${translation})</name>
    <description/>
-    <modelVersion>4.0.0</modelVersion>
-
    <repositories>
        <repository>
            <id>jboss</id>
@@ -31,7 +31,6 @@
                <!ENTITY UserFederation SYSTEM "modules/user-federation.xml">
                <!ENTITY ExportImport SYSTEM "modules/export-import.xml">
                <!ENTITY ServerCache SYSTEM "modules/cache.xml">
-                <!ENTITY SecurityVulnerabilities SYSTEM "modules/security-vulnerabilities.xml">
                ]>

 <book>
@@ -39,7 +38,7 @@
   <bookinfo>
      <title>Keycloak Reference Guide</title>
      <subtitle>SSO for Web Apps and REST Services</subtitle>
-      <releaseinfo>&project.version;</releaseinfo>
+      <releaseinfo>1.0-rc-2</releaseinfo>
   </bookinfo>

   <toc/>
@@ -120,7 +119,6 @@ This one is short
    &UserFederation;
    &ExportImport;
    &ServerCache;
-    &SecurityVulnerabilities;
    &Migration;

 </book>
@@ -152,7 +152,7 @@
                of roles that an application or oauth client is allowed to ask permission for.  Access tokens are always
                granted at the request of a specific application or oauth client.  This also holds true for SSO.  As you visit
                different sites, the application will redirect back to the Keycloak Server via the OAuth 2.0 protocol to obtain an access
-                token specific to that application.  The role mappings contained within the token are the intersection
+                token specific to that application.  The role mappings contained within the token are the union
                between the set of user role mappings and the permission scope of the application/oauth client.  So,
                access tokens are tailor made for each application/oauth client and contain only the information required
                for by them.
@@ -44,7 +44,7 @@
                <listitem>
                    <para>
                        For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
-                        This switch is for oauth clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
+                        This switch is for oauth clients that only use the  <link linkend='direct-access-grant'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
@@ -11,7 +11,7 @@
  "realm-public-key" : "MIGfMA0GCSqGSIb3D...31LwIDAQAB",
  "auth-server-url" : "https://localhost:8443/auth",
  "ssl-required" : "external",
-  "use-resource-role-mappings" : false,
+  "user-resource-role-mappings" : false,
  "enable-cors" : true,
  "cors-max-age" : 1000,
  "cors-allowed-methods" : [ "POST", "PUT", "DELETE", "GET" ],
@@ -101,7 +101,7 @@
                </listitem>
            </varlistentry>
            <varlistentry>
-                <term>use-resource-role-mappings</term>
+                <term>user-resource-role-mappings</term>
                <listitem>
                    <para>
                        If set to true, the adapter will look inside the token for application level role mappings for
@@ -1,155 +0,0 @@
-<chapter id="security_vulnerabilities">
-    <title>Security Vulnerabilities</title>
-    <para>
-        This chapter discusses possible security vulnerabilities Keycloak could have, how Keycloak mitigates those
-        vulnerabilities, and what steps you need to do to configure Keycloak to mitigate some vulnerabilities.  A good list
-        of potential vulnerabilities and what security implementations should do to mitigate them can be found in the
-        <ulink url="http://tools.ietf.org/html/rfc6819">OAuth 2.0 Thread Model</ulink> document put out by the IETF.  Many of those vulnerabilities are discussed here.
-    </para>
-    <section>
-        <title>SSL/HTTPS Requirement</title>
-        <para>
-            If you do not use SSL/HTTPS for all communication between the Keycloak auth server and the clients it secures
-            you will be very vulnerable to man in the middle attacks.  OAuth 2.0/OpenID Connect uses access tokens for
-            security.  Without SSL/HTTPS, attackers can sniff your network and obtain an access token.  Once they have an
-            access token they can do any operation that the token has been given permission for.
-        </para>
-        <para>
-            Keycloak has <link linkend="ssl_modes">three modes for SSL/HTTPS</link>.  SSL can be hard to set up, so out of the box, Keycloak allows
-            non-HTTPS communication over private IP addresses like localhost, 192.168.x.x, and other private IP addresses.
-            In production, you should make sure SSL is enabled and required across the board.
-        </para>
-        <para>
-            On the adapter/client side, Keycloak allows you to turn off the SSL trust manager.  The trust manager ensures
-            identity the client is talking to.  It checks the DNS domain name against the server's certificate.  In production
-            you should make sure that each of your client adapters is configured to use a truststore.  Otherwise you are vulnerable
-            to DNS man in the middle attacks.
-        </para>
-    </section>
-    <section>
-        <title>CSRF Attacks</title>
-        <para>
-            Cross-site request forgery (CSRF) is a web-based attack whereby HTTP
-            requests are transmitted from a user that the web site trusts or has
-            authenticated (e.g., via HTTP redirects or HTML forms).  Any site that uses
-            cookie based authentication is vulnerable for these types of attacks.  These attacks are mitigated
-            by matching a state cookie against a posted form or query parameter.
-        </para>
-        <para>
-            OAuth 2.0 login specification requires that a state cookie be used and matched against a transmitted state
-            parameter.  Keycloak fully implements this part of the specification so all logins are protected.
-        </para>
-        <para>
-            The Keycloak adminstration console is a pure Javascript/HTML5 application that makes REST calls to the
-            backend Keycloak admin API.  These calls all require bearer token authentication and are made via Javascript
-            Ajax calls.  CSRF does not apply here.  The admin REST API can also be configured to validate CORS origins
-            as well.
-        </para>
-        <para>
-            The only part of Keycloak that really falls into CSRF is the user account management pages.  To mitigate this
-            Keycloak sets a state cookie and also embeds the value of this state cookie within hidden form fields or
-            query parameters in action links.  This query or form parameter is checked against the state cookie to verify
-            that the call was made by the user.
-        </para>
-    </section>
-    <section>
-        <title>Clickjacking</title>
-        <para>
-            With clickjacking, a malicious site loads the target site in a
-            transparent iFrame overlaid on top of a set of dummy
-            buttons that are carefully constructed to be placed directly under
-            important buttons on the target site.  When a user clicks a visible
-            button, they are actually clicking a button (such as an "Authorize"
-            button) on the hidden page.  An attacker can steal a user's authentication credentials and
-            access their resources.
-        </para>
-        <para>
-            By default, every response by Keycloak sets some specific browser headers that can prevent this from happening
-            specifically <ulink url="http://tools.ietf.org/html/rfc7034">X-FRAME_OPTIONS</ulink> and <ulink url="http://www.w3.org/TR/CSP/">Content-Security-Policy</ulink>.  You
-            should take a look at both of these headers.  In the admin console you can specify the values these headers will
-            have.  By default, Keycloak only sets up a same-origin policy for iframes.
-        </para>
-    </section>
-    <section>
-        <title>Compromised Access Codes</title>
-        <para>
-            It would be very hard for an attacker to compromise Keycloak access codes.  Keycloak generates a cryptographically
-            strong random value for its access codes so it would be very hard to guess an access token.
-            An access code can only be turned into an access token once so it can't be replayed.  In the admin console
-            you can specify how long an access token is valid for.  This value should be really short.  Like a seconds.
-            Just long enough for the client to make the request to turn the code into an token.
-        </para>
-    </section>
-    <section>
-        <title>Compromised access and refresh tokens</title>
-        <para>
-            There's a few things you can do to mitigate access tokens and refresh tokens from being stolen.
-            Most importantly is to enforce SSL/HTTPS communication between Keycloak and its clients and applications.
-            Short lifespans (minutes) for access tokens allows Keycloak to check the validity of a refresh token.  Making
-            sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.
-        </para>
-        <para>
-            If an access token or refresh token is compromised, the first thing you should do is go to the admin console
-            and push a not-before revocation policy to all applications.  This will enforce that any tokens issued
-            prior to that date are now invalid.  You can also disable specific applications, clients, and users if you
-            feel that any one of those entities is completely compromised.
-        </para>
-    </section>
-    <section>
-        <title>Open redirectors</title>
-        <para>
-            An attacker could use the end-user authorization endpoint and the
-            redirect URI parameter to abuse the authorization server as an open
-            redirector.  An open redirector is an endpoint using a parameter to
-            automatically redirect a user agent to the location specified by the
-            parameter value without any validation.  An attacker could utilize a user's trust in an authorization
-            server to launch a phishing attack.
-        </para>
-        <para>
-            Keycloak requires that all registered applications and clients register at least one redirection uri pattern.
-            Any time a client asks Keycloak to perform a redirect (on login or logout for example), Keycloak will
-            check the redirect uri vs. the list of valid registered uri patterns.  It is important that clients and
-            applications register as specific a URI pattern as possible to mitigate open redirector attacks.
-        </para>
-    </section>
-    <section>
-        <title>Password guess: brute force attacks</title>
-        <para>
-            A brute force attack happens when an attacker is trying to guess a user's password.  Keycloak has some
-            limited brute force detection capabilities.  If turned on, a user account will be temporarily disabled
-            if a threshold of login failures is reached.  The downside of this is that this makes Keycloak vulnerable
-            to denial of service attacks.  Eventually we will expand this functionality to take client IP address into
-            account when deciding whether to block a user.
-        </para>
-        <para>
-            Another thing you can do to prevent password guessing is to point a tool like <ulink url="http://fail2ban.org">Fail2Ban</ulink> to the Keycloak
-            server's log file.  Keycloak logs every login failure and client IP address that had the failure.
-        </para>
-        <para>
-            In the admin console, per realm, you can set up a password policy to enforce that users pick hard to guess passwords.
-        </para>
-        <para>
-            Finally, the best way to mitigate against brute force attacks is to require user to set up a one-time-password (OTP).
-        </para>
-    </section>
-    <section>
-        <title>Password database compromised</title>
-        <para>
-            Keycloak does not store passwords in raw text.  It stores a hash of them.  Because of performance reasons,
-            Keycloak only hashes passwords once.  While a human could probably never crack a hashed password, it is very
-            possible that a computer could.  The security community suggests around 20,000 (yes thousand!) hashing iterations
-            to be done to each password.  This number grows every year due to increasing computing power (It was 1000 12 years ago).
-            The problem with this is that password hashing is a huge performance hit as each login would require the entered
-            password to be hashed that many times and compared to the stored hash.  So, its up to the admin to configure the
-            password hash iterations.  This can be done in the admin console password policy configuration.  Again, the default
-            value is 1 as we thought it might be more important for Keycloak to scale out of the box.  There's a lot of
-            other measures admins can do to protect their password databases.
-        </para>
-    </section>
-    <section>
-        <title>SQL Injection attacks</title>
-        <para>
-            At this point in time, there is no knowledge of any SQL injection vulnerabilities in Keycloak
-        </para>
-    </section>
-</chapter>
@@ -8,11 +8,11 @@
        <itemizedlist>

            <listitem>
-                keycloak-appliance-dist-all-&project.version;.zip
+                keycloak-appliance-dist-all-1.0-rc-2.zip
            </listitem>

            <listitem>
-                keycloak-war-dist-all-&project.version;.zip
+                keycloak-war-dist-all-1.0-rc-2.zip
            </listitem>

        </itemizedlist>
@@ -22,7 +22,7 @@
        <title>Appliance Install</title>
        <para>
            The
-            <literal>keycloak-appliance-dist-all-&project.version;.zip</literal>
+            <literal>keycloak-appliance-dist-all.zip</literal>
            is quite large, but contains a complete server (backed by Wildfly)
            that runs out of the box. The only thing you'll have to enable and configure is SSL. Unzipping it, the
            directory layout looks
@@ -31,7 +31,7 @@

        <para>
 <programlisting>
-keycloak-appliance-dist-all-&project.version;/
+keycloak-appliance-dist-all-1.0-rc-2/
    keycloak/
        bin/
            standalone.sh
@@ -42,9 +42,9 @@ keycloak-appliance-dist-all-&project.version;/
                keycloak-server.json
                themes/
    adapters/
-        keycloak-as7-adapter-dist-&project.version;.zip
-        keycloak-eap6-adapter-dist-&project.version;.zip
-        keycloak-wildfly-adapter-dist-&project.version;.zip
+        keycloak-as7-adapter-dist-1.0-rc-2.zip
+        keycloak-eap6-adapter-dist-1.0-rc-2.zip
+        keycloak-wildfly-adapter-dist-1.0-rc-2.zip
    examples/
    docs/
 </programlisting>
@@ -67,7 +67,7 @@ keycloak-appliance-dist-all-&project.version;/
        <title>WAR Distribution Installation</title>
        <para>
            The
-            <literal>keycloak-war-dist-all-&project.version;.zip</literal>
+            <literal>keycloak-war-dist-all.zip</literal>
            contains
            just the bits you need to install keycloak on your favorite web container. We currently only support
            installing it on top of an existing JBoss AS 7.1.1, JBoss EAP 6.x, or Wildfly 8 distribution. We may in the
@@ -79,7 +79,7 @@ keycloak-appliance-dist-all-&project.version;/
        </para>
        <para>
 <programlisting>
-keycloak-war-dist-all-&project.version;/
+keycloak-war-dist-all-1.0-rc-2/
    deployments/
        auth-server.war/
        keycloak-ds.xml
@@ -87,9 +87,9 @@ keycloak-war-dist-all-&project.version;/
        keycloak-server.json
        themes/
    adapters/
-        keycloak-as7-adapter-dist-&project.version;.zip
-        keycloak-eap6-adapter-dist-&project.version;.zip
-        keycloak-wildfly-adapter-dist-&project.version;.zip
+        keycloak-as7-adapter-dist-1.0-rc-2.zip
+        keycloak-eap6-adapter-dist-1.0-rc-2.zip
+        keycloak-wildfly-adapter-dist-1.0-rc-2.zip
    examples/
    docs/
 </programlisting>
@@ -101,7 +101,7 @@ keycloak-war-dist-all-&project.version;/
        </para>
        <para>
 <programlisting>
-    $ cd keycloak-war-dist-all-&project.version;
+    $ cd keycloak-war-dist-all-1.0-rc-2
    $ cp -r deployments $JBOSS_HOME/standalone
    $ cp -r configuration $JBOSS_HOME/standalone
 </programlisting>
@@ -129,7 +129,7 @@ keycloak-war-dist-all-&project.version;/
            <itemizedlist>

                <listitem>
-                    Configuring Keycloak to use a production database.
+                    Configuring keycloak to use a production database.
                </listitem>

                <listitem>
@@ -144,14 +144,14 @@ keycloak-war-dist-all-&project.version;/
        <section>
            <title>Relational Database Configuration</title>
            <para>
-                By default, Keycloak uses a relational database to store Keycloak data.  This datasource is the <literal>standalone/deployments/keycloak-ds.xml</literal>
-                file of your Keycloak Server installation if you used <xref linkend="WAR_distribution_installation" /> or in <literal>standalone/configuration/standalone.xml</literal>
+                By default, Keycloak uses a relational database to store Keycloak data.  This datasource is the <literal>.../standalone/deployments/keycloak-ds.xml</literal>
+                file of your Keycloak Server installation if you used <xref linkend="WAR_distribution_installation" /> or in <literal>.../standalone/configuration/standalone.xml</literal>
                if you used <xref linkend="Appliance_install" />. File <literal>keycloak-ds.xml</literal> is used in WAR
                distribution, so that you have datasource available out of the box and you don't need to edit <literal>standalone.xml</literal> file.
                However a good thing is to always delete the file  <literal>keycloak-ds.xml</literal> and move its configuration text
                into the centrally managed <literal>standalone.xml</literal> file.
                This will allow you to manage the database connection pool from the Wildfly/JBoss administration console.  Here's what
-                <literal>standalone/configuration/standalone.xml</literal> should look like after you've done this:
+                <literal>.../standalone/configuration/standalone.xml</literal> should look like after you've done this:
            </para>
            <para>
 <programlisting><![CDATA[
@@ -180,8 +180,8 @@ keycloak-war-dist-all-&project.version;/
            <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
         </driver>
      </drivers>
-   </datasources>
-</subsystem>
+            </datasources>
+        </subsystem>
 ]]>
 </programlisting>
            </para>
@@ -206,6 +206,16 @@ keycloak-war-dist-all-&project.version;/
 ]]></programlisting>
                Possible configuration options are:
                <variablelist>
+                    <varlistentry>
+                        <term>unitName</term>
+                        <listitem>
+                            <para>
+                                Allow you to specify name of persistence unit if you want to provide your own persistence.xml file for JPA configuration.
+                                If this option is used, then all other configuration options are ignored as you are expected to configure
+                                all JPA/DB properties in your own persistence.xml file. Hence you can remove properties "dataSource" and "databaseSchema" in this case.
+                            </para>
+                        </listitem>
+                    </varlistentry>
                    <varlistentry>
                        <term>dataSource</term>
                        <listitem>
@@ -255,16 +265,6 @@ keycloak-war-dist-all-&project.version;/
                            </para>
                        </listitem>
                    </varlistentry>
-                    <varlistentry>
-                        <term>unitName</term>
-                        <listitem>
-                            <para>
-                                Allow you to specify name of persistence unit if you want to provide your own persistence.xml file for JPA configuration.
-                                If this option is used, then all other configuration options are ignored as you are expected to configure
-                                all JPA/DB properties in your own persistence.xml file. Hence you can remove properties "dataSource" and "databaseSchema" in this case.
-                            </para>
-                        </listitem>
-                    </varlistentry>
                </variablelist>
                For more info about Hibernate properties, see <ulink url="http://hibernate.org/orm/documentation/">Hibernate and JPA documentation</ulink> .
            </para>
@@ -350,9 +350,6 @@ keycloak-war-dist-all-&project.version;/
                <programlisting><![CDATA[
 "eventsStore": {
    "provider": "mongo",
-    "mongo": {
-        "exclude-events": [ "REFRESH_TOKEN" ]
-    }
 },

 "realm": {
@@ -361,7 +358,7 @@ keycloak-war-dist-all-&project.version;/

 "user": {
    "provider": "mongo"
-},
+}
 ]]></programlisting>

                And at the end of the file add the snippet like this where you can configure details about your Mongo database:
@@ -404,7 +401,7 @@ keycloak-war-dist-all-&project.version;/
 ]]>
 </programlisting>
        </section>
-        <section id="ssl_modes">
+        <section>
            <title>SSL/HTTPS Requirement/Modes</title>
            <warning>
                <para>
@@ -671,6 +668,17 @@ keycloak-war-dist-all-&project.version;/
 </web-app>]]></programlisting>
                </para>
            </section>
+
+            <section>
+                <title>Enforce HTTPS at Realm Level</title>
+                <para>
+                    In Keycloak, each realm has an "Require SSL" switch that you should turn on.  Log into the
+                    adminstration console and set this switch for each realm that Keycloak manages.  This switch is on
+                    the <literal>Settings>>General</literal> page.  While this switch does do similar checks as the security
+                    constraint in <literal>web.xml</literal>, it will also force applications and oauth clients to only
+                    register HTTPS based redirect URLs.
+                </para>
+            </section>
        </section>

    </section>
@@ -22,13 +22,6 @@
                the list and the status should be <literal>ON</literal>).
            </para>
        </listitem>
-        <listitem>
-            <para>
-                Now click on the <literal>Consent screen</literal> link on the sidebar menu on the left.  You must specify
-                a project name and choose an email for the consent screen.  Otherwise users will get a login error.  There's
-                other things you can configure here like what the consent screen looks like.  Feel free to play around with this.
-            </para>
-        </listitem>
        <listitem>
            <para>
                Now click <literal>Credentials</literal> in the sidebar on the left. Then click
@@ -47,4 +40,9 @@
            </para>
        </listitem>
    </orderedlist>
+    <para>
+        You may also want to configure how the Google Consent Screen looks when users log in to your application via
+        Google. To do this go to <ulink url="https://cloud.google.com/console/project">Google Developer Console</ulink>
+        and click on <literal>Consent Screen</literal> in the sidebar to the left.
+    </para>
 </section>
@@ -6,37 +6,13 @@
        and feel of end-user facing pages so they can be integrated with your brand and applications.
    </para>

-    <section>
-        <title>Theme types</title>
-        <para>
-            There are several types of themes in Keycloak:
-            <itemizedlist>
-                <listitem>Account - Account management</listitem>
-                <listitem>Admin - Admin console</listitem>
-                <listitem>Common - Shared resources for themes</listitem>
-                <listitem>Email - Emails</listitem>
-                <listitem>Login - Login forms</listitem>
-                <listitem>Welcome - Welcome pages</listitem>
-            </itemizedlist>
-        </para>
-    </section>
-
    <section>
        <title>Configure theme</title>
        <para>
-            All theme types, except welcome, is configured through <literal>Keycloak Admin Console</literal>. To change
-            the theme used for a realm open the open the <literal>Keycloak Admin Console</literal>, select your realm
-            from the drop-down box in the top left corner. Under <literal>Settings</literal> click on <literal>Theme</literal>.
-        </para>
-        <para>
-            To change the welcome theme you need to edit <literal>standalone/configuration/keycloak-server.json</literal>
-            and add <literal>welcomeTheme</literal> to the theme element, for example:
-<programlisting>
-"theme": {
-    ...
-    "welcomeTheme": "custom-theme"
-}
-</programlisting>
+            To configure the theme used by a realm open the <literal>Keycloak Admin Console</literal>, select your realm
+            from the drop-down box in the top left corner. In the <literal>Optional Settings</literal> use the drop-down
+            boxes for <literal>Login Theme</literal> and <literal>Account Theme</literal> to select the theme used
+            by login forms and account management pages.
        </para>
    </section>

@@ -51,15 +27,26 @@

    <section>
        <title>Creating a theme</title>
+        <para>
+            There are several types of themes in Keycloak:
+            <itemizedlist>
+                <listitem>Account - Account management</listitem>
+                <listitem>Admin - Admin console</listitem>
+                <listitem>Common - Shared resources for themes</listitem>
+                <listitem>Email - Emails</listitem>
+                <listitem>Login - Login forms</listitem>
+            </itemizedlist>
+        </para>
+
        <para>
            A theme consists of:
            <itemizedlist>
-                <listitem><ulink url="http://freemarker.org">FreeMarker</ulink> templates</listitem>
-                <listitem>Stylesheets</listitem>
-                <listitem>Scripts</listitem>
-                <listitem>Images</listitem>
-                <listitem>Message bundles</listitem>
-                <listitem>Theme properties</listitem>
+                <listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
+                <listitem><para>Stylesheets</para></listitem>
+                <listitem><para>Scripts</para></listitem>
+                <listitem><para>Images</para></listitem>
+                <listitem><para>Message bundles</para></listitem>
+                <listitem><para>Theme properties</para></listitem>
            </itemizedlist>
        </para>
        <para>
@@ -69,7 +56,7 @@
            templates.
        </para>
        <para>
-            To create a new theme, create a folder in <literal>.../standalone/configuration/themes/&lt;theme type&gt;</literal>.
+            To create a new theme, create a folder in <literal>.../standalone/configuration/themes/&lt; theme type&gt;</literal>.
            The name of the folder is the name of the theme. Then create a file <literal>theme.properties</literal> inside the theme folder.
            The contents of the file should be:
        </para>
@@ -92,7 +79,6 @@
            <programlisting>styles=css/styles.css css/more-styles.css</programlisting>
        </section>
        <section>
-            <title>Scripts</title>
            <para>
                A theme can have one or more scripts, to add a script create a file inside <literal>resources/js</literal> (for example <literal>resources/js/script.js</literal>)
                inside your theme folder. Then registering it in <literal>theme.properties</literal> by adding:
@@ -147,9 +133,10 @@
        <section>
            <title>Theme SPI</title>
            <para>
-                The Theme SPI allows creating different mechanisms to load themes for the default FreeMarker based
+                The Theme SPI allows creating different mechanisms to providing themes for the default FreeMarker based
                implementations of login forms and account management. To create a theme provider you will need to implement
-                <literal>org.keycloak.freemarker.ThemeProviderFactory</literal> and <literal>org.keycloak.freemarker.ThemeProvider</literal>.
+                <literal>org.keycloak.freemarker.ThemeProvider</literal> and <literal>org.keycloak.freemarker.Theme</literal> in
+                <literal>forms/common-freemarker</literal>.
            </para>
            <para>
                Keycloak comes with two theme providers, one that loads themes from the classpath (used by default themes)
@@ -163,15 +150,12 @@
            <para>
                The Account SPI allows implementing the account management pages using whatever web framework or templating
                engine you want. To create an Account provider implement <literal>org.keycloak.account.AccountProviderFactory</literal>
-                and <literal>org.keycloak.account.AccountProvider</literal>.
+                and <literal>org.keycloak.account.AccountProvider</literal> in <literal>forms/account-api</literal>.
            </para>
            <para>
-                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
-<programlisting>
-"account": {
-    "provider": "custom-provider"
-}
-</programlisting>
+                Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-1.0-rc-2.jar</literal>
+                or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
            </para>
        </section>
        <section>
@@ -182,12 +166,9 @@
                and <literal>org.keycloak.login.LoginFormsProvider</literal> in <literal>forms/login-api</literal>.
            </para>
            <para>
-                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
-<programlisting>
-"login": {
-    "provider": "custom-provider"
-}
-</programlisting>
+                Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-1.0-rc-2.jar</literal>
+                or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
            </para>
        </section>
    </section>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -1,48 +0,0 @@
-Keycloak Examples
-=================
-
-This directory contains a number of examples for Keycloak.
-
-Demo
----
-
-This is the our main example, which shows Login, Single-Sign On, Single-Sign Out and OAuth Token Grant. The demo comes in two flavours: 
-
-* Preconfigured - Use this flavour to quickly deploy the demo to a local Keycloak server without having to configure anything other than importing the realm settings into Keycloak
-* Unconfigured - Use this flavour to manually configure and deploy the demo to either a local or external Keycloak server
-
-For more information look at `preconfigured-demo/README.md` or `unconfigured-demo/README.md`. For the unconfigured-demo there's an accompanying screencast at [http://keycloak.org/docs](http://keycloak.org/docs) that walks you through the setup process.
-
-
-Cordova
-------
-
-Example Cordova application. For more information look at `cordova/README.md`.
-
-
-CORS
----
-
-Example CORS application. For more information look at `cors/README.md`.
-
-
-JS Console
----------
-
-Example JavaScript application that let's you experiment with the JavaScript adapter. For more information look at `js-console/README.md`.
-
-
-Providers
---------
-
-Example providers for Event Listener SPI, Event Store SPI and User Federation SPI. For more information look at:
-
-* Event Listener that outputs event detalis to sysout - `providers/event-listener-sysout/README.md`
-* Event Store that stores events in memory - `providers/event-store-mem/README.md`
-* User Federation that loads users from a text file - `providers/federation-provider/README.md`
-
-
-Themes
------
-
-Example themes to change the look and feel of login forms, account management console and admin console. For more information look at `themes/README.md`.
@@ -35,6 +35,12 @@
            }
        ]
    },
+    "roleMappings": [
+        {
+            "username": "user",
+            "roles": ["user"]
+        }
+    ],
    "scopeMappings": [
        {
            "client": "cordova",
@@ -46,10 +52,17 @@
            "name": "cordova",
            "enabled": true,
            "publicClient": true,
-            "redirectUris": ["http://localhost"],
-            "webOrigins": ["localhost"]
+            "redirectUris": []
        }
    ],
+    "applicationRoleMappings": {
+        "account": [
+            {
+                "username": "user",
+                "roles": ["view-profile", "manage-account"]
+            }
+        ]
+    },
    "applicationScopeMappings": {
        "account": [
            {
@@ -10,5 +10,5 @@

    <gap:plugin name="org.apache.cordova.inappbrowser" />

-    <access origin="*"/>
+    <access origin="http://*"/>
 </widget>
@@ -28,7 +28,7 @@
        }

        document.addEventListener("deviceready", function() {
-            keycloak.init({ onLoad: 'check-sso' }).success(updateState);
+            keycloak.init({ onLoad: 'check-sso' });
        }, false);
    </script>
 </head>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -34,7 +34,6 @@
            </tbody>
        </table>
    </div>
-    <hr />
    <div>
        <h2><span>Realm Roles</span></h2>
        <button type="submit" data-ng-click="loadRoles()">load Roles</button>
@@ -53,34 +52,6 @@
            </tbody>
        </table>
    </div>
-    <hr />
-    <div>
-        <h2><span>Social providers</span></h2>
-        <button type="submit" data-ng-click="loadServerInfo()">load available social providers</button>
-        <table class="table" data-ng-show="serverInfo.socialProviders.length > 0">
-            <thead>
-            <tr>
-                <th>Available social providers</th>
-            </tr>
-            </thead>
-            <tbody>
-            <tr data-ng-repeat="sp in serverInfo.socialProviders">
-                <td>{{sp}}</a></td>
-            </tr>
-            </tbody>
-        </table>
-    </div>
-    <hr />
-    <div>
-        <h2><span>Realm info</span></h2>
-        <button type="submit" data-ng-click="loadPublicRealmInfo()">Load public realm info</button>
-
-        <div data-ng-show="realm">
-            Realm name: {{realm.realm}} <br/>
-            Public key: {{realm.public_key}} <br/>
-        </div>
-    </div>
-    <hr />
 </div>
 </body>
 </html>
@@ -58,20 +58,6 @@ module.controller('GlobalCtrl', function($scope, $http) {
        });

    };
-
-    $scope.loadServerInfo = function() {
-        $http.get("http://localhost-auth:8080/auth/admin/serverinfo").success(function(data) {
-            $scope.serverInfo = angular.fromJson(data);
-        });
-
-    };
-
-    $scope.loadPublicRealmInfo = function() {
-        $http.get("http://localhost-auth:8080/auth/realms/cors").success(function(data) {
-            $scope.realm = angular.fromJson(data);
-        });
-    };
-
    $scope.logout = logout;
 });

@@ -1,11 +1,9 @@
 {
    "realm": "cors",
    "enabled": true,
-    "accessTokenLifespan": 60,
-    "accessCodeLifespan": 60,
-    "accessCodeLifespanUserAction": 300,
-    "ssoSessionIdleTimeout": 600,
-    "ssoSessionMaxLifespan": 36000,
+    "accessTokenLifespan": 3000,
+    "accessCodeLifespan": 10,
+    "accessCodeLifespanUserAction": 6000,
    "sslRequired": "external",
    "registrationAllowed": false,
    "social": false,
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -112,7 +112,7 @@ Next thing you have to do is import the test realm for the demo.  Clicking on th
 create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
 create a new admin password before you can go to the create realm page.

-[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+[http://localhost:8080/auth/admin/index.html#/create/realm](http://localhost:8080/auth/admin/index.html#/create/realm)

 Import the testrealm.json file that is in the preconfigured-demo/ example directory.

@@ -0,0 +1,10 @@
+Login, Distributed SSO, Distributed Logout, and OAuth Token Grant Examples
+===================================
+
+Preconfigured Examples
+===================================
+The Preconfigured Examples (in 'preconfigured-demo') contains pre-configured examples that can be deployed without having to configure anything except importing the realm settings into Keycloak. To try this out follow the instructions in preconfigured-demo/README.md.
+
+Unconfigured Examples
+===================================
+The Unconfigured Examples (in 'unconfigured-demo') contains examples without any Keycloak specific configuration. These should be used in conjunction with the online screencasts tutorials at [http://keycloak.org/docs](http://keycloak.org/docs).
@@ -1,137 +1,10 @@
 Unconfigured Examples
 ===================================
 This set of projects contains a stripped down version of the demo described in preconfigured-demo.  All keycloak specific
-configuration has been removed. Use this project in conjunction with instructions below and/or the online screencast tutorials at
+configuration has been removed.  Use this project in conjunction with the online screencast tutorials at
 [http://keycloak.org/docs](http://keycloak.org/docs).


-# Run Demo with an external Keycloak Server
-
-These instructions assume you've already installed and started a Keycloak Server. Keycloak can be running on your locally or remotely (for example on OpenShift). If you're not running Keycloak locally you'll also need a locally running WildFly server.
-
-## Create Realm
-
-Open the Keycloak admin console and click on `Add Realm`. Enter `demo` as the name for the realm and click `Save`.
-
-The demo applications uses two realm roles, `user` and `admin`, so the next step is to create these. Click on `Roles` then click on `Add Role`. Use `user` as the role name and click `Save`. Repeat to create a role with the name `admin`.
-
-Next you'll either want to enable user registration or create a new user.
-
-### Enable user registration
-
-To enable user registration first click on `Roles` then `Default Roles`. Select the `user` role and click on the right arrow. This will make sure that all new users are automatically assigned the `user` role. Next step is to enable user registration for the realm. Click on `Settings` then `Login`. Click on the toggle for `user registration` to allow users to self-register.
-
-### Create user
-
-To create a new user click on `Users` then `Add User`. You are required to at least fill in the `username` field, but you may want to fill in values for the other fields as well. After you've completed the form click on `Save`. To allow the user to login you also need to set a password for the user. To do this click on `Credentials`. Enter a new password for the user. If you leave the `Temporary` toggle ON the user will be required to reset the password on the next login.


-## Deploy Demo Applications

-First you need to install WildFly application server. Second step is to install the Keycloak WildFly subsystem. To do this run:
-
-    # cd <WILDFLY HOME>
-    # unzip <KEYCLOAK DIST>/adapters/keycloak-wildfly-adapter-dist-<KEYCLOAK VERSION>.zip
-
-Next configure the Keycloak adapter by editing `standalone/configuration/standalone.xml`. Add a new child-element to `<extensions>`:
-
-    <extensions>
-        ....
-        <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
-    </extensions>
-
-You also need to add realm config to the same file. Add a new child-element to `<profile>`:
-
-    <profile>
-        ....
-        <subsystem xmlns="urn:jboss:domain:keycloak:1.0">
-            <realm name="demo">
-                <realm-public-key>REALM PUBLIC KEY</realm-public-key>
-                <auth-server-url>KEYCLOAK URL</auth-server-url>
-                <ssl-required>external</ssl-required>
-            </realm>
-        </subsystem>
-    </profile>
-
-In the above snippet replace the following:
-
-* `REALM PUBLIC KEY` - replace with the public key for the realm. You can find this in the admin console by selecting the realm, then clicking on `Keys`
-* `KEYCLOAK URL` - replace with the base url of Keycloak (for example http://localhost:8080/auth or http://keycloak.example.org/auth)
-
-Don't start the WildFly server until you've configured and deployed the demo applications.
-
-### Database Services
-
-Most demo applications connects to the REST services provided by the database-services application, so start with deploying this.
-
-Run the following to deploy it:
-
-    # cd database-services
-    # mvn install
-    # cp target/database.war <WILDFLY HOME>/standalone/deployments
-
-Next add the configuration for it to the Keycloak subsystem. Edit `<WILDFLY HOME>/standalone/configuration/standalone.xml` to `<subsystem xmlns="urn:jboss:domain:keycloak:1.0">` add:
-
-    <secure-deployment name="database.war">
-        <realm>demo</realm>
-        <resource>database-service</resource>
-        <bearer-only>true</bearer-only>
-    </secure-deployment>
-
-### Customer Portal
-
-Next deploy the customer portal application.
-
-Run the following to deploy it:
-
-    # cd customer-app
-    # mvn install
-    # cp target/customer-portal.war <WILDFLY HOME>/standalone/deployments
-
-Then open the Keycloak admin console to add a configuration for it. Navigate to the realm and click on `Applications` then `Add Application`. Fill in the form with:
-
-* Name - `customer-portal`
-* Redirect URI - `http://localhost:8080/customer-portal/*` (click `Add` after filling in the field)
-
-Then click on `Save`. As it's a confidential (non-public) application you need the secret for it. Click on `Credentials` and note the value of the `Secret` field.
-
-Then edit `<WILDFLY HOME>/standalone/configuration/standalone.xml` and add the following to `<subsystem xmlns="urn:jboss:domain:keycloak:1.0">`:
-
-    <secure-deployment name="customer-portal.war">
-        <realm>demo</realm>
-        <resource>customer-portal</resource>
-        <credential name="secret">APPLICATION SECRET</credential>
-    </secure-deployment>
-
-In the above snippet replace the following:
-
-* `APPLICATION SECRET` - replace with the applications secret you just noted from the Keycloak admin console
-
-### Product Portal
-
-Next deploy the product portal application.
-
-Run the following to deploy it:
-
-    # cd product-app
-    # mvn install
-    # cp target/product-portal.war <WILDFLY HOME>/standalone/deployments
-
-Then open the Keycloak admin console to add a configuration for it. Navigate to the realm and click on `Applications` then `Add Application`. Fill in the form with:
-
-* Name - `product-portal`
-* Redirect URI - `http://localhost:8080/product-portal/*` (click `Add` after filling in the field)
-
-Then click on `Save`. As it's a confidential (non-public) application you need the secret for it. Click on `Credentials` and note the value of the `Secret` field.
-
-Then edit `<WILDFLY HOME>/standalone/configuration/standalone.xml` and add the following to `<subsystem xmlns="urn:jboss:domain:keycloak:1.0">`:
-
-    <secure-deployment name="product-portal.war">
-        <realm>demo</realm>
-        <resource>product-portal</resource>
-        <credential name="secret">484ba263-8bb5-4048-bb6f-40da75e9eefb</credential>
-    </secure-deployment>
-
-In the above snippet replace the following:
-
-* `APPLICATION SECRET` - replace with the applications secret you just noted from the Keycloak admin console
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath> 
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Listener System.out Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Store In-Mem Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Properties Authentication Provider Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Provider Examples</name>
@@ -1,33 +1,4 @@
-Example Themes
-==============
+Example Login Theme
+===================

-Sunrise Login Theme
-------------------
-
-Example login theme that changes the look of the login forms.
-
-To use the theme copy `login/sunrise` to `standalone/configuration/themes/login/`. Open the admin console, select your realm, click on `Theme`. In the dropdown for `Login Theme` select `sunrise`. Click `Save` and login to the realm to see the new theme in action.
-
-
-Change Logo Theme
-----------------
-
-Example themes for login forms, account management, admin console and welcome pages that changes the Keycloak logo.
-
-To use the themes copy:
-
-* `account/logo-example` to `standalone/configuration/themes/account/`
-* `login/logo-example` to `standalone/configuration/themes/login/`
-* `admin/logo-example` to `standalone/configuration/themes/admin/`
-* `welcome/logo-example` to `standalone/configuration/themes/welcome/`
-
-Open the admin console, select your realm, click on `Theme`. In the dropdowns for `Login Theme`, `Account Theme` and `Admin Console Theme` select `logo-example`. Click `Save` and login to the realm to see the new theme in action.
-
-To change the theme for the welcome pages open `standalone/configuration/keycloak-server.json` find the config for `theme` and add 'welcomeTheme':
-
-    "theme": {
-        ...
-        "welcomeTheme": "logo-example"
-    },
-
-One thing to note is that to change the admin console for the master admin console (`/auth/admin`) you need to change the theme for the master realm. Changing the admin console theme for any other realms will only change the admin console for that specific realm (for example `/auth/admin/myrealm/console`).
+To deploy copy login/sunrise to standalone/configuration/themes/login/. Open the admin console, select your realm, in the drop-down for login theme select sunrise. Then login to your realm to see the new theme in action.
@@ -1,8 +0,0 @@
-.navbar-title {
-    background-image: url('../img/red-hat-logo.png');
-    height: 65px;
-    background-repeat: no-repeat;
-    width: 203px;
-    margin: 3px 10px 5px;
-    text-indent: -99999px;
-}
@@ -1,4 +0,0 @@
-parent=keycloak
-import=common/keycloak
-
-styles= ../patternfly/lib/patternfly/css/patternfly.css ../patternfly/css/account.css ../keycloak/css/account.css css/account.css
@@ -1,8 +0,0 @@
-.navbar-title {
-    background-image: url('../img/red-hat-logo.png');
-    height: 65px;
-    background-repeat: no-repeat;
-    width: 203px;
-    margin: 3px 10px 5px;
-    text-indent: -99999px;
-}
@@ -1,2 +0,0 @@
-parent=keycloak
-import=common/keycloak
@@ -1,9 +0,0 @@
-#kc-logo-wrapper {
-    background-image: url("../img/red-hat-logo.png");
-    background-repeat: no-repeat;
-    background-position: top right;
-
-    height: 65px;
-
-    margin: 100px;
-}
@@ -1,4 +0,0 @@
-parent=keycloak
-import=common/keycloak
-
-styles= ../patternfly/lib/patternfly/css/patternfly.css ../patternfly/css/login.css ../patternfly/lib/zocial/zocial.css ../keycloak/css/login.css css/login.css
@@ -1,50 +0,0 @@
-<!--
-  ~ JBoss, Home of Professional Open Source.
-  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
-  ~ as indicated by the @author tags. See the copyright.txt file in the
-  ~ distribution for a full listing of individual contributors.
-  ~
-  ~ This is free software; you can redistribute it and/or modify it
-  ~ under the terms of the GNU Lesser General Public License as
-  ~ published by the Free Software Foundation; either version 2.1 of
-  ~ the License, or (at your option) any later version.
-  ~
-  ~ This software is distributed in the hope that it will be useful,
-  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
-  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-  ~ Lesser General Public License for more details.
-  ~
-  ~ You should have received a copy of the GNU Lesser General Public
-  ~ License along with this software; if not, write to the Free
-  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
-  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
-  -->
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
-
-<html>
-<head>
-    <title>Welcome to Keycloak</title>
-    <link rel="shortcut icon" href="welcome-content/favicon.ico" type="image/x-icon">
-    <link rel="StyleSheet" href="welcome-content/keycloak.css" type="text/css">
-</head>
-
-<body>
-<div class="wrapper">
-    <div class="content">
-        <div class="logo">
-                <img src="welcome-content/red-hat-logo.png" alt="Red Hat" border="0" />
-        </div>
-        <h1>Welcome to Keycloak</h1>
-
-        <h3>Your Keycloak is running.</h3>
-
-        <p><a href="http://www.keycloak.org/docs">Documentation</a> | <a href="admin/">Administration Console</a> </p>
-
-        <p><a href="http://www.keycloak.org">Keycloak Project</a> |
-            <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">Mailing List</a> |
-            <a href="https://issues.jboss.org/browse/KEYCLOAK">Report an issue</a></p>
-        <p class="logos"><a href="http://www.jboss.org"><img src="welcome-content/jboss_community.png" alt="JBoss and JBoss Community" width="254" height="31" border="0"></a></p>
-    </div>
-</div>
-</body>
-</html>
@@ -1 +0,0 @@
-parent=keycloak
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -1,7 +1,6 @@
 package org.keycloak.exportimport.util;

 import org.jboss.logging.Logger;
-import org.keycloak.Version;
 import org.keycloak.exportimport.ExportImportConfig;
 import org.keycloak.exportimport.ExportProvider;
 import org.keycloak.exportimport.UsersExportStrategy;
@@ -38,19 +37,12 @@ public abstract class MultipleStepsExportProvider implements ExportProvider {
        });

        for (RealmModel realm : holder.realms) {
-            exportRealmImpl(factory, realm.getName());
+            exportRealm(factory, realm.getName());
        }
-
-        writeVersion("version.json", Version.SINGLETON);
    }

    @Override
-    public void exportRealm(KeycloakSessionFactory factory, String realmName) throws IOException {
-        exportRealmImpl(factory, realmName);
-        writeVersion("version.json", Version.SINGLETON);
-    }
-
-    protected void exportRealmImpl(KeycloakSessionFactory factory, final String realmName) throws IOException {
+    public void exportRealm(KeycloakSessionFactory factory, final String realmName) throws IOException {
        final UsersExportStrategy usersExportStrategy = ExportImportConfig.getUsersExportStrategy();
        final int usersPerFile = ExportImportConfig.getUsersPerFile();
        final UsersHolder usersHolder = new UsersHolder();
@@ -110,8 +102,6 @@ public abstract class MultipleStepsExportProvider implements ExportProvider {

    protected abstract void writeUsers(String fileName, KeycloakSession session, RealmModel realm, List<UserModel> users) throws IOException;

-    protected abstract void writeVersion(String fileName, Version version) throws IOException;
-
    public static class RealmsHolder {
        List<RealmModel> realms;

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -1,6 +1,5 @@
 package org.keycloak.exportimport.dir;

-import org.keycloak.Version;
 import org.keycloak.exportimport.util.ExportUtils;
 import org.keycloak.exportimport.util.MultipleStepsExportProvider;
 import org.keycloak.models.KeycloakSession;
@@ -69,13 +68,6 @@ public class DirExportProvider extends MultipleStepsExportProvider {
        ExportUtils.exportUsersToStream(session, realm, users, JsonSerialization.prettyMapper, os);
    }

-    @Override
-    protected void writeVersion(String fileName, Version version) throws IOException {
-        File file = new File(this.rootDirectory, fileName);
-        FileOutputStream stream = new FileOutputStream(file);
-        JsonSerialization.prettyMapper.writeValue(stream, version);
-    }
-
    @Override
    public void close() {
    }
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,6 @@ import de.idyl.winzipaes.AesZipFileEncrypter;
 import de.idyl.winzipaes.impl.AESEncrypter;
 import de.idyl.winzipaes.impl.AESEncrypterBC;
 import org.jboss.logging.Logger;
-import org.keycloak.Version;
 import org.keycloak.exportimport.util.ExportUtils;
 import org.keycloak.exportimport.util.MultipleStepsExportProvider;
 import org.keycloak.models.KeycloakSession;
@@ -48,24 +47,17 @@ public class ZipExportProvider extends MultipleStepsExportProvider {
    protected void writeRealm(String fileName, RealmRepresentation rep) throws IOException {
        ByteArrayOutputStream stream = new ByteArrayOutputStream();
        JsonSerialization.mapper.writeValue(stream, rep);
-        writeStream(fileName, stream);
+
+        byte[] byteArray = stream.toByteArray();
+        ByteArrayInputStream bis = new ByteArrayInputStream(byteArray);
+        this.encrypter.add(fileName, bis, this.password);
    }

    @Override
    protected void writeUsers(String fileName, KeycloakSession session, RealmModel realm, List<UserModel> users) throws IOException {
        ByteArrayOutputStream stream = new ByteArrayOutputStream();
        ExportUtils.exportUsersToStream(session, realm, users, JsonSerialization.mapper, stream);
-        writeStream(fileName, stream);
-    }

-    @Override
-    protected void writeVersion(String fileName, Version version) throws IOException {
-        ByteArrayOutputStream stream = new ByteArrayOutputStream();
-        JsonSerialization.mapper.writeValue(stream, version);
-        writeStream(fileName, stream);
-    }
-
-    private void writeStream(String fileName, ByteArrayOutputStream stream) throws IOException {
        byte[] byteArray = stream.toByteArray();
        ByteArrayInputStream bis = new ByteArrayInputStream(byteArray);
        this.encrypter.add(fileName, bis, this.password);
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -45,6 +45,7 @@ public class LDAPUtils {
        picketlinkUser.setFirstName(firstName);
        picketlinkUser.setLastName(lastName);
        picketlinkUser.setEmail(email);
+        picketlinkUser.setAttribute(new Attribute("fullName", getFullName(username, firstName, lastName)));
        idmManager.update(picketlinkUser);
        return picketlinkUser;
    }
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.3.Final</version>
+        <version>1.0-rc-2</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.3.Final</version>
+		<version>1.0-rc-2</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -6,7 +6,6 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
 import org.keycloak.provider.Provider;

-import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
 import java.util.List;
@@ -28,8 +27,6 @@ public interface AccountProvider extends Provider {

    AccountProvider setUser(UserModel user);

-    AccountProvider setProfileFormData(MultivaluedMap<String, String> formData);
-
    AccountProvider setStatus(Response.Status status);

    AccountProvider setRealm(RealmModel realm);
@@ -42,7 +39,5 @@ public interface AccountProvider extends Provider {

    AccountProvider setPasswordSet(boolean passwordSet);

-    AccountProvider setStateChecker(String stateChecker);
-
    AccountProvider setFeatures(boolean social, boolean events, boolean passwordUpdateSupported);
 }
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.3.Final</version>
+		<version>1.0-rc-2</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -25,7 +25,6 @@ import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;

 import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
@@ -44,12 +43,10 @@ public class FreeMarkerAccountProvider implements AccountProvider {
    private static final Logger logger = Logger.getLogger(FreeMarkerAccountProvider.class);

    private UserModel user;
-    private MultivaluedMap<String, String> profileFormData;
    private Response.Status status = Response.Status.OK;
    private RealmModel realm;
    private String[] referrer;
    private List<Event> events;
-    private String stateChecker;
    private List<UserSessionModel> sessions;
    private boolean socialEnabled;
    private boolean eventsEnabled;
@@ -110,10 +107,6 @@ public class FreeMarkerAccountProvider implements AccountProvider {
        }
        URI baseQueryUri = baseUriBuilder.build();

-        if (stateChecker != null) {
-            attributes.put("stateChecker", stateChecker);
-        }
-
        if (message != null) {
            attributes.put("message", new MessageBean(messages.containsKey(message) ? messages.getProperty(message) : message, messageType));
        }
@@ -122,19 +115,19 @@ public class FreeMarkerAccountProvider implements AccountProvider {
            attributes.put("referrer", new ReferrerBean(referrer));
        }

-        attributes.put("url", new UrlBean(realm, theme, baseUri, baseQueryUri, uriInfo.getRequestUri(), stateChecker));
+        attributes.put("url", new UrlBean(realm, theme, baseUri, baseQueryUri, uriInfo.getRequestUri()));

        attributes.put("features", new FeaturesBean(socialEnabled, eventsEnabled, passwordUpdateSupported));

        switch (page) {
            case ACCOUNT:
-                attributes.put("account", new AccountBean(user, profileFormData));
+                attributes.put("account", new AccountBean(user));
                break;
            case TOTP:
                attributes.put("totp", new TotpBean(user, baseUri));
                break;
            case SOCIAL:
-                attributes.put("social", new AccountSocialBean(session, realm, user, uriInfo.getBaseUri(), stateChecker));
+                attributes.put("social", new AccountSocialBean(session, realm, user, uriInfo.getBaseUri()));
                break;
            case LOG:
                attributes.put("log", new LogBean(events));
@@ -189,12 +182,6 @@ public class FreeMarkerAccountProvider implements AccountProvider {
        return this;
    }

-    @Override
-    public AccountProvider setProfileFormData(MultivaluedMap<String, String> formData) {
-        this.profileFormData = formData;
-        return this;
-    }
-
    @Override
    public AccountProvider setRealm(RealmModel realm) {
        this.realm = realm;
@@ -225,12 +212,6 @@ public class FreeMarkerAccountProvider implements AccountProvider {
        return this;
    }

-    @Override
-    public AccountProvider setStateChecker(String stateChecker) {
-        this.stateChecker = stateChecker;
-        return this;
-    }
-
    @Override
    public AccountProvider setFeatures(boolean socialEnabled, boolean eventsEnabled, boolean passwordUpdateSupported) {
        this.socialEnabled = socialEnabled;
@@ -1,7 +1,5 @@
 package org.keycloak.account.freemarker.model;

-import javax.ws.rs.core.MultivaluedMap;
-
 import org.keycloak.models.UserModel;

 /**
@@ -9,20 +7,18 @@ import org.keycloak.models.UserModel;
 */
 public class AccountBean {

-    private final UserModel user;
-    private final MultivaluedMap<String, String> profileFormData;
+    private UserModel user;

-    public AccountBean(UserModel user, MultivaluedMap<String, String> profileFormData) {
+    public AccountBean(UserModel user) {
        this.user = user;
-        this.profileFormData = profileFormData;
    }

    public String getFirstName() {
-        return profileFormData != null ?  profileFormData.getFirst("firstName") : user.getFirstName();
+        return user.getFirstName();
    }

    public String getLastName() {
-        return profileFormData != null ?  profileFormData.getFirst("lastName") :user.getLastName();
+        return user.getLastName();
    }

    public String getUsername() {
@@ -30,7 +26,7 @@ public class AccountBean {
    }

    public String getEmail() {
-        return profileFormData != null ?  profileFormData.getFirst("email") :user.getEmail();
+        return user.getEmail();
    }

 }
@@ -25,7 +25,7 @@ public class AccountSocialBean {
    private final boolean removeLinkPossible;
    private final KeycloakSession session;

-    public AccountSocialBean(KeycloakSession session, RealmModel realm, UserModel user, URI baseUri, String stateChecker) {
+    public AccountSocialBean(KeycloakSession session, RealmModel realm, UserModel user, URI baseUri) {
        this.session = session;
        URI accountSocialUpdateUri = Urls.accountSocialUpdate(baseUri, realm.getName());
        this.socialLinks = new LinkedList<SocialLinkEntry>();
@@ -44,11 +44,7 @@ public class AccountSocialBean {
                        availableLinks++;
                    }
                    String action = socialLink != null ? "remove" : "add";
-                    String actionUrl = UriBuilder.fromUri(accountSocialUpdateUri)
-                            .queryParam("action", action)
-                            .queryParam("provider_id", socialProviderId)
-                            .queryParam("stateChecker", stateChecker)
-                            .build().toString();
+                    String actionUrl = UriBuilder.fromUri(accountSocialUpdateUri).queryParam("action", action).queryParam("provider_id", socialProviderId).build().toString();

                    SocialLinkEntry entry = new SocialLinkEntry(socialLink, provider.getName(), actionUrl);
                    this.socialLinks.add(entry);
@@ -44,8 +44,6 @@ public class SessionsBean {
            this.session = session;
        }

-        public String getId() {return session.getId(); }
-
        public String getIpAddress() {
            return session.getIpAddress();
        }
@@ -16,15 +16,13 @@ public class UrlBean {
    private URI baseURI;
    private URI baseQueryURI;
    private URI currentURI;
-    private String stateChecker;

-    public UrlBean(RealmModel realm, Theme theme, URI baseURI, URI baseQueryURI, URI currentURI, String stateChecker) {
+    public UrlBean(RealmModel realm, Theme theme, URI baseURI, URI baseQueryURI, URI currentURI) {
        this.realm = realm.getName();
        this.theme = theme;
        this.baseURI = baseURI;
        this.baseQueryURI = baseQueryURI;
        this.currentURI = currentURI;
-        this.stateChecker = stateChecker;
    }

    public String getAccessUrl() {
@@ -56,11 +54,11 @@ public class UrlBean {
    }

    public String getSessionsLogoutUrl() {
-        return Urls.accountSessionsLogoutPage(baseQueryURI, realm, stateChecker).toString();
+        return Urls.accountSessionsLogoutPage(baseQueryURI, realm).toString();
    }

    public String getTotpRemoveUrl() {
-        return Urls.accountTotpRemove(baseQueryURI, realm, stateChecker).toString();
+        return Urls.accountTotpRemove(baseQueryURI, realm).toString();
    }

    public String getLogoutUrl() {
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.3.Final</version>
+		<version>1.0-rc-2</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>