Set version to 1.6.1.Final

KEYCLOAK-2005 Fixed migration to take less time. Added UserProvider.g…

.gitattributes

@@ -0,0 +1,20 @@
+* text=auto
+
+*.html text eol=lf
+*.java text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.jsp text eol=lf
+*.md text eol=lf
+*.properties text eol=lf
+*.svg text auto
+*.xml text eol=lf
+*.xsl text eol=lf
+
+*.png binary
+*.jpg binary
+*.gif binary
+*.ttf binary
+*.eot binary
+*.otf binary
+*.woff binary

.gitignore

@@ -9,6 +9,12 @@
 .settings
 .classpath
 
+# NetBeans #
+############
+nbactions.xml
+nb-configuration.xml
+catalog.xml
+
 # Compiled source #
 ###################
 *.com

.travis.yml

@@ -0,0 +1,19 @@
+language: java
+
+jdk:
+  - oraclejdk8
+
+cache:
+    directories:
+        - $HOME/.m2
+
+before_cache:
+  - rm -rf $HOME/.m2/repository/org/keycloak
+
+install: mvn install -Pdistribution -DskipTests=true -B -V
+
+script:
+  - mvn test -B
+  - mvn -file testsuite/integration-arquillian test -B
+
+sudo: false

README.md

@@ -1,35 +1,72 @@
-keycloak
+Keycloak
 ========
 
-Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
-and video tutorials.  
+Keycloak is an SSO Service for web apps and REST services. For more information visit [http://keycloak.org](http://keycloak.org).  
 
-Keycloak is an SSO Service for web apps and REST services.
-It can be used for social applications as well as enterprise applications.  It is based on OpenID Connect with SAML support in the works.
-Here's some of the features:
 
-* SSO and Single Log Out for browser applications
-* Social Broker.  Enable Google, Facebook, Yahoo, Twitter social login with no code required.
-* Optional LDAP/Active Directory integration
-* Optional User Registration
-* Password and TOTP support (via Google Authenticator).  Client cert auth coming soon.
-* User session management from both admin and user perspective
-* Customizable themes for user facing pages: login, grant pages, account management, emails, and admin console all customizable!
-* OAuth Bearer token auth for REST Services
-* Integrated Browser App to REST Service token propagation
-* Admin REST API
-* OAuth 2.0 Grant requests
-* CORS Support
-* CORS Web Origin management and validation
-* Completely centrally managed user and role mapping metadata.  Minimal configuration at the application side
-* Admin Console for managing users, roles, role mappings, applications, user sessions, allowed CORS web origins, and OAuth clients.
-* Deployable as a WAR, appliance, or an Openshift  cloud service (SaaS).
-* Supports JBoss AS7, EAP 6.x, and Wildfly applications.   Plans to support Node.js, RAILS, GRAILS, and other non-Java applications.
-* Javascript/HTML 5 adapter for pure Javascript apps
-* Session management from admin console
-* Revocation policies
-* Password policies
-* OpenID Connect Support
+Building
+--------
 
-Please visit [http://keycloak.org](http://keycloak.org) for more information on Keycloak including how to download, documentation,
-and video tutorials.
+Ensure you have JDK 7 (or newer), Maven 3.2.1 (or newer) and Git installed
+
+    java -version
+    mvn -version
+    git --version
+    
+First clone the Keycloak repository:
+    
+    git clone https://github.com/keycloak/keycloak.git
+    cd keycloak
+    
+To build Keycloak run:
+
+    mvn install
+    
+This will build all modules and run the testsuite. 
+
+To build the distribution run:
+
+    mvn install -Pdistribution
+    
+Once completed you will find distribution archives in `distribution`.
+
+
+Starting Keycloak
+-----------------
+
+To start Keycloak during development first build as specficied above, then run:
+
+    mvn -f testsuite/integration/pom.xml exec:java -Pkeycloak-server 
+
+
+To start Keycloak from the appliance distribution first build the distribution it as specified above, then run:
+
+    tar xfz distribution/appliance-dist/target/keycloak-appliance-dist-all-<VERSION>.tar.gz
+    cd keycloak-appliance-dist-all-<VERSION>/keycloak
+    bin/standalone.sh
+    
+To stop the server press `Ctrl + C`.
+
+
+Contributing
+------------
+
+* See [Hacking on Keycloak](misc/HackingOnKeycloak.md)
+
+
+Documentation
+-------------
+
+* [User Guide, Admin REST API and Javadocs](http://keycloak.jboss.org/docs)
+* Developer documentation
+    * [Hacking on Keycloak](misc/HackingOnKeycloak.md) - how to become a Keycloak contributor
+    * [Testsuite](misc/Testsuite.md) - details about testsuite, but also how to quickly run Keycloak during development and a few test tools (OTP generation, LDAP server, Mail server)
+    * [Database Testing](misc/DatabaseTesting.md) - how to do testing of Keycloak on different databases
+    * [Updating Database](misc/UpdatingDatabaseSchema.md) - how to change the Keycloak database
+    * [Release Process](misc/ReleaseProcess.md) - how to release Keycloak
+
+
+License
+-------
+
+* [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)

broker/core/pom.xml

@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-broker-core</artifactId>
+    <name>Keycloak Broker Core</name>
+    <description/>
+    <packaging>jar</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-events-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+    </dependencies>
+
+</project>

broker/core/src/main/java/org/keycloak/broker/provider/AbstractIdentityProvider.java

@@ -0,0 +1,95 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.events.EventBuilder;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
+/**
+ * @author Pedro Igor
+ */
+public abstract class AbstractIdentityProvider<C extends IdentityProviderModel> implements IdentityProvider<C> {
+
+    private final C config;
+
+    public AbstractIdentityProvider(C config) {
+        this.config = config;
+    }
+
+    public C getConfig() {
+        return this.config;
+    }
+
+    @Override
+    public Response export(UriInfo uriInfo, RealmModel realm, String format) {
+        return Response.noContent().build();
+    }
+
+    @Override
+    public void close() {
+        // no-op
+    }
+
+    @Override
+    public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) {
+        return null;
+    }
+
+    @Override
+    public Response performLogin(AuthenticationRequest request) {
+        return null;
+    }
+
+    @Override
+    public Response keycloakInitiatedBrowserLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+        return null;
+    }
+
+    @Override
+    public void backchannelLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+
+    }
+
+    @Override
+    public void attachUserSession(UserSessionModel userSession, ClientSessionModel clientSession, BrokeredIdentityContext context) {
+
+    }
+
+    @Override
+    public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, BrokeredIdentityContext context) {
+
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context) {
+
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context) {
+
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderFactory.java

@@ -0,0 +1,59 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.Config;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Pedro Igor
+ */
+public abstract class AbstractIdentityProviderFactory<T extends IdentityProvider> implements IdentityProviderFactory<T> {
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public T create(KeycloakSession session) {
+        return null;
+    }
+
+    @Override
+    public Map<String, String> parseConfig(InputStream inputStream) {
+        return new HashMap<String, String>();
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/AbstractIdentityProviderMapper.java

@@ -0,0 +1,38 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.broker.provider.IdentityProviderMapper;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public abstract class AbstractIdentityProviderMapper implements IdentityProviderMapper {
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public IdentityProviderMapper create(KeycloakSession session) {
+        return null;
+    }
+
+    @Override
+    public void init(org.keycloak.Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+    @Override
+    public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/AuthenticationRequest.java

@@ -0,0 +1,83 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.jboss.resteasy.spi.HttpRequest;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+
+import javax.ws.rs.core.UriInfo;
+
+/**
+ * @author Pedro Igor
+ */
+public class AuthenticationRequest {
+
+    private final KeycloakSession session;
+    private final UriInfo uriInfo;
+    private final String state;
+    private final HttpRequest httpRequest;
+    private final RealmModel realm;
+    private final String redirectUri;
+    private final ClientSessionModel clientSession;
+
+    public AuthenticationRequest(KeycloakSession session, RealmModel realm, ClientSessionModel clientSession, HttpRequest httpRequest, UriInfo uriInfo, String state, String redirectUri) {
+        this.session = session;
+        this.realm = realm;
+        this.httpRequest = httpRequest;
+        this.uriInfo = uriInfo;
+        this.state = state;
+        this.redirectUri = redirectUri;
+        this.clientSession = clientSession;
+    }
+
+    public KeycloakSession getSession() {
+        return session;
+    }
+
+    public UriInfo getUriInfo() {
+        return this.uriInfo;
+    }
+
+    public String getState() {
+        return this.state;
+    }
+
+    public HttpRequest getHttpRequest() {
+        return this.httpRequest;
+    }
+
+    public RealmModel getRealm() {
+        return this.realm;
+    }
+
+    /**
+     * <p>Returns the redirect url that must be included in an authentication request in order to process responses from an
+     * identity provider.</p>
+     *
+     * @return
+     */
+    public String getRedirectUri() {
+        return this.redirectUri;
+    }
+
+    public ClientSessionModel getClientSession() {
+        return this.clientSession;
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/BrokeredIdentityContext.java

@@ -0,0 +1,200 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.IdentityProviderModel;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * <p>Represents all identity information obtained from an {@link org.keycloak.broker.provider.IdentityProvider} after a
+ * successful authentication.</p>
+ *
+ * @author Pedro Igor
+ */
+public class BrokeredIdentityContext {
+
+    private String id;
+    private String username;
+    private String modelUsername;
+    private String email;
+    private String firstName;
+    private String lastName;
+    private String brokerSessionId;
+    private String brokerUserId;
+    private String code;
+    private String token;
+    private IdentityProviderModel idpConfig;
+    private IdentityProvider idp;
+    private Map<String, Object> contextData = new HashMap<>();
+    private ClientSessionModel clientSession;
+
+    public BrokeredIdentityContext(String id) {
+        if (id == null) {
+            throw new RuntimeException("No identifier provider for identity.");
+        }
+
+        this.id = id;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    /**
+     * Username in remote idp
+     *
+     * @return
+     */
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    /**
+     * username to store in UserModel
+     *
+     * @return
+     */
+    public String getModelUsername() {
+        return modelUsername;
+    }
+
+    public void setModelUsername(String modelUsername) {
+        this.modelUsername = modelUsername;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getBrokerSessionId() {
+        return brokerSessionId;
+    }
+
+    public void setBrokerSessionId(String brokerSessionId) {
+        this.brokerSessionId = brokerSessionId;
+    }
+
+    public String getBrokerUserId() {
+        return brokerUserId;
+    }
+
+    public void setBrokerUserId(String brokerUserId) {
+        this.brokerUserId = brokerUserId;
+    }
+
+    public String getToken() {
+        return token;
+    }
+
+    public void setToken(String token) {
+        this.token = token;
+    }
+
+    public String getCode() {
+        return code;
+    }
+
+    public void setCode(String code) {
+        this.code = code;
+    }
+
+    public IdentityProviderModel getIdpConfig() {
+        return idpConfig;
+    }
+
+    public void setIdpConfig(IdentityProviderModel idpConfig) {
+        this.idpConfig = idpConfig;
+    }
+
+    public IdentityProvider getIdp() {
+        return idp;
+    }
+
+    public void setIdp(IdentityProvider idp) {
+        this.idp = idp;
+    }
+
+    public Map<String, Object> getContextData() {
+        return contextData;
+    }
+
+    public void setContextData(Map<String, Object> contextData) {
+        this.contextData = contextData;
+    }
+
+    public String getFirstName() {
+        return firstName;
+    }
+
+    public void setFirstName(String firstName) {
+        this.firstName = firstName;
+    }
+
+    public String getLastName() {
+        return lastName;
+    }
+
+    public void setLastName(String lastName) {
+        this.lastName = lastName;
+    }
+
+    public ClientSessionModel getClientSession() {
+        return clientSession;
+    }
+
+    public void setClientSession(ClientSessionModel clientSession) {
+        this.clientSession = clientSession;
+    }
+
+    public void setName(String name) {
+        if (name != null) {
+            int i = name.lastIndexOf(' ');
+            if (i != -1) {
+                firstName  = name.substring(0, i);
+                lastName = name.substring(i + 1);
+            } else {
+                firstName = name;
+            }
+        }
+    }
+
+
+    @Override
+    public String toString() {
+        return "{" +
+                "id='" + id + '\'' +
+                ", username='" + username + '\'' +
+                ", email='" + email + '\'' +
+                '}';
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/HardcodedAttributeMapper.java

@@ -0,0 +1,89 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class HardcodedAttributeMapper extends AbstractIdentityProviderMapper {
+    public static final String ATTRIBUTE = "attribute";
+    public static final String ATTRIBUTE_VALUE = "attribute.value";
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE);
+        property.setLabel("User Attribute");
+        property.setHelpText("Name of user attribute you want to hardcode");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_VALUE);
+        property.setLabel("User Attribute Value");
+        property.setHelpText("Value you want to hardcode");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+    }
+
+
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Hardcoded Attribute";
+    }
+
+    public static final String[] COMPATIBLE_PROVIDERS = {ANY_PROVIDER};
+
+
+    public static final String PROVIDER_ID = "hardcoded-attribute-idp-mapper";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(ATTRIBUTE);
+        String attributeValue = mapperModel.getConfig().get(ATTRIBUTE_VALUE);
+        user.setSingleAttribute(attribute, attributeValue);
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(ATTRIBUTE);
+        String attributeValue = mapperModel.getConfig().get(ATTRIBUTE_VALUE);
+        user.setSingleAttribute(attribute, attributeValue);
+    }
+
+    @Override
+    public String getHelpText() {
+        return "When user is imported from provider, hardcode a value to a specific user attribute.";
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/HardcodedRoleMapper.java

@@ -0,0 +1,110 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class HardcodedRoleMapper extends AbstractIdentityProviderMapper {
+    public static final String ROLE = "role";
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(ROLE);
+        property.setLabel("Role");
+        property.setHelpText("Role to grant to user.  Click 'Select Role' button to browse roles, or just type it in the textbox.  To reference an application role the syntax is appname.approle, i.e. myapp.myrole");
+        property.setType(ProviderConfigProperty.ROLE_TYPE);
+        configProperties.add(property);
+    }
+
+
+
+    public static String[] parseRole(String role) {
+        int scopeIndex = role.lastIndexOf('.');
+        if (scopeIndex > -1) {
+            String appName = role.substring(0, scopeIndex);
+            role = role.substring(scopeIndex + 1);
+            String[] rtn = {appName, role};
+            return rtn;
+        } else {
+            String[] rtn = {null, role};
+            return rtn;
+
+        }
+    }
+
+    public static RoleModel getRoleFromString(RealmModel realm, String roleName) {
+        String[] parsedRole = parseRole(roleName);
+        RoleModel role = null;
+        if (parsedRole[0] == null) {
+            role = realm.getRole(parsedRole[1]);
+        } else {
+            ClientModel client = realm.getClientByClientId(parsedRole[0]);
+            role = client.getRole(parsedRole[1]);
+        }
+        return role;
+    }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Role Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Hardcoded Role";
+    }
+
+    public static final String[] COMPATIBLE_PROVIDERS = {ANY_PROVIDER};
+
+
+    public static final String PROVIDER_ID = "oidc-hardcoded-role-idp-mapper";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String roleName = mapperModel.getConfig().get(ROLE);
+        RoleModel role = getRoleFromString(realm, roleName);
+        if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+        user.grantRole(role);
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "When user is imported from provider, hardcode a role mapping for it.";
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/HardcodedUserSessionAttributeMapper.java

@@ -0,0 +1,87 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class HardcodedUserSessionAttributeMapper extends AbstractIdentityProviderMapper {
+    public static final String ATTRIBUTE = "attribute";
+    public static final String ATTRIBUTE_VALUE = "attribute.value";
+    protected static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE);
+        property.setLabel("User Session Attribute");
+        property.setHelpText("Name of user session attribute you want to hardcode");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_VALUE);
+        property.setLabel("User Session Attribute Value");
+        property.setHelpText("Value you want to hardcode");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+    }
+
+
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Hardcoded User Session Attribute";
+    }
+
+    public static final String[] COMPATIBLE_PROVIDERS = {ANY_PROVIDER};
+
+
+    public static final String PROVIDER_ID = "hardcoded-user-session-attribute-idp-mapper";
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(ATTRIBUTE);
+        String attributeValue = mapperModel.getConfig().get(ATTRIBUTE_VALUE);
+        context.getClientSession().setUserSessionNote(attribute, attributeValue);
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(ATTRIBUTE);
+        String attributeValue = mapperModel.getConfig().get(ATTRIBUTE_VALUE);
+        context.getClientSession().setUserSessionNote(attribute, attributeValue);
+    }
+
+    @Override
+    public String getHelpText() {
+        return "When user is imported from provider, hardcode a value to a specific user session attribute.";
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityBrokerException.java

@@ -0,0 +1,32 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+/**
+ * @author pedroigor
+ */
+public class IdentityBrokerException extends RuntimeException {
+
+    public IdentityBrokerException(String message) {
+        super(message);
+    }
+
+    public IdentityBrokerException(String message, Throwable t) {
+        super(message, t);
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityProvider.java

@@ -0,0 +1,106 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.events.EventBuilder;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.provider.Provider;
+
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
+/**
+ * @author Pedro Igor
+ */
+public interface IdentityProvider<C extends IdentityProviderModel> extends Provider {
+
+    interface AuthenticationCallback {
+        /**
+         * This method should be called by provider after the JAXRS callback endpoint has finished authentication
+         * with the remote IDP
+         *
+         * @param context
+         * @return
+         */
+        Response authenticated(BrokeredIdentityContext context);
+
+        Response cancelled(String code);
+
+        Response error(String code, String message);
+    }
+
+
+    void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, BrokeredIdentityContext context);
+    void attachUserSession(UserSessionModel userSession, ClientSessionModel clientSession, BrokeredIdentityContext context);
+    void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context);
+    void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, BrokeredIdentityContext context);
+
+    /**
+     * JAXRS callback endpoint for when the remote IDP wants to callback to keycloak.
+     *
+     * @return
+     */
+    Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event);
+
+    /**
+     * <p>Initiates the authentication process by sending an authentication request to an identity provider. This method is called
+     * only once during the authentication.</p>
+     *
+     * @param request The initial authentication request. Contains all the contextual information in order to build an authentication request to the
+ *                    identity provider.
+     * @return
+     */
+    Response performLogin(AuthenticationRequest request);
+
+    /**
+     * <p>Returns a {@link javax.ws.rs.core.Response} containing the token previously stored during the authentication process for a
+     * specific user.</p>
+     *
+     * @param identity
+     * @return
+     */
+    Response retrieveToken(FederatedIdentityModel identity);
+
+    void backchannelLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm);
+
+    /**
+     * Called when a Keycloak application initiates a logout through the browser.  This is expected to do a logout
+     * with the IDP
+     *
+     * @param userSession
+     * @param uriInfo
+     * @param realm
+     * @return null if this is not supported by this provider
+     */
+    Response keycloakInitiatedBrowserLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm);
+
+    /**
+     * Export a representation of the IdentityProvider in a specific format.  For example, a SAML EntityDescriptor
+     *
+     * @return
+     */
+    Response export(UriInfo uriInfo, RealmModel realm, String format);
+
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityProviderFactory.java

@@ -0,0 +1,58 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.provider.ProviderFactory;
+
+import java.io.InputStream;
+import java.util.Map;
+
+/**
+ * @author Pedro Igor
+ */
+public interface IdentityProviderFactory<T extends IdentityProvider> extends ProviderFactory<T> {
+
+    /**
+     * <p>A friendly name for this factory.</p>
+     *
+     * @return
+     */
+    String getName();
+
+    /**
+     * <p>Creates an {@link IdentityProvider} based on the configuration contained in
+     * <code>model</code>.</p>
+     *
+     * @param model The configuration to be used to create the identity provider.
+     * @return
+     */
+    T create(IdentityProviderModel model);
+
+    /**
+     * <p>Creates an {@link IdentityProvider} based on the configuration from
+     * <code>inputStream</code>.</p>
+     *
+     * @param model The model containing the common abd basic configuration for an identity provider.
+     * @param inputStream The input stream from where configuration will be loaded from..
+     * @return
+     */
+    Map<String, String> parseConfig(InputStream inputStream);
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityProviderMapper.java

@@ -0,0 +1,56 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ConfiguredProvider;
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface IdentityProviderMapper extends Provider, ProviderFactory<IdentityProviderMapper>,ConfiguredProvider {
+    public static final String ANY_PROVIDER = "*";
+
+    String[] getCompatibleProviders();
+    String getDisplayCategory();
+    String getDisplayType();
+
+    /**
+     * Called to determine what keycloak username and email to use to process the login request from the external IDP
+     * Usually used to map BrokeredIdentityContet.username or email.
+     *
+     * @param session
+     * @param realm
+     * @param mapperModel
+     * @param context
+     */
+    void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context);
+
+    /**
+     * Called after UserModel is created for first time for this user.
+     *
+     * @param session
+     * @param realm
+     * @param user
+     * @param mapperModel
+     * @param context
+     */
+    void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context);
+
+    /**
+     * Called when this user has logged in before and has already been imported.
+     *
+     * @param session
+     * @param realm
+     * @param user
+     * @param mapperModel
+     * @param context
+     */
+    void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context);
+
+
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityProviderMapperSpi.java

@@ -0,0 +1,32 @@
+package org.keycloak.broker.provider;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class IdentityProviderMapperSpi implements Spi {
+
+    @Override
+    public boolean isInternal() {
+        return true;
+    }
+
+    @Override
+    public String getName() {
+        return "identity-provider-mapper";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return IdentityProviderMapper.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return IdentityProviderMapper.class;
+    }
+
+}

broker/core/src/main/java/org/keycloak/broker/provider/IdentityProviderSpi.java

@@ -0,0 +1,50 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.provider;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author Pedro Igor
+ */
+public class IdentityProviderSpi implements Spi {
+
+    public static final String IDENTITY_PROVIDER_SPI_NAME = "identity_provider";
+
+    @Override
+    public boolean isInternal() {
+        return false;
+    }
+
+    @Override
+    public String getName() {
+        return IDENTITY_PROVIDER_SPI_NAME;
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return IdentityProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return IdentityProviderFactory.class;
+    }
+}

broker/core/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java

@@ -0,0 +1,238 @@
+package org.keycloak.broker.provider.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.StringWriter;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.zip.GZIPInputStream;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public class SimpleHttp {
+
+
+    private String url;
+    private String method;
+    private Map<String, String> headers;
+    private Map<String, String> params;
+
+    protected SimpleHttp(String url, String method) {
+        this.url = url;
+        this.method = method;
+    }
+
+    public static SimpleHttp doGet(String url) {
+        return new SimpleHttp(url, "GET");
+    }
+
+    public static SimpleHttp doPost(String url) {
+        return new SimpleHttp(url, "POST");
+    }
+
+    public SimpleHttp header(String name, String value) {
+        if (headers == null) {
+            headers = new HashMap<String, String>();
+        }
+        headers.put(name, value);
+        return this;
+    }
+
+    public SimpleHttp param(String name, String value) {
+        if (params == null) {
+            params = new HashMap<String, String>();
+        }
+        params.put(name, value);
+        return this;
+    }
+
+
+    public String asString() throws IOException {
+        boolean get = method.equals("GET");
+        boolean post = method.equals("POST");
+
+        StringBuilder sb = new StringBuilder();
+        if (get) {
+            sb.append(url);
+        }
+
+        if (params != null) {
+            boolean f = true;
+            for (Map.Entry<String, String> p : params.entrySet()) {
+                if (f) {
+                    f = false;
+                    if (get) {
+                        sb.append("?");
+                    }
+                } else {
+                    sb.append("&");
+                }
+                sb.append(URLEncoder.encode(p.getKey(), "UTF-8"));
+                sb.append("=");
+                sb.append(URLEncoder.encode(p.getValue(), "UTF-8"));
+            }
+        }
+
+        if (get) {
+            url = sb.toString();
+        }
+
+        HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
+        OutputStream os = null;
+        InputStream is = null;
+
+        try {
+            connection.setRequestMethod(method);
+
+            if (headers != null) {
+                for (Map.Entry<String, String> h : headers.entrySet()) {
+                    connection.setRequestProperty(h.getKey(), h.getValue());
+                }
+            }
+
+            if (post) {
+                String data = sb.toString();
+
+                connection.setDoOutput(true);
+                connection.setRequestMethod("POST");
+                connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
+                connection.setRequestProperty("Content-Length", String.valueOf(data.length()));
+
+                os = connection.getOutputStream();
+                os.write(data.getBytes());
+            } else {
+                connection.setDoOutput(false);
+            }
+
+            String ce = connection.getHeaderField("Content-Encoding");
+            is = connection.getInputStream();
+            if ("gzip".equals(ce)) {
+              is = new GZIPInputStream(is);
+	          }
+            return toString(is);
+        } finally {
+            if (os != null) {
+                try {
+                    os.close();
+                } catch (IOException e) {
+                }
+            }
+
+            if (is != null) {
+                try {
+                    is.close();
+                } catch (IOException e) {
+                }
+            }
+            if (connection != null) {
+                try {
+                    connection.disconnect();
+                } catch (Exception e) {
+                }
+            }
+        }
+    }
+
+    public int asStatus() throws IOException {
+        boolean get = method.equals("GET");
+        boolean post = method.equals("POST");
+
+        StringBuilder sb = new StringBuilder();
+        if (get) {
+            sb.append(url);
+        }
+
+        if (params != null) {
+            boolean f = true;
+            for (Map.Entry<String, String> p : params.entrySet()) {
+                if (f) {
+                    f = false;
+                    if (get) {
+                        sb.append("?");
+                    }
+                } else {
+                    sb.append("&");
+                }
+                sb.append(URLEncoder.encode(p.getKey(), "UTF-8"));
+                sb.append("=");
+                sb.append(URLEncoder.encode(p.getValue(), "UTF-8"));
+            }
+        }
+
+        if (get) {
+            url = sb.toString();
+        }
+
+        HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
+        OutputStream os = null;
+        InputStream is = null;
+
+        try {
+            connection.setRequestMethod(method);
+
+            if (headers != null) {
+                for (Map.Entry<String, String> h : headers.entrySet()) {
+                    connection.setRequestProperty(h.getKey(), h.getValue());
+                }
+            }
+
+            if (post) {
+                String data = sb.toString();
+
+                connection.setDoOutput(true);
+                connection.setRequestMethod("POST");
+                connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
+                connection.setRequestProperty("Content-Length", String.valueOf(data.length()));
+
+                os = connection.getOutputStream();
+                os.write(data.getBytes());
+            } else {
+                connection.setDoOutput(false);
+            }
+
+            is = connection.getInputStream();
+            return connection.getResponseCode();
+        } finally {
+            if (os != null) {
+                try {
+                    os.close();
+                } catch (IOException e) {
+                }
+            }
+
+            if (is != null) {
+                try {
+                    is.close();
+                } catch (IOException e) {
+                }
+            }
+            if (connection != null) {
+                try {
+                    connection.disconnect();
+                } catch (Exception e) {
+                }
+            }
+        }
+    }
+
+    private String toString(InputStream is) throws IOException {
+        InputStreamReader reader = new InputStreamReader(is);
+
+        StringWriter writer = new StringWriter();
+
+        char[] buffer = new char[1024 * 4];
+        for (int n = reader.read(buffer); n != -1; n = reader.read(buffer)) {
+            writer.write(buffer, 0, n);
+        }
+
+        return writer.toString();
+    }
+
+}

broker/core/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderMapper

@@ -0,0 +1,3 @@
+org.keycloak.broker.provider.HardcodedRoleMapper
+org.keycloak.broker.provider.HardcodedAttributeMapper
+org.keycloak.broker.provider.HardcodedUserSessionAttributeMapper

broker/core/src/main/resources/META-INF/services/org.keycloak.provider.Spi

@@ -0,0 +1,2 @@
+org.keycloak.broker.provider.IdentityProviderSpi
+org.keycloak.broker.provider.IdentityProviderMapperSpi

broker/oidc/pom.xml

@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-broker-oidc</artifactId>
+    <name>Keycloak Broker - OpenID Connect Identity Provider</name>
+    <description/>
+    <packaging>jar</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-broker-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-events-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+</project>

broker/oidc/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java

@@ -0,0 +1,258 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.codehaus.jackson.JsonNode;
+import org.codehaus.jackson.map.ObjectMapper;
+import org.jboss.logging.Logger;
+import org.keycloak.common.ClientConnection;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.broker.provider.AbstractIdentityProvider;
+import org.keycloak.broker.provider.AuthenticationRequest;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.events.EventType;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.services.ErrorPage;
+import org.keycloak.services.messages.Messages;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
+import java.net.URI;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * @author Pedro Igor
+ */
+public abstract class AbstractOAuth2IdentityProvider<C extends OAuth2IdentityProviderConfig> extends AbstractIdentityProvider<C> {
+    protected static final Logger logger = Logger.getLogger(AbstractOAuth2IdentityProvider.class);
+
+    public static final String OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE = "authorization_code";
+    public static final String FEDERATED_ACCESS_TOKEN = "FEDERATED_ACCESS_TOKEN";
+    public static final String FEDERATED_REFRESH_TOKEN = "FEDERATED_REFRESH_TOKEN";
+    public static final String FEDERATED_TOKEN_EXPIRATION = "FEDERATED_TOKEN_EXPIRATION";
+    public static final String ACCESS_DENIED = "access_denied";
+    protected static ObjectMapper mapper = new ObjectMapper();
+
+    public static final String OAUTH2_PARAMETER_ACCESS_TOKEN = "access_token";
+    public static final String OAUTH2_PARAMETER_SCOPE = "scope";
+    public static final String OAUTH2_PARAMETER_STATE = "state";
+    public static final String OAUTH2_PARAMETER_RESPONSE_TYPE = "response_type";
+    public static final String OAUTH2_PARAMETER_REDIRECT_URI = "redirect_uri";
+    public static final String OAUTH2_PARAMETER_CODE = "code";
+    public static final String OAUTH2_PARAMETER_CLIENT_ID = "client_id";
+    public static final String OAUTH2_PARAMETER_CLIENT_SECRET = "client_secret";
+    public static final String OAUTH2_PARAMETER_GRANT_TYPE = "grant_type";
+
+
+    public AbstractOAuth2IdentityProvider(C config) {
+        super(config);
+
+        if (config.getDefaultScope() == null || config.getDefaultScope().isEmpty()) {
+            config.setDefaultScope(getDefaultScopes());
+        }
+    }
+
+    @Override
+    public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) {
+        return new Endpoint(callback, realm, event);
+    }
+
+    @Override
+    public Response performLogin(AuthenticationRequest request) {
+        try {
+            URI authorizationUrl = createAuthorizationUrl(request).build();
+
+            return Response.temporaryRedirect(authorizationUrl).build();
+        } catch (Exception e) {
+            throw new IdentityBrokerException("Could not create authentication request.", e);
+        }
+    }
+
+    @Override
+    public Response retrieveToken(FederatedIdentityModel identity) {
+        return Response.ok(identity.getToken()).build();
+    }
+
+    @Override
+    public C getConfig() {
+        return super.getConfig();
+    }
+
+    protected String extractTokenFromResponse(String response, String tokenName) {
+    	  if(response == null)
+    	  	return null;
+    	  
+        if (response.startsWith("{")) {
+            try {
+            		JsonNode node = mapper.readTree(response);
+            		if(node.has(tokenName)){
+            			String s = node.get(tokenName).getTextValue();
+            			if(s == null || s.trim().isEmpty())
+            				return null;
+                  return s;
+            		} else {
+            			return null;
+            		}
+            } catch (IOException e) {
+                throw new IdentityBrokerException("Could not extract token [" + tokenName + "] from response [" + response + "] due: " + e.getMessage(), e);
+            }
+        } else {
+            Matcher matcher = Pattern.compile(tokenName + "=([^&]+)").matcher(response);
+
+            if (matcher.find()) {
+                return matcher.group(1);
+            }
+        }
+
+        return null;
+    }
+
+    protected BrokeredIdentityContext getFederatedIdentity(String response) {
+        String accessToken = extractTokenFromResponse(response, OAUTH2_PARAMETER_ACCESS_TOKEN);
+
+        if (accessToken == null) {
+            throw new IdentityBrokerException("No access token available in OAuth server response: " + response);
+        }
+
+        return doGetFederatedIdentity(accessToken);
+    }
+
+
+    protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
+        return null;
+    }
+
+
+    protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
+        return UriBuilder.fromUri(getConfig().getAuthorizationUrl())
+                .queryParam(OAUTH2_PARAMETER_SCOPE, getConfig().getDefaultScope())
+                .queryParam(OAUTH2_PARAMETER_STATE, request.getState())
+                .queryParam(OAUTH2_PARAMETER_RESPONSE_TYPE, "code")
+                .queryParam(OAUTH2_PARAMETER_CLIENT_ID, getConfig().getClientId())
+                .queryParam(OAUTH2_PARAMETER_REDIRECT_URI, request.getRedirectUri());
+    }
+
+    /**
+     * Get JSON property as text. JSON numbers and booleans are converted to text. Empty string is converted to null. 
+     * 
+     * @param jsonNode to get property from
+     * @param name of property to get
+     * @return string value of the property or null.
+     */
+    protected String getJsonProperty(JsonNode jsonNode, String name) {
+        if (jsonNode.has(name) && !jsonNode.get(name).isNull()) {
+        	  String s = jsonNode.get(name).asText();
+        	  if(s != null && !s.isEmpty())
+        	  		return s;
+        	  else
+      	  			return null;
+        }
+
+        return null;
+    }
+
+    protected JsonNode asJsonNode(String json) throws IOException {
+        return mapper.readTree(json);
+    }
+
+    protected abstract String getDefaultScopes();
+
+    protected class Endpoint {
+        protected AuthenticationCallback callback;
+        protected RealmModel realm;
+        protected EventBuilder event;
+
+        @Context
+        protected KeycloakSession session;
+
+        @Context
+        protected ClientConnection clientConnection;
+
+        @Context
+        protected HttpHeaders headers;
+
+        @Context
+        protected UriInfo uriInfo;
+
+        public Endpoint(AuthenticationCallback callback, RealmModel realm, EventBuilder event) {
+            this.callback = callback;
+            this.realm = realm;
+            this.event = event;
+        }
+
+        @GET
+        public Response authResponse(@QueryParam(AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_STATE) String state,
+                                     @QueryParam(AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_CODE) String authorizationCode,
+                                     @QueryParam(OAuth2Constants.ERROR) String error) {
+            if (error != null) {
+                //logger.error("Failed " + getConfig().getAlias() + " broker login: " + error);
+                if (error.equals(ACCESS_DENIED)) {
+                    return callback.cancelled(state);
+                } else {
+                    return callback.error(state, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+                }
+            }
+
+            try {
+
+                if (authorizationCode != null) {
+                    String response = generateTokenRequest(authorizationCode).asString();
+
+                    BrokeredIdentityContext federatedIdentity = getFederatedIdentity(response);
+
+                    if (getConfig().isStoreToken()) {
+                        federatedIdentity.setToken(response);
+                    }
+
+                    federatedIdentity.setCode(state);
+                    federatedIdentity.setIdpConfig(getConfig());
+                    federatedIdentity.setIdp(AbstractOAuth2IdentityProvider.this);
+
+                    return callback.authenticated(federatedIdentity);
+                }
+            } catch (Exception e) {
+                logger.error("Failed to make identity provider oauth callback", e);
+            }
+            event.event(EventType.LOGIN);
+            event.error(Errors.IDENTITY_PROVIDER_LOGIN_FAILURE);
+            return ErrorPage.error(session, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+        }
+
+        public SimpleHttp generateTokenRequest(String authorizationCode) {
+            return SimpleHttp.doPost(getConfig().getTokenUrl())
+                    .param(OAUTH2_PARAMETER_CODE, authorizationCode)
+                    .param(OAUTH2_PARAMETER_CLIENT_ID, getConfig().getClientId())
+                    .param(OAUTH2_PARAMETER_CLIENT_SECRET, getConfig().getClientSecret())
+                    .param(OAUTH2_PARAMETER_REDIRECT_URI, uriInfo.getAbsolutePath().toString())
+                    .param(OAUTH2_PARAMETER_GRANT_TYPE, OAUTH2_GRANT_TYPE_AUTHORIZATION_CODE);
+        }
+    }
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProvider.java

@@ -0,0 +1,114 @@
+package org.keycloak.broker.oidc;
+
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.constants.AdapterConstants;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.adapters.action.AdminAction;
+import org.keycloak.representations.adapters.action.LogoutAction;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.util.JsonSerialization;
+
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+import java.security.PublicKey;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakOIDCIdentityProvider extends OIDCIdentityProvider {
+
+    public static final String VALIDATED_ACCESS_TOKEN = "VALIDATED_ACCESS_TOKEN";
+
+    public KeycloakOIDCIdentityProvider(OIDCIdentityProviderConfig config) {
+        super(config);
+    }
+
+    @Override
+    public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) {
+        return new KeycloakEndpoint(callback, realm, event);
+    }
+
+    @Override
+    protected void processAccessTokenResponse(BrokeredIdentityContext context, PublicKey idpKey, AccessTokenResponse response) {
+        JsonWebToken access = validateToken(idpKey, response.getToken());
+        context.getContextData().put(VALIDATED_ACCESS_TOKEN, access);
+    }
+
+    protected class KeycloakEndpoint extends OIDCEndpoint {
+        public KeycloakEndpoint(AuthenticationCallback callback, RealmModel realm, EventBuilder event) {
+            super(callback, realm, event);
+        }
+
+        @POST
+        @Path(AdapterConstants.K_LOGOUT)
+        public Response backchannelLogout(String input) {
+            JWSInput token = new JWSInput(input);
+            PublicKey key = getExternalIdpKey();
+            if (key != null) {
+                if (!verify(token, key)) {
+                    logger.warn("Failed to verify logout request");
+                    return Response.status(400).build();
+                }
+            }
+            LogoutAction action = null;
+            try {
+                action = JsonSerialization.readValue(token.getContent(), LogoutAction.class);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+            if (!validateAction(action)) return Response.status(400).build();
+            if (action.getKeycloakSessionIds() != null) {
+                for (String sessionId : action.getKeycloakSessionIds()) {
+                    String brokerSessionId = getConfig().getAlias() + "." + sessionId;
+                    UserSessionModel userSession = session.sessions().getUserSessionByBrokerSessionId(realm, brokerSessionId);
+                    if (userSession != null
+                            && userSession.getState() != UserSessionModel.State.LOGGING_OUT
+                            && userSession.getState() != UserSessionModel.State.LOGGED_OUT
+                            ) {
+                        AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, false);
+                    }
+                }
+
+            }
+            return Response.ok().build();
+        }
+
+        protected boolean validateAction(AdminAction action)  {
+            if (!action.validate()) {
+                logger.warn("admin request failed, not validated" + action.getAction());
+                return false;
+            }
+            if (action.isExpired()) {
+                logger.warn("admin request failed, expired token");
+                return false;
+            }
+            if (!getConfig().getClientId().equals(action.getResource())) {
+                logger.warn("Resource name does not match");
+                return false;
+
+            }
+            return true;
+        }
+
+        @Override
+        public SimpleHttp generateTokenRequest(String authorizationCode) {
+            return super.generateTokenRequest(authorizationCode)
+                    .param(AdapterConstants.CLIENT_SESSION_STATE, "n/a");  // hack to get backchannel logout to work
+
+        }
+
+
+
+    }
+
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/KeycloakOIDCIdentityProviderFactory.java

@@ -0,0 +1,59 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.keycloak.broker.oidc.mappers.UsernameTemplateMapper;
+import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Pedro Igor
+ */
+public class KeycloakOIDCIdentityProviderFactory extends AbstractIdentityProviderFactory<KeycloakOIDCIdentityProvider> {
+
+    public static final String PROVIDER_ID = "keycloak-oidc";
+
+    @Override
+    public String getName() {
+        return "Keycloak OpenID Connect";
+    }
+
+    @Override
+    public KeycloakOIDCIdentityProvider create(IdentityProviderModel model) {
+        return new KeycloakOIDCIdentityProvider(new OIDCIdentityProviderConfig(model));
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public Map<String, String> parseConfig(InputStream inputStream) {
+        return OIDCIdentityProviderFactory.parseOIDCConfig(inputStream);
+
+    }
+
+ }

broker/oidc/src/main/java/org/keycloak/broker/oidc/OAuth2IdentityProviderConfig.java

@@ -0,0 +1,78 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.keycloak.models.IdentityProviderModel;
+
+/**
+ * @author Pedro Igor
+ */
+public class OAuth2IdentityProviderConfig extends IdentityProviderModel {
+
+    public OAuth2IdentityProviderConfig(IdentityProviderModel model) {
+        super(model);
+    }
+
+    public String getAuthorizationUrl() {
+        return getConfig().get("authorizationUrl");
+    }
+
+    public void setAuthorizationUrl(String authorizationUrl) {
+        getConfig().put("authorizationUrl", authorizationUrl);
+    }
+
+    public String getTokenUrl() {
+        return getConfig().get("tokenUrl");
+    }
+
+    public void setTokenUrl(String tokenUrl) {
+        getConfig().put("tokenUrl", tokenUrl);
+    }
+
+    public String getUserInfoUrl() {
+        return getConfig().get("userInfoUrl");
+    }
+
+    public void setUserInfoUrl(String userInfoUrl) {
+        getConfig().put("userInfoUrl", userInfoUrl);
+    }
+
+    public String getClientId() {
+        return getConfig().get("clientId");
+    }
+
+    public void setClientId(String clientId) {
+        getConfig().put("clientId", clientId);
+    }
+
+    public String getClientSecret() {
+        return getConfig().get("clientSecret");
+    }
+
+    public void setClientSecret(String clientSecret) {
+        getConfig().put("clientSecret", clientSecret);
+    }
+
+    public String getDefaultScope() {
+        return getConfig().get("defaultScope");
+    }
+
+    public void setDefaultScope(String defaultScope) {
+        getConfig().put("defaultScope", defaultScope);
+    }
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProvider.java

@@ -0,0 +1,332 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.codehaus.jackson.JsonNode;
+import org.jboss.logging.Logger;
+import org.keycloak.broker.oidc.mappers.AbstractJsonUserAttributeMapper;
+import org.keycloak.broker.oidc.util.JsonSimpleHttp;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.broker.provider.AuthenticationRequest;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.events.EventType;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.crypto.RSAProvider;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.JsonWebToken;
+import org.keycloak.services.ErrorPage;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.services.resources.IdentityBrokerService;
+import org.keycloak.services.resources.RealmsResource;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.common.util.PemUtils;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+
+import java.io.IOException;
+import java.security.PublicKey;
+
+/**
+ * @author Pedro Igor
+ */
+public class OIDCIdentityProvider extends AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig> {
+    protected static final Logger logger = Logger.getLogger(OIDCIdentityProvider.class);
+
+    public static final String OAUTH2_PARAMETER_PROMPT = "prompt";
+    public static final String SCOPE_OPENID = "openid";
+    public static final String FEDERATED_ID_TOKEN = "FEDERATED_ID_TOKEN";
+    public static final String USER_INFO = "UserInfo";
+    public static final String FEDERATED_ACCESS_TOKEN_RESPONSE = "FEDERATED_ACCESS_TOKEN_RESPONSE";
+    public static final String VALIDATED_ID_TOKEN = "VALIDATED_ID_TOKEN";
+
+    public OIDCIdentityProvider(OIDCIdentityProviderConfig config) {
+        super(config);
+
+        String defaultScope = config.getDefaultScope();
+
+        if (!defaultScope.contains(SCOPE_OPENID)) {
+            config.setDefaultScope(SCOPE_OPENID + " " + defaultScope);
+        }
+    }
+
+    @Override
+    public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) {
+        return new OIDCEndpoint(callback, realm, event);
+    }
+
+    protected PublicKey getExternalIdpKey() {
+        String signingCert = getConfig().getCertificateSignatureVerifier();
+        try {
+            if (signingCert != null && !signingCert.trim().equals("")) {
+                return PemUtils.decodeCertificate(signingCert).getPublicKey();
+            } else if (getConfig().getPublicKeySignatureVerifier() != null && !getConfig().getPublicKeySignatureVerifier().trim().equals("")) {
+                return PemUtils.decodePublicKey(getConfig().getPublicKeySignatureVerifier());
+            }
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        return null;
+
+    }
+
+    protected class OIDCEndpoint extends Endpoint {
+        public OIDCEndpoint(AuthenticationCallback callback, RealmModel realm, EventBuilder event) {
+            super(callback, realm, event);
+        }
+
+
+
+        @GET
+        @Path("logout_response")
+        public Response logoutResponse(@Context UriInfo uriInfo,
+                                       @QueryParam("state") String state) {
+            UserSessionModel userSession = session.sessions().getUserSession(realm, state);
+            if (userSession == null) {
+                logger.error("no valid user session");
+                EventBuilder event = new EventBuilder(realm, session, clientConnection);
+                event.event(EventType.LOGOUT);
+                event.error(Errors.USER_SESSION_NOT_FOUND);
+                return ErrorPage.error(session, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+            }
+            if (userSession.getState() != UserSessionModel.State.LOGGING_OUT) {
+                logger.error("usersession in different state");
+                EventBuilder event = new EventBuilder(realm, session, clientConnection);
+                event.event(EventType.LOGOUT);
+                event.error(Errors.USER_SESSION_NOT_FOUND);
+                return ErrorPage.error(session, Messages.SESSION_NOT_ACTIVE);
+            }
+            return AuthenticationManager.finishBrowserLogout(session, realm, userSession, uriInfo, clientConnection, headers);
+        }
+
+    }
+
+    @Override
+    public void backchannelLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+        if (getConfig().getLogoutUrl() == null || getConfig().getLogoutUrl().trim().equals("") || !getConfig().isBackchannelSupported()) return;
+        String idToken = userSession.getNote(FEDERATED_ID_TOKEN);
+        if (idToken == null) return;
+        backchannelLogout(userSession, idToken);
+    }
+
+    protected void backchannelLogout(UserSessionModel userSession, String idToken) {
+        String sessionId = userSession.getId();
+        UriBuilder logoutUri = UriBuilder.fromUri(getConfig().getLogoutUrl())
+                .queryParam("state", sessionId);
+        logoutUri.queryParam("id_token_hint", idToken);
+        String url = logoutUri.build().toString();
+        try {
+            int status = JsonSimpleHttp.doGet(url).asStatus();
+            boolean success = status >=200 && status < 400;
+            if (!success) {
+                logger.warn("Failed backchannel broker logout to: " + url);
+            }
+        } catch (Exception e) {
+            logger.warn("Failed backchannel broker logout to: " + url, e);
+        }
+    }
+
+
+    @Override
+    public Response keycloakInitiatedBrowserLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+        if (getConfig().getLogoutUrl() == null || getConfig().getLogoutUrl().trim().equals("")) return null;
+        String idToken = userSession.getNote(FEDERATED_ID_TOKEN);
+        if (idToken != null && getConfig().isBackchannelSupported()) {
+            backchannelLogout(userSession, idToken);
+            return null;
+        } else {
+            String sessionId = userSession.getId();
+            UriBuilder logoutUri = UriBuilder.fromUri(getConfig().getLogoutUrl())
+                    .queryParam("state", sessionId);
+            if (idToken != null) logoutUri.queryParam("id_token_hint", idToken);
+            String redirect = RealmsResource.brokerUrl(uriInfo)
+                    .path(IdentityBrokerService.class, "getEndpoint")
+                    .path(OIDCEndpoint.class, "logoutResponse")
+                    .build(realm.getName(), getConfig().getAlias()).toString();
+            logoutUri.queryParam("post_logout_redirect_uri", redirect);
+            Response response = Response.status(302).location(logoutUri.build()).build();
+            return response;
+        }
+    }
+
+    @Override
+    protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) {
+        UriBuilder authorizationUrl = super.createAuthorizationUrl(request);
+        String prompt = getConfig().getPrompt();
+
+        if (prompt != null && !prompt.isEmpty()) {
+            authorizationUrl.queryParam(OAUTH2_PARAMETER_PROMPT, prompt);
+        }
+
+        return authorizationUrl;
+    }
+
+    protected void processAccessTokenResponse(BrokeredIdentityContext context, PublicKey idpKey, AccessTokenResponse response) {
+
+    }
+
+    @Override
+    protected BrokeredIdentityContext getFederatedIdentity(String response) {
+        AccessTokenResponse tokenResponse = null;
+        try {
+            tokenResponse = JsonSerialization.readValue(response, AccessTokenResponse.class);
+        } catch (IOException e) {
+            throw new IdentityBrokerException("Could not decode access token response.", e);
+        }
+        PublicKey key = getExternalIdpKey();
+        String accessToken = verifyAccessToken(key, tokenResponse);
+
+        String encodedIdToken = tokenResponse.getIdToken();
+
+
+
+        JsonWebToken idToken = validateToken(key, encodedIdToken);
+
+        try {
+            String id = idToken.getSubject();
+            BrokeredIdentityContext identity = new BrokeredIdentityContext(id);
+            String name = (String)idToken.getOtherClaims().get(IDToken.NAME);
+            String preferredUsername = (String)idToken.getOtherClaims().get(IDToken.PREFERRED_USERNAME);
+            String email = (String)idToken.getOtherClaims().get(IDToken.EMAIL);
+
+            if (getConfig().getUserInfoUrl() != null && (id == null || name == null || preferredUsername == null || email == null) ) {
+                SimpleHttp request = JsonSimpleHttp.doGet(getConfig().getUserInfoUrl())
+                        .header("Authorization", "Bearer " + accessToken);
+                JsonNode userInfo = JsonSimpleHttp.asJson(request);
+
+                id = getJsonProperty(userInfo, "sub");
+                name = getJsonProperty(userInfo, "name");
+                preferredUsername = getJsonProperty(userInfo, "preferred_username");
+                email = getJsonProperty(userInfo, "email");
+                AbstractJsonUserAttributeMapper.storeUserProfileForMapper(identity, userInfo, getConfig().getAlias());
+            }
+            identity.getContextData().put(FEDERATED_ACCESS_TOKEN_RESPONSE, tokenResponse);
+            identity.getContextData().put(VALIDATED_ID_TOKEN, idToken);
+            processAccessTokenResponse(identity, key, tokenResponse);
+
+            identity.setId(id);
+            identity.setName(name);
+            identity.setEmail(email);
+
+            identity.setBrokerUserId(getConfig().getAlias() + "." + id);
+            if (tokenResponse.getSessionState() != null) {
+                identity.setBrokerSessionId(getConfig().getAlias() + "." + tokenResponse.getSessionState());
+            }
+
+            if (preferredUsername == null) {
+                preferredUsername = email;
+            }
+
+            if (preferredUsername == null) {
+                preferredUsername = id;
+            }
+
+            identity.setUsername(preferredUsername);
+
+            if (getConfig().isStoreToken()) {
+                identity.setToken(response);
+            }
+
+            return identity;
+        } catch (Exception e) {
+            throw new IdentityBrokerException("Could not fetch attributes from userinfo endpoint.", e);
+        }
+    }
+
+    private String verifyAccessToken(PublicKey key, AccessTokenResponse tokenResponse) {
+        String accessToken = tokenResponse.getToken();
+
+        if (accessToken == null) {
+            throw new IdentityBrokerException("No access_token from server.");
+        }
+        return accessToken;
+    }
+
+    protected boolean verify(JWSInput jws, PublicKey key) {
+        if (key == null) return true;
+        if (!getConfig().isValidateSignature()) return true;
+        return RSAProvider.verify(jws, key);
+
+    }
+
+    protected JsonWebToken validateToken(PublicKey key, String encodedToken) {
+        if (encodedToken == null) {
+            throw new IdentityBrokerException("No token from server.");
+        }
+
+        try {
+            JWSInput jws = new JWSInput(encodedToken);
+            if (!verify(jws, key)) {
+                throw new IdentityBrokerException("token signature validation failed");
+            }
+            JsonWebToken token = jws.readJsonContent(JsonWebToken.class);
+
+            String iss = token.getIssuer();
+
+            if (!token.hasAudience(getConfig().getClientId())) {
+                throw new IdentityBrokerException("Wrong audience from token.");
+            }
+
+            if (!token.isActive()) {
+                throw new IdentityBrokerException("Token is no longer valid");
+            }
+
+            String trustedIssuers = getConfig().getIssuer();
+
+            if (trustedIssuers != null) {
+                String[] issuers = trustedIssuers.split(",");
+
+                for (String trustedIssuer : issuers) {
+                    if (iss != null && iss.equals(trustedIssuer.trim())) {
+                        return token;
+                    }
+                }
+
+                throw new IdentityBrokerException("Wrong issuer from token. Got: " + iss + " expected: " + getConfig().getIssuer());
+            }
+            return token;
+        } catch (IOException e) {
+            throw new IdentityBrokerException("Could not decode token.", e);
+        }
+    }
+
+    @Override
+    public void attachUserSession(UserSessionModel userSession, ClientSessionModel clientSession, BrokeredIdentityContext context) {
+        AccessTokenResponse tokenResponse = (AccessTokenResponse)context.getContextData().get(FEDERATED_ACCESS_TOKEN_RESPONSE);
+        userSession.setNote(FEDERATED_ACCESS_TOKEN, tokenResponse.getToken());
+        userSession.setNote(FEDERATED_ID_TOKEN, tokenResponse.getIdToken());
+    }
+
+    @Override
+    protected String getDefaultScopes() {
+        return "openid";
+    }
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderConfig.java

@@ -0,0 +1,84 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.keycloak.models.IdentityProviderModel;
+
+/**
+ * @author Pedro Igor
+ */
+public class OIDCIdentityProviderConfig extends OAuth2IdentityProviderConfig {
+
+    public OIDCIdentityProviderConfig(IdentityProviderModel identityProviderModel) {
+        super(identityProviderModel);
+    }
+
+    public String getPrompt() {
+        return getConfig().get("prompt");
+    }
+    public void setPrompt(String prompt) {
+        getConfig().put("prompt", prompt);
+    }
+
+    public String getIssuer() {
+        return getConfig().get("issuer");
+    }
+    public void setIssuer(String issuer) {
+        getConfig().put("issuer", issuer);
+    }
+    public String getLogoutUrl() {
+        return getConfig().get("logoutUrl");
+    }
+    public void setLogoutUrl(String url) {
+        getConfig().put("logoutUrl", url);
+    }
+    public String getCertificateSignatureVerifier() {
+        return getConfig().get("certificateSignatureVerifier");
+    }
+
+    public void setCertificateSignatureVerifier(String signingCertificate) {
+        getConfig().put("certificateSignatureVerifier", signingCertificate);
+    }
+    public String getPublicKeySignatureVerifier() {
+        return getConfig().get("publicKeySignatureVerifier");
+    }
+
+    public void setPublicKeySignatureVerifier(String signingCertificate) {
+        getConfig().put("publicKeySignatureVerifier", signingCertificate);
+    }
+
+    public boolean isValidateSignature() {
+        return Boolean.valueOf(getConfig().get("validateSignature"));
+    }
+
+    public void setValidateSignature(boolean validateSignature) {
+        getConfig().put("validateSignature", String.valueOf(validateSignature));
+    }
+
+    public boolean isBackchannelSupported() {
+        return Boolean.valueOf(getConfig().get("backchannelSupported"));
+    }
+
+    public void setBackchannelSupported(boolean backchannel) {
+        getConfig().put("backchannelSupported", String.valueOf(backchannel));
+    }
+
+
+
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/OIDCIdentityProviderFactory.java

@@ -0,0 +1,108 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.oidc;
+
+import org.keycloak.broker.oidc.mappers.UsernameTemplateMapper;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
+import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jwk.JWKParser;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.protocol.oidc.representations.JSONWebKeySet;
+import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.PublicKey;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Pedro Igor
+ */
+public class OIDCIdentityProviderFactory extends AbstractIdentityProviderFactory<OIDCIdentityProvider> {
+
+    public static final String PROVIDER_ID = "oidc";
+
+    @Override
+    public String getName() {
+        return "OpenID Connect v1.0";
+    }
+
+    @Override
+    public OIDCIdentityProvider create(IdentityProviderModel model) {
+        return new OIDCIdentityProvider(new OIDCIdentityProviderConfig(model));
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public Map<String, String> parseConfig(InputStream inputStream) {
+        return parseOIDCConfig(inputStream);
+    }
+
+    protected static Map<String, String> parseOIDCConfig(InputStream inputStream) {
+        OIDCConfigurationRepresentation rep = null;
+        try {
+            rep = JsonSerialization.readValue(inputStream, OIDCConfigurationRepresentation.class);
+        } catch (IOException e) {
+            throw new RuntimeException("failed to load openid connect metadata", e);
+        }
+        OIDCIdentityProviderConfig config = new OIDCIdentityProviderConfig(new IdentityProviderModel());
+        config.setIssuer(rep.getIssuer());
+        config.setLogoutUrl(rep.getLogoutEndpoint());
+        config.setAuthorizationUrl(rep.getAuthorizationEndpoint());
+        config.setTokenUrl(rep.getTokenEndpoint());
+        config.setUserInfoUrl(rep.getUserinfoEndpoint());
+        if (rep.getJwksUri() != null) {
+            String uri = rep.getJwksUri();
+            String keySetString = null;
+            try {
+                keySetString = SimpleHttp.doGet(uri).asString();
+                JSONWebKeySet keySet = JsonSerialization.readValue(keySetString, JSONWebKeySet.class);
+                for (JWK jwk : keySet.getKeys()) {
+                    JWKParser parse = JWKParser.create(jwk);
+                    if (parse.getJwk().getPublicKeyUse().equals(JWK.SIG_USE) && keyTypeSupported(jwk.getKeyType())) {
+                        PublicKey key = parse.toPublicKey();
+                        config.setPublicKeySignatureVerifier(KeycloakModelUtils.getPemFromKey(key));
+                        config.setValidateSignature(true);
+                        break;
+                    }
+
+                }
+            } catch (IOException e) {
+                throw new RuntimeException("Failed to query JWKSet from: " + uri, e);
+            }
+
+        }
+        return config.getConfig();
+    }
+
+    protected static boolean keyTypeSupported(String type) {
+        return type != null && type.equals("RSA");
+    }
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/AbstractClaimMapper.java

@@ -0,0 +1,97 @@
+package org.keycloak.broker.oidc.mappers;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider;
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.JsonWebToken;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public abstract class AbstractClaimMapper extends AbstractIdentityProviderMapper {
+    public static final String CLAIM = "claim";
+    public static final String CLAIM_VALUE = "claim.value";
+
+    public static Object getClaimValue(JsonWebToken token, String claim) {
+        String[] split = claim.split("\\.");
+        Map<String, Object> jsonObject = token.getOtherClaims();
+        for (int i = 0; i < split.length; i++) {
+            if (i == split.length - 1) {
+                return jsonObject.get(split[i]);
+            } else {
+                Object val = jsonObject.get(split[i]);
+                if (!(val instanceof Map)) return null;
+                jsonObject = (Map<String, Object>)val;
+            }
+        }
+        return null;
+    }
+
+    public static Object getClaimValue(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String claim = mapperModel.getConfig().get(CLAIM);
+        return getClaimValue(context, claim);
+    }
+
+    public static Object getClaimValue(BrokeredIdentityContext context, String claim) {
+        {  // search access token
+            JsonWebToken token = (JsonWebToken)context.getContextData().get(KeycloakOIDCIdentityProvider.VALIDATED_ACCESS_TOKEN);
+            if (token != null) {
+                Object value = getClaimValue(token, claim);
+                if (value != null) return value;
+            }
+
+        }
+        {  // search ID Token
+            JsonWebToken token = (JsonWebToken)context.getContextData().get(KeycloakOIDCIdentityProvider.VALIDATED_ID_TOKEN);
+            if (token != null) {
+                Object value = getClaimValue(token, claim);
+                if (value != null) return value;
+            }
+
+        }
+        return null;
+    }
+
+
+    protected boolean hasClaimValue(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        Object value = getClaimValue(mapperModel, context);
+        String desiredValue = mapperModel.getConfig().get(CLAIM_VALUE);
+        return valueEquals(desiredValue, value);
+    }
+
+    public boolean valueEquals(String desiredValue, Object value) {
+        if (value instanceof String) {
+            if (desiredValue.equals(value)) return true;
+        } else if (value instanceof Double) {
+            try {
+                if (Double.valueOf(desiredValue).equals(value)) return true;
+            } catch (Exception e) {
+
+            }
+        } else if (value instanceof Integer) {
+            try {
+                if (Integer.valueOf(desiredValue).equals(value)) return true;
+            } catch (Exception e) {
+
+            }
+        } else if (value instanceof Boolean) {
+            try {
+                if (Boolean.valueOf(desiredValue).equals(value)) return true;
+            } catch (Exception e) {
+
+            }
+        } else if (value instanceof List) {
+            List list = (List)value;
+            for (Object val : list) {
+                return valueEquals(desiredValue, val);
+            }
+        }
+        return false;
+    }
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/AbstractJsonUserAttributeMapper.java

@@ -0,0 +1,206 @@
+package org.keycloak.broker.oidc.mappers;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.codehaus.jackson.JsonNode;
+import org.jboss.logging.Logger;
+import org.keycloak.broker.oidc.OIDCIdentityProvider;
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+/**
+ * Abstract class for Social Provider mappers which allow mapping of JSON user profile field into Keycloak user
+ * attribute. Concrete mapper classes with own ID and provider mapping must be implemented for each social provider who
+ * uses {@link JsonNode} user profile.
+ * 
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public abstract class AbstractJsonUserAttributeMapper extends AbstractIdentityProviderMapper {
+
+
+	protected static final Logger logger = Logger.getLogger(AbstractJsonUserAttributeMapper.class);
+
+	protected static final Logger LOGGER_DUMP_USER_PROFILE = Logger.getLogger("org.keycloak.social.user_profile_dump");
+
+	private static final String JSON_PATH_DELIMITER = ".";
+
+	/**
+	 * Config param where name of mapping source JSON User Profile field is stored.
+	 */
+	public static final String CONF_JSON_FIELD = "jsonField";
+	/**
+	 * Config param where name of mapping target USer attribute is stored.
+	 */
+	public static final String CONF_USER_ATTRIBUTE = "userAttribute";
+
+	/**
+	 * Key in {@link BrokeredIdentityContext#getContextData()} where {@link JsonNode} with user profile is stored.
+	 */
+	public static final String CONTEXT_JSON_NODE = OIDCIdentityProvider.USER_INFO;
+
+	private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+	static {
+		ProviderConfigProperty property;
+		ProviderConfigProperty property1;
+		property1 = new ProviderConfigProperty();
+		property1.setName(CONF_JSON_FIELD);
+		property1.setLabel("Social Profile JSON Field Path");
+		property1.setHelpText("Path of field in Social provider User Profile JSON data to get value from. You can use dot notation for nesting and square brackets for array index. Eg. 'contact.address[0].country'.");
+		property1.setType(ProviderConfigProperty.STRING_TYPE);
+		configProperties.add(property1);
+		property = new ProviderConfigProperty();
+		property.setName(CONF_USER_ATTRIBUTE);
+		property.setLabel("User Attribute Name");
+		property.setHelpText("User attribute name to store information into.");
+		property.setType(ProviderConfigProperty.STRING_TYPE);
+		configProperties.add(property);
+	}
+
+	/**
+	 * Store used profile JsonNode into user context for later use by this mapper. Profile data are dumped into special logger if enabled also to allow investigation of the structure. 
+	 * 
+	 * @param user context to store profile data into
+	 * @param profile to store into context
+	 * @param provider identification of social provider to be used in log dump
+	 * 
+	 * @see #importNewUser(KeycloakSession, RealmModel, UserModel, IdentityProviderMapperModel, BrokeredIdentityContext)
+	 * @see BrokeredIdentityContext#getContextData()
+	 */
+	public static void storeUserProfileForMapper(BrokeredIdentityContext user, JsonNode profile, String provider) {
+		user.getContextData().put(AbstractJsonUserAttributeMapper.CONTEXT_JSON_NODE, profile);
+		if (LOGGER_DUMP_USER_PROFILE.isDebugEnabled())
+			LOGGER_DUMP_USER_PROFILE.debug("User Profile JSON Data for provider "+provider+": " + profile);
+	}
+
+	@Override
+	public List<ProviderConfigProperty> getConfigProperties() {
+		return configProperties;
+	}
+
+	@Override
+	public String getDisplayCategory() {
+		return "Attribute Importer";
+	}
+
+	@Override
+	public String getDisplayType() {
+		return "Attribute Importer";
+	}
+
+	@Override
+	public String getHelpText() {
+		return "Import user profile information if it exists in Social provider JSON data into the specified user attribute.";
+	}
+
+	@Override
+	public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+		String attribute = mapperModel.getConfig().get(CONF_USER_ATTRIBUTE);
+		if (attribute == null || attribute.trim().isEmpty()) {
+			logger.debug("Attribute is not configured");
+			return;
+		}
+		attribute = attribute.trim();
+
+		String value = getJsonValue(mapperModel, context);
+		if (value != null) {
+			user.setSingleAttribute(attribute, value);
+		}
+	}
+
+	@Override
+	public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+		// we do not update user profile from social provider
+	}
+
+	protected static String getJsonValue(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+
+		String jsonField = mapperModel.getConfig().get(CONF_JSON_FIELD);
+		if (jsonField == null || jsonField.trim().isEmpty()) {
+			logger.debug("JSON field path is not configured");
+			return null;
+		}
+		jsonField = jsonField.trim();
+
+		if (jsonField.startsWith(JSON_PATH_DELIMITER) || jsonField.endsWith(JSON_PATH_DELIMITER) || jsonField.startsWith("[")) {
+			logger.debug("JSON field path is invalid " + jsonField);
+			return null;
+		}
+
+		JsonNode profileJsonNode = (JsonNode) context.getContextData().get(CONTEXT_JSON_NODE);
+
+		String value = getJsonValue(profileJsonNode, jsonField);
+
+		if (value == null) {
+			logger.debug("User profile JSON value '" + jsonField + "' is not available.");
+		}
+
+		return value;
+	}
+
+	protected static String getJsonValue(JsonNode baseNode, String fieldPath) {
+		logger.debug("Going to process JsonNode path " + fieldPath + " on data " + baseNode);
+		if (baseNode != null) {
+
+			int idx = fieldPath.indexOf(JSON_PATH_DELIMITER);
+
+			String currentFieldName = fieldPath;
+			if (idx > 0) {
+				currentFieldName = fieldPath.substring(0, idx).trim();
+				if (currentFieldName.isEmpty()) {
+					logger.debug("JSON path is invalid " + fieldPath);
+					return null;
+				}
+			}
+
+			String currentNodeName = currentFieldName;
+			int arrayIndex = -1;
+			if (currentFieldName.endsWith("]")) {
+				int bi = currentFieldName.indexOf("[");
+				if (bi == -1) {
+					logger.debug("Invalid array index construct in " + currentFieldName);
+					return null;
+				}
+				try {
+				String is = currentFieldName.substring(bi+1, currentFieldName.length() - 1).trim();
+					arrayIndex = Integer.parseInt(is);
+				} catch (Exception e) {
+					logger.debug("Invalid array index construct in " + currentFieldName);
+					return null;
+				}
+				currentNodeName = currentFieldName.substring(0,bi).trim();
+			}
+
+			JsonNode currentNode = baseNode.get(currentNodeName);
+			if (arrayIndex > -1 && currentNode.isArray()) {
+				logger.debug("Going to take array node at index " + arrayIndex);
+				currentNode = currentNode.get(arrayIndex);
+			}
+
+			if (currentNode == null) {
+				logger.debug("JsonNode not found for name " + currentFieldName);
+				return null;
+			}
+
+			if (idx < 0) {
+				if (!currentNode.isValueNode()) {
+					logger.debug("JsonNode is not value node for name " + currentFieldName);
+					return null;
+				}
+				String ret = currentNode.asText();
+				if (ret != null && !ret.trim().isEmpty())
+					return ret.trim();
+			} else {
+				return getJsonValue(currentNode, fieldPath.substring(idx + 1));
+			}
+		}
+		return null;
+	}
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/ClaimToRoleMapper.java

@@ -0,0 +1,105 @@
+package org.keycloak.broker.oidc.mappers;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
+import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.HardcodedRoleMapper;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class ClaimToRoleMapper extends AbstractClaimMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {KeycloakOIDCIdentityProviderFactory.PROVIDER_ID, OIDCIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    static {
+        ProviderConfigProperty property;
+        ProviderConfigProperty property1;
+        property1 = new ProviderConfigProperty();
+        property1.setName(CLAIM);
+        property1.setLabel("Claim");
+        property1.setHelpText("Name of claim to search for in token.  You can reference nested claims using a '.', i.e. 'address.locality'.");
+        property1.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property1);
+        property1 = new ProviderConfigProperty();
+        property1.setName(CLAIM_VALUE);
+        property1.setLabel("Claim Value");
+        property1.setHelpText("Value the claim must have.  If the claim is an array, then the value must be contained in the array.");
+        property1.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property1);
+        property = new ProviderConfigProperty();
+        property.setName(HardcodedRoleMapper.ROLE);
+        property.setLabel("Role");
+        property.setHelpText("Role to grant to user if claim is present.  Click 'Select Role' button to browse roles, or just type it in the textbox.  To reference an application role the syntax is appname.approle, i.e. myapp.myrole");
+        property.setType(ProviderConfigProperty.ROLE_TYPE);
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "oidc-role-idp-mapper";
+
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Role Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Claim to Role";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
+        if (hasClaimValue(mapperModel, context)) {
+            RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
+            if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+            user.grantRole(role);
+        }
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
+        if (!hasClaimValue(mapperModel, context)) {
+            RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
+            if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+            user.deleteRoleMapping(role);
+        }
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "If a claim exists, grant the user the specified realm or application role.";
+    }
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/ExternalKeycloakRoleToRoleMapper.java

@@ -0,0 +1,118 @@
+package org.keycloak.broker.oidc.mappers;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider;
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
+import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.HardcodedRoleMapper;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.JsonWebToken;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class ExternalKeycloakRoleToRoleMapper extends AbstractClaimMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {KeycloakOIDCIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+    private static final String EXTERNAL_ROLE = "external.role";
+
+    static {
+        ProviderConfigProperty property;
+        ProviderConfigProperty property1;
+        property1 = new ProviderConfigProperty();
+        property1.setName(EXTERNAL_ROLE);
+        property1.setLabel("External role");
+        property1.setHelpText("External role to check for.  To reference an application role the syntax is appname.approle, i.e. myapp.myrole.");
+        property1.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property1);
+        property = new ProviderConfigProperty();
+        property.setName(HardcodedRoleMapper.ROLE);
+        property.setLabel("Role");
+        property.setHelpText("Role to grant to user if external role is present.  Click 'Select Role' button to browse roles, or just type it in the textbox.  To reference an application role the syntax is appname.approle, i.e. myapp.myrole");
+        property.setType(ProviderConfigProperty.ROLE_TYPE);
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "keycloak-oidc-role-to-role-idp-mapper";
+
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Role Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "External Role to Role";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        RoleModel role = hasRole(realm, mapperModel, context);
+        if (role != null) {
+            user.grantRole(role);
+        }
+    }
+
+    private RoleModel hasRole(RealmModel realm,IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        JsonWebToken token = (JsonWebToken)context.getContextData().get(KeycloakOIDCIdentityProvider.VALIDATED_ACCESS_TOKEN);
+        //if (token == null) return;
+        String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
+        String[] parseRole = HardcodedRoleMapper.parseRole(mapperModel.getConfig().get(EXTERNAL_ROLE));
+        String externalRoleName = parseRole[1];
+        String claimName = null;
+        if (parseRole[0] == null) {
+            claimName = "realm_access.roles";
+        } else {
+            claimName = "resource_access." + parseRole[0] + ".roles";
+        }
+        Object claim = getClaimValue(token, claimName);
+        if (valueEquals(externalRoleName, claim)) {
+            RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
+            if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+            return role;
+        }
+        return null;
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        RoleModel role = hasRole(realm, mapperModel, context);
+        if (role == null) {
+            user.deleteRoleMapping(role);
+        }
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Looks for an external role in a keycloak access token.  If external role exists, grant the user the specified realm or application role.";
+    }
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/UserAttributeMapper.java

@@ -0,0 +1,98 @@
+package org.keycloak.broker.oidc.mappers;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
+import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class UserAttributeMapper extends AbstractClaimMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {KeycloakOIDCIdentityProviderFactory.PROVIDER_ID, OIDCIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    public static final String USER_ATTRIBUTE = "user.attribute";
+
+    static {
+        ProviderConfigProperty property;
+        ProviderConfigProperty property1;
+        property1 = new ProviderConfigProperty();
+        property1.setName(CLAIM);
+        property1.setLabel("Claim");
+        property1.setHelpText("Name of claim to search for in token.  You can reference nested claims using a '.', i.e. 'address.locality'.");
+        property1.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property1);
+        property = new ProviderConfigProperty();
+        property.setName(USER_ATTRIBUTE);
+        property.setLabel("User Attribute Name");
+        property.setHelpText("User attribute name to store claim.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "oidc-user-attribute-idp-mapper";
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(USER_ATTRIBUTE);
+        Object value = getClaimValue(mapperModel, context);
+        if (value != null) {
+            user.setSingleAttribute(attribute, value.toString());
+        }
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(USER_ATTRIBUTE);
+        Object value = getClaimValue(mapperModel, context);
+        String current = user.getFirstAttribute(attribute);
+        if (value != null && !value.equals(current)) {
+            user.setSingleAttribute(attribute, value.toString());
+        } else if (value == null) {
+            user.removeAttribute(attribute);
+        }
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Import declared claim if it exists in ID or access token into the specified user attribute.";
+    }
+
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/mappers/UsernameTemplateMapper.java

@@ -0,0 +1,109 @@
+package org.keycloak.broker.oidc.mappers;
+
+import org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory;
+import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class UsernameTemplateMapper extends AbstractClaimMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {KeycloakOIDCIdentityProviderFactory.PROVIDER_ID, OIDCIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    public static final String TEMPLATE = "template";
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(TEMPLATE);
+        property.setLabel("Template");
+        property.setHelpText("Template to use to format the username to import.  Substitutions are enclosed in ${}.  For example: '${ALIAS}.${CLAIM.sub}'.  ALIAS is the provider alias.  CLAIM.<NAME> references an ID or Access token claim.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        property.setDefaultValue("${ALIAS}.${CLAIM.preferred_username}");
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "oidc-username-idp-mapper";
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Preprocessor";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Username Template Importer";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+    }
+
+    static Pattern substitution = Pattern.compile("\\$\\{([^}]+)\\}");
+
+    @Override
+    public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String template = mapperModel.getConfig().get(TEMPLATE);
+        Matcher m = substitution.matcher(template);
+        StringBuffer sb = new StringBuffer();
+        while (m.find()) {
+            String variable = m.group(1);
+            if (variable.equals("ALIAS")) {
+                m.appendReplacement(sb, context.getIdpConfig().getAlias());
+            } else if (variable.equals("UUID")) {
+                m.appendReplacement(sb, KeycloakModelUtils.generateId());
+            } else if (variable.startsWith("CLAIM.")) {
+                String name = variable.substring("CLAIM.".length());
+                Object value = AbstractClaimMapper.getClaimValue(context, name);
+                if (value == null) value = "";
+                m.appendReplacement(sb, value.toString());
+            } else {
+                m.appendReplacement(sb, m.group(1));
+            }
+
+        }
+        m.appendTail(sb);
+        String username = sb.toString();
+        context.setModelUsername(username);
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Format the username to import.";
+    }
+}

broker/oidc/src/main/java/org/keycloak/broker/oidc/util/JsonSimpleHttp.java

@@ -0,0 +1,32 @@
+package org.keycloak.broker.oidc.util;
+
+import org.codehaus.jackson.JsonNode;
+import org.codehaus.jackson.map.ObjectMapper;
+import org.keycloak.broker.provider.util.SimpleHttp;
+
+import java.io.IOException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JsonSimpleHttp extends SimpleHttp {
+    public JsonSimpleHttp(String url, String method) {
+        super(url, method);
+    }
+
+    public static JsonSimpleHttp doGet(String url) {
+        return new JsonSimpleHttp(url, "GET");
+    }
+
+    public static JsonSimpleHttp doPost(String url) {
+        return new JsonSimpleHttp(url, "POST");
+    }
+
+    private static ObjectMapper mapper = new ObjectMapper();
+
+    public static JsonNode asJson(SimpleHttp request) throws IOException {
+        return mapper.readTree(request.asString());
+    }
+
+}

broker/oidc/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory

@@ -0,0 +1,2 @@
+org.keycloak.broker.oidc.OIDCIdentityProviderFactory
+org.keycloak.broker.oidc.KeycloakOIDCIdentityProviderFactory

broker/oidc/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderMapper

@@ -0,0 +1,4 @@
+org.keycloak.broker.oidc.mappers.ClaimToRoleMapper
+org.keycloak.broker.oidc.mappers.ExternalKeycloakRoleToRoleMapper
+org.keycloak.broker.oidc.mappers.UserAttributeMapper
+org.keycloak.broker.oidc.mappers.UsernameTemplateMapper

broker/oidc/src/test/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProviderTest.java

@@ -0,0 +1,133 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ */
+package org.keycloak.broker.oidc;
+
+import org.codehaus.jackson.JsonNode;
+import org.junit.Assert;
+import org.junit.Test;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.models.IdentityProviderModel;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Unit test for {@link AbstractOAuth2IdentityProvider}
+ * 
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public class AbstractOAuth2IdentityProviderTest {
+	
+	@Test
+	public void constructor_defaultScopeHandling(){
+		TestProvider tested = getTested();
+		
+		//default scope is set from the provider if not provided in the configuration
+		Assert.assertEquals( tested.getDefaultScopes(), tested.getConfig().getDefaultScope());
+		
+		//default scope is preserved if provided in the configuration
+		IdentityProviderModel model = new IdentityProviderModel();
+		OAuth2IdentityProviderConfig config = new OAuth2IdentityProviderConfig(model);
+		config.setDefaultScope("myscope");
+		tested = new TestProvider(config);
+
+		Assert.assertEquals("myscope", tested.getConfig().getDefaultScope());
+		
+	}
+
+	@Test
+	public void getJsonProperty_asJsonNode() throws IOException {
+		TestProvider tested = getTested();
+
+		JsonNode jsonNode = tested
+				.asJsonNode("{\"nullone\":null, \"emptyone\":\"\", \"blankone\": \" \", \"withvalue\" : \"my value\", \"withbooleanvalue\" : true, \"withnumbervalue\" : 10}");
+		Assert.assertNull(tested.getJsonProperty(jsonNode, "nonexisting"));
+		Assert.assertNull(tested.getJsonProperty(jsonNode, "nullone"));
+		Assert.assertNull(tested.getJsonProperty(jsonNode, "emptyone"));
+		Assert.assertEquals(" ", tested.getJsonProperty(jsonNode, "blankone"));
+		Assert.assertEquals("my value", tested.getJsonProperty(jsonNode, "withvalue"));
+		Assert.assertEquals("true", tested.getJsonProperty(jsonNode, "withbooleanvalue"));
+		Assert.assertEquals("10", tested.getJsonProperty(jsonNode, "withnumbervalue"));
+	}
+
+	@Test(expected = IdentityBrokerException.class)
+	public void getFederatedIdentity_responseUrlLine_tokenNotFound() {
+		TestProvider tested = getTested();
+		tested.getFederatedIdentity("cosi=sss");
+	}
+
+	@Test(expected = IdentityBrokerException.class)
+	public void getFederatedIdentity_responseJSON_tokenNotFound() {
+		TestProvider tested = getTested();
+		Map<String, String> notes = new HashMap<>();
+		tested.getFederatedIdentity("{\"cosi\":\"sss\"}");
+	}
+
+	@Test(expected = IdentityBrokerException.class)
+	public void getFederatedIdentity_responseJSON_invalidFormat() {
+		TestProvider tested = getTested();
+		Map<String, String> notes = new HashMap<>();
+		tested.getFederatedIdentity("{\"cosi\":\"sss\"");
+	}
+
+	@Test(expected = IdentityBrokerException.class)
+	public void getFederatedIdentity_responseJSON_emptyTokenField() {
+		TestProvider tested = getTested();
+		tested.getFederatedIdentity("{\""
+				+ AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_ACCESS_TOKEN + "\" : \"\"}");
+	}
+
+	@Test(expected = IdentityBrokerException.class)
+	public void getFederatedIdentity_responseJSON_nullTokenField() {
+		TestProvider tested = getTested();
+		tested.getFederatedIdentity("{\""
+				+ AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_ACCESS_TOKEN + "\" : null}");
+	}
+
+	@Test
+	public void getFederatedIdentity_responseJSON() {
+		TestProvider tested = getTested();
+		BrokeredIdentityContext fi = tested.getFederatedIdentity("{\""
+				+ AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_ACCESS_TOKEN + "\" : \"458rt\"}");
+		Assert.assertNotNull(fi);
+		Assert.assertEquals("458rt", fi.getId());
+	}
+
+	@Test
+	public void getFederatedIdentity_responseUrlLine() {
+		TestProvider tested = getTested();
+        BrokeredIdentityContext fi = tested.getFederatedIdentity("cosi=sss&"
+				+ AbstractOAuth2IdentityProvider.OAUTH2_PARAMETER_ACCESS_TOKEN + "=458rtf&kdesi=ss}");
+		Assert.assertNotNull(fi);
+		Assert.assertEquals("458rtf", fi.getId());
+	}
+
+	private TestProvider getTested() {
+		IdentityProviderModel model = new IdentityProviderModel();
+		OAuth2IdentityProviderConfig config = new OAuth2IdentityProviderConfig(model);
+		return new TestProvider(config);
+	}
+
+	private static class TestProvider extends AbstractOAuth2IdentityProvider<OAuth2IdentityProviderConfig> {
+
+		public TestProvider(OAuth2IdentityProviderConfig config) {
+			super(config);
+		}
+
+		@Override
+		protected String getDefaultScopes() {
+			return "default";
+		}
+
+		protected BrokeredIdentityContext doGetFederatedIdentity(String accessToken) {
+			return new BrokeredIdentityContext(accessToken);
+		};
+
+	};
+
+}

broker/oidc/src/test/java/org/keycloak/broker/oidc/mappers/AbstractJsonUserAttributeMapperTest.java

@@ -0,0 +1,120 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ */
+package org.keycloak.broker.oidc.mappers;
+
+import java.io.IOException;
+
+import org.codehaus.jackson.JsonNode;
+import org.codehaus.jackson.JsonProcessingException;
+import org.codehaus.jackson.map.ObjectMapper;
+import org.junit.Assert;
+import org.junit.Test;
+
+/**
+ * Unit test for {@link AbstractJsonUserAttributeMapper}
+ * 
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public class AbstractJsonUserAttributeMapperTest {
+
+	private static ObjectMapper mapper = new ObjectMapper();
+
+	private static JsonNode baseNode;
+
+	private JsonNode getJsonNode() throws JsonProcessingException, IOException {
+		if (baseNode == null)
+			baseNode = mapper.readTree("{ \"value1\" : \"v1 \",\"value_empty\" : \"\", \"value_b\" : true, \"value_i\" : 454, " + " \"value_array\":[\"a1\",\"a2\"], " +" \"nest1\": {\"value1\": \" fgh \",\"value_empty\" : \"\", \"nest2\":{\"value_b\" : false, \"value_i\" : 43}}, "+ " \"nesta\": { \"a\":[{\"av1\": \"vala1\"},{\"av1\": \"vala2\"}]}"+" }");
+		return baseNode;
+	}
+
+	@Test
+	public void getJsonValue_invalidPath() throws JsonProcessingException, IOException {
+
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "."));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), ".."));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "...value1"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), ".value1"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value1."));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "[]"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "[value1"));
+	}
+
+	@Test
+	public void getJsonValue_simpleValues() throws JsonProcessingException, IOException {
+
+		//unknown field returns null
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_unknown"));
+		
+		// we check value is trimmed also!
+		Assert.assertEquals("v1", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_empty"));
+
+		Assert.assertEquals("true", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_b"));
+		Assert.assertEquals("454", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_i"));
+
+	}
+
+	@Test
+	public void getJsonValue_nestedSimpleValues() throws JsonProcessingException, IOException {
+
+		// null if path points to JSON object
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.nest2"));
+
+		//unknown field returns null
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.value_unknown"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.nest2.value_unknown"));
+
+		// we check value is trimmed also!
+		Assert.assertEquals("fgh", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.value1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.value_empty"));
+
+		Assert.assertEquals("false", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.nest2.value_b"));
+		Assert.assertEquals("43", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.nest2.value_i"));
+
+		// null if invalid nested path
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1."));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nest1.nest2."));
+	}
+
+	@Test
+	public void getJsonValue_simpleArray() throws JsonProcessingException, IOException {
+
+		// array field itself returns null if no index is provided
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array"));
+		// outside index returns null
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[2]"));
+
+		//corect index
+		Assert.assertEquals("a1", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[0]"));
+		Assert.assertEquals("a2", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[1]"));
+		
+		//incorrect array constructs
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[]"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array]"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array["));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[a]"));
+		Assert.assertNull(AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "value_array[-2]"));
+	}
+
+	@Test
+	public void getJsonValue_nestedArrayWithObjects() throws JsonProcessingException, IOException {
+		Assert.assertEquals("vala1", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[0].av1"));
+		Assert.assertEquals("vala2", AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[1].av1"));
+
+		//different path erros or nonexisting indexes or fields return null
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[2].av1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[0]"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[0].av_unknown"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[].av1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a.av1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a].av1"));
+		Assert.assertEquals(null, AbstractJsonUserAttributeMapper.getJsonValue(getJsonNode(), "nesta.a[.av1"));
+		
+	}
+
+}

broker/pom.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-broker-parent</artifactId>
+    <name>Keycloak Broker Parent</name>
+    <description/>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>core</module>
+        <module>oidc</module>
+        <module>saml</module>
+    </modules>
+
+</project>

broker/saml/pom.xml

@@ -0,0 +1,50 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-broker-saml</artifactId>
+    <name>Keycloak Broker - SAML Identity Provider</name>
+    <description/>
+    <packaging>jar</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-broker-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-protocol</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-saml-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-events-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+</project>

broker/saml/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java

@@ -0,0 +1,438 @@
+package org.keycloak.broker.saml;
+
+import org.jboss.logging.Logger;
+import org.keycloak.common.ClientConnection;
+import org.keycloak.common.VerificationException;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.provider.IdentityProvider;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.AttributeStatementType;
+import org.keycloak.dom.saml.v2.assertion.AttributeType;
+import org.keycloak.dom.saml.v2.assertion.AuthnStatementType;
+import org.keycloak.dom.saml.v2.assertion.NameIDType;
+import org.keycloak.dom.saml.v2.assertion.SubjectType;
+import org.keycloak.dom.saml.v2.protocol.LogoutRequestType;
+import org.keycloak.dom.saml.v2.protocol.RequestAbstractType;
+import org.keycloak.dom.saml.v2.protocol.ResponseType;
+import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.events.EventType;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.saml.JaxrsSAML2BindingBuilder;
+import org.keycloak.saml.SAML2LogoutResponseBuilder;
+import org.keycloak.saml.SAMLRequestParser;
+import org.keycloak.protocol.saml.SamlProtocol;
+import org.keycloak.protocol.saml.SamlProtocolUtils;
+import org.keycloak.saml.common.constants.GeneralConstants;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+import org.keycloak.saml.common.exceptions.ConfigurationException;
+import org.keycloak.saml.common.exceptions.ProcessingException;
+import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
+import org.keycloak.saml.processing.core.saml.v2.constants.X500SAMLProfileConstants;
+import org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil;
+import org.keycloak.saml.processing.core.util.XMLSignatureUtil;
+import org.keycloak.saml.processing.web.util.PostBindingUtil;
+import org.keycloak.services.ErrorPage;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.messages.Messages;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.FormParam;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class SAMLEndpoint {
+    protected static final Logger logger = Logger.getLogger(SAMLEndpoint.class);
+    public static final String SAML_FEDERATED_SESSION_INDEX = "SAML_FEDERATED_SESSION_INDEX";
+    public static final String SAML_FEDERATED_SUBJECT = "SAML_FEDERATED_SUBJECT";
+    public static final String SAML_FEDERATED_SUBJECT_NAMEFORMAT = "SAML_FEDERATED_SUBJECT_NAMEFORMAT";
+    public static final String SAML_LOGIN_RESPONSE = "SAML_LOGIN_RESPONSE";
+    public static final String SAML_ASSERTION = "SAML_ASSERTION";
+    public static final String SAML_AUTHN_STATEMENT = "SAML_AUTHN_STATEMENT";
+    protected RealmModel realm;
+    protected EventBuilder event;
+    protected SAMLIdentityProviderConfig config;
+    protected IdentityProvider.AuthenticationCallback callback;
+    protected SAMLIdentityProvider provider;
+
+    @Context
+    private UriInfo uriInfo;
+
+    @Context
+    private KeycloakSession session;
+
+    @Context
+    private ClientConnection clientConnection;
+
+    @Context
+    private HttpHeaders headers;
+
+
+    public SAMLEndpoint(RealmModel realm, SAMLIdentityProvider provider, SAMLIdentityProviderConfig config, IdentityProvider.AuthenticationCallback callback) {
+        this.realm = realm;
+        this.config = config;
+        this.callback = callback;
+        this.provider = provider;
+    }
+
+    @GET
+    public Response redirectBinding(@QueryParam(GeneralConstants.SAML_REQUEST_KEY) String samlRequest,
+                                    @QueryParam(GeneralConstants.SAML_RESPONSE_KEY) String samlResponse,
+                                    @QueryParam(GeneralConstants.RELAY_STATE) String relayState)  {
+        return new RedirectBinding().execute(samlRequest, samlResponse, relayState);
+    }
+
+
+    /**
+     */
+    @POST
+    @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+    public Response postBinding(@FormParam(GeneralConstants.SAML_REQUEST_KEY) String samlRequest,
+                                @FormParam(GeneralConstants.SAML_RESPONSE_KEY) String samlResponse,
+                                @FormParam(GeneralConstants.RELAY_STATE) String relayState) {
+        return new PostBinding().execute(samlRequest, samlResponse, relayState);
+    }
+
+    protected abstract class Binding {
+        private boolean checkSsl() {
+            if (uriInfo.getBaseUri().getScheme().equals("https")) {
+                return true;
+            } else {
+                return !realm.getSslRequired().isRequired(clientConnection);
+            }
+        }
+
+        protected Response basicChecks(String samlRequest, String samlResponse) {
+            if (!checkSsl()) {
+                event.event(EventType.LOGIN);
+                event.error(Errors.SSL_REQUIRED);
+                return ErrorPage.error(session, Messages.HTTPS_REQUIRED);
+            }
+            if (!realm.isEnabled()) {
+                event.event(EventType.LOGIN_ERROR);
+                event.error(Errors.REALM_DISABLED);
+                return ErrorPage.error(session, Messages.REALM_NOT_ENABLED);
+            }
+
+            if (samlRequest == null && samlResponse == null) {
+                event.event(EventType.LOGIN);
+                event.error(Errors.INVALID_REQUEST);
+                return ErrorPage.error(session, Messages.INVALID_REQUEST);
+
+            }
+            return null;
+        }
+
+        protected abstract String getBindingType();
+        protected abstract void verifySignature(String key, SAMLDocumentHolder documentHolder) throws VerificationException;
+        protected abstract SAMLDocumentHolder extractRequestDocument(String samlRequest);
+        protected abstract SAMLDocumentHolder extractResponseDocument(String response);
+        protected PublicKey getIDPKey() {
+            X509Certificate certificate = null;
+            try {
+                certificate = XMLSignatureUtil.getX509CertificateFromKeyInfoString(config.getSigningCertificate().replaceAll("\\s", ""));
+            } catch (ProcessingException e) {
+                throw new RuntimeException(e);
+            }
+            return certificate.getPublicKey();
+        }
+
+        public Response execute(String samlRequest, String samlResponse, String relayState) {
+            event = new EventBuilder(realm, session, clientConnection);
+            Response response = basicChecks(samlRequest, samlResponse);
+            if (response != null) return response;
+            if (samlRequest != null) return handleSamlRequest(samlRequest, relayState);
+            else return handleSamlResponse(samlResponse, relayState);
+        }
+
+        protected Response handleSamlRequest(String samlRequest, String relayState) {
+            SAMLDocumentHolder holder = extractRequestDocument(samlRequest);
+            RequestAbstractType requestAbstractType = (RequestAbstractType) holder.getSamlObject();
+            // validate destination
+            if (requestAbstractType.getDestination() != null && !uriInfo.getAbsolutePath().equals(requestAbstractType.getDestination())) {
+                event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
+                event.detail(Details.REASON, "invalid_destination");
+                event.error(Errors.INVALID_SAML_RESPONSE);
+                return ErrorPage.error(session, Messages.INVALID_REQUEST);
+            }
+            if (config.isValidateSignature()) {
+                try {
+                    verifySignature(GeneralConstants.SAML_REQUEST_KEY, holder);
+                } catch (VerificationException e) {
+                    logger.error("validation failed", e);
+                    event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
+                    event.error(Errors.INVALID_SIGNATURE);
+                    return ErrorPage.error(session, Messages.INVALID_REQUESTER);
+                }
+            }
+
+            if (requestAbstractType instanceof LogoutRequestType) {
+                logger.debug("** logout request");
+                event.event(EventType.LOGOUT);
+                LogoutRequestType logout = (LogoutRequestType) requestAbstractType;
+                return logoutRequest(logout, relayState);
+
+            } else {
+                event.event(EventType.LOGIN);
+                event.error(Errors.INVALID_TOKEN);
+                return ErrorPage.error(session, Messages.INVALID_REQUEST);
+            }
+        }
+
+        protected Response logoutRequest(LogoutRequestType request, String relayState) {
+            String brokerUserId = config.getAlias() + "." + request.getNameID().getValue();
+            if (request.getSessionIndex() == null || request.getSessionIndex().isEmpty()) {
+                List<UserSessionModel> userSessions = session.sessions().getUserSessionByBrokerUserId(realm, brokerUserId);
+                for (UserSessionModel userSession : userSessions) {
+                    if (userSession.getState() == UserSessionModel.State.LOGGING_OUT || userSession.getState() == UserSessionModel.State.LOGGED_OUT) {
+                        continue;
+                    }
+                    try {
+                        AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, false);
+                    } catch (Exception e) {
+                        logger.warn("failed to do backchannel logout for userSession", e);
+                    }
+                }
+
+            }  else {
+                for (String sessionIndex : request.getSessionIndex()) {
+                    String brokerSessionId = brokerUserId + "." + sessionIndex;
+                    UserSessionModel userSession = session.sessions().getUserSessionByBrokerSessionId(realm, brokerSessionId);
+                    if (userSession != null) {
+                        if (userSession.getState() == UserSessionModel.State.LOGGING_OUT || userSession.getState() == UserSessionModel.State.LOGGED_OUT) {
+                            continue;
+                        }
+                        try {
+                            AuthenticationManager.backchannelLogout(session, realm, userSession, uriInfo, clientConnection, headers, false);
+                        } catch (Exception e) {
+                            logger.warn("failed to do backchannel logout for userSession", e);
+                        }
+                    }
+                }
+            }
+
+            String issuerURL = getEntityId(uriInfo, realm);
+            SAML2LogoutResponseBuilder builder = new SAML2LogoutResponseBuilder();
+            builder.logoutRequestID(request.getID());
+            builder.destination(config.getSingleLogoutServiceUrl());
+            builder.issuer(issuerURL);
+            JaxrsSAML2BindingBuilder binding = new JaxrsSAML2BindingBuilder()
+                        .relayState(relayState);
+            if (config.isWantAuthnRequestsSigned()) {
+                binding.signWith(realm.getPrivateKey(), realm.getPublicKey(), realm.getCertificate())
+                        .signatureAlgorithm(provider.getSignatureAlgorithm())
+                        .signDocument();
+            }
+            try {
+                if (config.isPostBindingResponse()) {
+                    return binding.postBinding(builder.buildDocument()).response(config.getSingleLogoutServiceUrl());
+                } else {
+                    return binding.redirectBinding(builder.buildDocument()).response(config.getSingleLogoutServiceUrl());
+                }
+            } catch (ConfigurationException e) {
+                throw new RuntimeException(e);
+            } catch (ProcessingException e) {
+                throw new RuntimeException(e);
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+
+        }
+
+        private String getEntityId(UriInfo uriInfo, RealmModel realm) {
+            return UriBuilder.fromUri(uriInfo.getBaseUri()).path("realms").path(realm.getName()).build().toString();
+        }
+        protected Response handleLoginResponse(String samlResponse, SAMLDocumentHolder holder, ResponseType responseType, String relayState) {
+
+            try {
+                AssertionType assertion = AssertionUtil.getAssertion(responseType, realm.getPrivateKey());
+                SubjectType subject = assertion.getSubject();
+                SubjectType.STSubType subType = subject.getSubType();
+                NameIDType subjectNameID = (NameIDType) subType.getBaseID();
+                //Map<String, String> notes = new HashMap<>();
+                BrokeredIdentityContext identity = new BrokeredIdentityContext(subjectNameID.getValue());
+                identity.setCode(relayState);
+                identity.getContextData().put(SAML_LOGIN_RESPONSE, responseType);
+                identity.getContextData().put(SAML_ASSERTION, assertion);
+
+                identity.setUsername(subjectNameID.getValue());
+
+                //SAML Spec 2.2.2 Format is optional
+                if (subjectNameID.getFormat() != null && subjectNameID.getFormat().toString().equals(JBossSAMLURIConstants.NAMEID_FORMAT_EMAIL.get())) {
+                    identity.setEmail(subjectNameID.getValue());
+                }
+
+                if (config.isStoreToken()) {
+                    identity.setToken(samlResponse);
+                }
+
+                AuthnStatementType authn = null;
+                for (Object statement : assertion.getStatements()) {
+                    if (statement instanceof AuthnStatementType) {
+                        authn = (AuthnStatementType)statement;
+                        identity.getContextData().put(SAML_AUTHN_STATEMENT, authn);
+                        break;
+                    }
+                }
+                if (assertion.getAttributeStatements() != null ) {
+                    for (AttributeStatementType attrStatement : assertion.getAttributeStatements()) {
+                        for (AttributeStatementType.ASTChoiceType choice : attrStatement.getAttributes()) {
+                            AttributeType attribute = choice.getAttribute();
+                            if (X500SAMLProfileConstants.EMAIL.getFriendlyName().equals(attribute.getFriendlyName())
+                                    || X500SAMLProfileConstants.EMAIL.get().equals(attribute.getName())) {
+                                if (!attribute.getAttributeValue().isEmpty()) identity.setEmail(attribute.getAttributeValue().get(0).toString());
+                            }
+                        }
+
+                    }
+
+                }
+                String brokerUserId = config.getAlias() + "." + subjectNameID.getValue();
+                identity.setBrokerUserId(brokerUserId);
+                identity.setIdpConfig(config);
+                identity.setIdp(provider);
+                if (authn != null && authn.getSessionIndex() != null) {
+                    identity.setBrokerSessionId(identity.getBrokerUserId() + "." + authn.getSessionIndex());
+                 }
+
+
+                return callback.authenticated(identity);
+
+            } catch (Exception e) {
+                throw new IdentityBrokerException("Could not process response from SAML identity provider.", e);
+            }
+        }
+
+
+
+
+        public Response handleSamlResponse(String samlResponse, String relayState) {
+            SAMLDocumentHolder holder = extractResponseDocument(samlResponse);
+            StatusResponseType statusResponse = (StatusResponseType)holder.getSamlObject();
+            // validate destination
+            if (statusResponse.getDestination() != null && !uriInfo.getAbsolutePath().toString().equals(statusResponse.getDestination())) {
+                event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
+                event.detail(Details.REASON, "invalid_destination");
+                event.error(Errors.INVALID_SAML_RESPONSE);
+                return ErrorPage.error(session, Messages.INVALID_FEDERATED_IDENTITY_ACTION);
+            }
+            if (config.isValidateSignature()) {
+                try {
+                    verifySignature(GeneralConstants.SAML_RESPONSE_KEY, holder);
+                } catch (VerificationException e) {
+                    logger.error("validation failed", e);
+                    event.event(EventType.IDENTITY_PROVIDER_RESPONSE);
+                    event.error(Errors.INVALID_SIGNATURE);
+                    return ErrorPage.error(session, Messages.INVALID_FEDERATED_IDENTITY_ACTION);
+                }
+            }
+            if (statusResponse instanceof ResponseType) {
+                return handleLoginResponse(samlResponse, holder, (ResponseType)statusResponse, relayState);
+
+            } else {
+                // todo need to check that it is actually a LogoutResponse
+                return handleLogoutResponse(holder, statusResponse, relayState);
+            }
+            //throw new RuntimeException("Unknown response type");
+
+        }
+
+        protected Response handleLogoutResponse(SAMLDocumentHolder holder, StatusResponseType responseType, String relayState) {
+            if (relayState == null) {
+                logger.error("no valid user session");
+                event.event(EventType.LOGOUT);
+                event.error(Errors.USER_SESSION_NOT_FOUND);
+                return ErrorPage.error(session, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+            }
+            UserSessionModel userSession = session.sessions().getUserSession(realm, relayState);
+            if (userSession == null) {
+                logger.error("no valid user session");
+                event.event(EventType.LOGOUT);
+                event.error(Errors.USER_SESSION_NOT_FOUND);
+                return ErrorPage.error(session, Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR);
+            }
+            if (userSession.getState() != UserSessionModel.State.LOGGING_OUT) {
+                logger.error("usersession in different state");
+                event.event(EventType.LOGOUT);
+                event.error(Errors.USER_SESSION_NOT_FOUND);
+                return ErrorPage.error(session, Messages.SESSION_NOT_ACTIVE);
+            }
+            return AuthenticationManager.finishBrowserLogout(session, realm, userSession, uriInfo, clientConnection, headers);
+        }
+
+
+
+
+
+    }
+
+    protected class PostBinding extends Binding {
+        @Override
+        protected void verifySignature(String key, SAMLDocumentHolder documentHolder) throws VerificationException {
+            SamlProtocolUtils.verifyDocumentSignature(documentHolder.getSamlDocument(), getIDPKey());
+        }
+
+        @Override
+        protected SAMLDocumentHolder extractRequestDocument(String samlRequest) {
+            return SAMLRequestParser.parseRequestPostBinding(samlRequest);
+        }
+        @Override
+        protected SAMLDocumentHolder extractResponseDocument(String response) {
+            byte[] samlBytes = PostBindingUtil.base64Decode(response);
+            String xml = new String(samlBytes);
+            return SAMLRequestParser.parseResponseDocument(samlBytes);
+        }
+
+        @Override
+        protected String getBindingType() {
+            return SamlProtocol.SAML_POST_BINDING;
+        }
+    }
+
+    protected class RedirectBinding extends Binding {
+        @Override
+        protected void verifySignature(String key, SAMLDocumentHolder documentHolder) throws VerificationException {
+            PublicKey publicKey = getIDPKey();
+            SamlProtocolUtils.verifyRedirectSignature(publicKey, uriInfo, key);
+        }
+
+
+
+        @Override
+        protected SAMLDocumentHolder extractRequestDocument(String samlRequest) {
+            return SAMLRequestParser.parseRequestRedirectBinding(samlRequest);
+        }
+
+        @Override
+        protected SAMLDocumentHolder extractResponseDocument(String response) {
+            return SAMLRequestParser.parseRequestRedirectBinding(response);
+        }
+
+        @Override
+        protected String getBindingType() {
+            return SamlProtocol.SAML_REDIRECT_BINDING;
+        }
+
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/SAMLIdentityProvider.java

@@ -0,0 +1,266 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.saml;
+
+import org.jboss.logging.Logger;
+import org.keycloak.broker.provider.AbstractIdentityProvider;
+import org.keycloak.broker.provider.AuthenticationRequest;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.provider.util.SimpleHttp;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.AuthnStatementType;
+import org.keycloak.dom.saml.v2.assertion.NameIDType;
+import org.keycloak.dom.saml.v2.assertion.SubjectType;
+import org.keycloak.dom.saml.v2.protocol.ResponseType;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.FederatedIdentityModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.protocol.saml.JaxrsSAML2BindingBuilder;
+import org.keycloak.saml.SAML2AuthnRequestBuilder;
+import org.keycloak.saml.SAML2LogoutRequestBuilder;
+import org.keycloak.saml.SAML2NameIDPolicyBuilder;
+import org.keycloak.saml.SignatureAlgorithm;
+import org.keycloak.saml.common.constants.GeneralConstants;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+import java.security.KeyPair;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+
+/**
+ * @author Pedro Igor
+ */
+public class SAMLIdentityProvider extends AbstractIdentityProvider<SAMLIdentityProviderConfig> {
+    protected static final Logger logger = Logger.getLogger(SAMLIdentityProvider.class);
+    public SAMLIdentityProvider(SAMLIdentityProviderConfig config) {
+        super(config);
+    }
+
+    @Override
+    public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) {
+        return new SAMLEndpoint(realm, this, getConfig(), callback);
+    }
+
+    @Override
+    public Response performLogin(AuthenticationRequest request) {
+        try {
+            UriInfo uriInfo = request.getUriInfo();
+            RealmModel realm = request.getRealm();
+            String issuerURL = getEntityId(uriInfo, realm);
+            String destinationUrl = getConfig().getSingleSignOnServiceUrl();
+            String nameIDPolicyFormat = getConfig().getNameIDPolicyFormat();
+
+            if (nameIDPolicyFormat == null) {
+                nameIDPolicyFormat =  JBossSAMLURIConstants.NAMEID_FORMAT_PERSISTENT.get();
+            }
+
+            String protocolBinding = JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get();
+
+            String assertionConsumerServiceUrl = request.getRedirectUri();
+
+            if (getConfig().isPostBindingResponse()) {
+                protocolBinding = JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get();
+            }
+
+            SAML2AuthnRequestBuilder authnRequestBuilder = new SAML2AuthnRequestBuilder()
+                    .assertionConsumerUrl(assertionConsumerServiceUrl)
+                    .destination(destinationUrl)
+                    .issuer(issuerURL)
+                    .forceAuthn(getConfig().isForceAuthn())
+                    .protocolBinding(protocolBinding)
+                    .nameIdPolicy(SAML2NameIDPolicyBuilder.format(nameIDPolicyFormat));
+            JaxrsSAML2BindingBuilder binding = new JaxrsSAML2BindingBuilder()
+                    .relayState(request.getState());
+
+            if (getConfig().isWantAuthnRequestsSigned()) {
+                PrivateKey privateKey = realm.getPrivateKey();
+                PublicKey publicKey = realm.getPublicKey();
+
+                if (privateKey == null) {
+                    throw new IdentityBrokerException("Identity Provider [" + getConfig().getAlias() + "] wants a signed authentication request. But the Realm [" + realm.getName() + "] does not have a private key.");
+                }
+
+                if (publicKey == null) {
+                    throw new IdentityBrokerException("Identity Provider [" + getConfig().getAlias() + "] wants a signed authentication request. But the Realm [" + realm.getName() + "] does not have a public key.");
+                }
+
+                KeyPair keypair = new KeyPair(publicKey, privateKey);
+
+                binding.signWith(keypair);
+                binding.signatureAlgorithm(getSignatureAlgorithm());
+                binding.signDocument();
+            }
+
+            if (getConfig().isPostBindingAuthnRequest()) {
+                return binding.postBinding(authnRequestBuilder.toDocument()).request(destinationUrl);
+            } else {
+                return binding.redirectBinding(authnRequestBuilder.toDocument()).request(destinationUrl);
+            }
+        } catch (Exception e) {
+            throw new IdentityBrokerException("Could not create authentication request.", e);
+        }
+    }
+
+    private String getEntityId(UriInfo uriInfo, RealmModel realm) {
+        return UriBuilder.fromUri(uriInfo.getBaseUri()).path("realms").path(realm.getName()).build().toString();
+    }
+
+    @Override
+    public void attachUserSession(UserSessionModel userSession, ClientSessionModel clientSession, BrokeredIdentityContext context) {
+        ResponseType responseType = (ResponseType)context.getContextData().get(SAMLEndpoint.SAML_LOGIN_RESPONSE);
+        AssertionType assertion = (AssertionType)context.getContextData().get(SAMLEndpoint.SAML_ASSERTION);
+        SubjectType subject = assertion.getSubject();
+        SubjectType.STSubType subType = subject.getSubType();
+        NameIDType subjectNameID = (NameIDType) subType.getBaseID();
+        userSession.setNote(SAMLEndpoint.SAML_FEDERATED_SUBJECT, subjectNameID.getValue());
+        if (subjectNameID.getFormat() != null) userSession.setNote(SAMLEndpoint.SAML_FEDERATED_SUBJECT_NAMEFORMAT, subjectNameID.getFormat().toString());
+        AuthnStatementType authn =  (AuthnStatementType)context.getContextData().get(SAMLEndpoint.SAML_AUTHN_STATEMENT);
+        if (authn != null && authn.getSessionIndex() != null) {
+            userSession.setNote(SAMLEndpoint.SAML_FEDERATED_SESSION_INDEX, authn.getSessionIndex());
+
+        }
+    }
+
+    @Override
+    public Response retrieveToken(FederatedIdentityModel identity) {
+        return Response.ok(identity.getToken()).build();
+    }
+
+    @Override
+    public void backchannelLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+        String singleLogoutServiceUrl = getConfig().getSingleLogoutServiceUrl();
+        if (singleLogoutServiceUrl == null || singleLogoutServiceUrl.trim().equals("") || !getConfig().isBackchannelSupported()) return;
+        SAML2LogoutRequestBuilder logoutBuilder = buildLogoutRequest(userSession, uriInfo, realm, singleLogoutServiceUrl);
+        JaxrsSAML2BindingBuilder binding = buildLogoutBinding(userSession, realm);
+        try {
+            int status = SimpleHttp.doPost(singleLogoutServiceUrl)
+                    .param(GeneralConstants.SAML_REQUEST_KEY, binding.postBinding(logoutBuilder.buildDocument()).encoded())
+                    .param(GeneralConstants.RELAY_STATE, userSession.getId()).asStatus();
+            boolean success = status >=200 && status < 400;
+            if (!success) {
+                logger.warn("Failed saml backchannel broker logout to: " + singleLogoutServiceUrl);
+            }
+        } catch (Exception e) {
+            logger.warn("Failed saml backchannel broker logout to: " + singleLogoutServiceUrl, e);
+        }
+
+    }
+
+    @Override
+    public Response keycloakInitiatedBrowserLogout(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm) {
+        String singleLogoutServiceUrl = getConfig().getSingleLogoutServiceUrl();
+        if (singleLogoutServiceUrl == null || singleLogoutServiceUrl.trim().equals("")) return null;
+
+        if (getConfig().isBackchannelSupported()) {
+            backchannelLogout(userSession, uriInfo, realm);
+            return null;
+       } else {
+            try {
+                SAML2LogoutRequestBuilder logoutBuilder = buildLogoutRequest(userSession, uriInfo, realm, singleLogoutServiceUrl);
+                JaxrsSAML2BindingBuilder binding = buildLogoutBinding(userSession, realm);
+                return binding.postBinding(logoutBuilder.buildDocument()).request(singleLogoutServiceUrl);
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        }
+
+    }
+
+    protected SAML2LogoutRequestBuilder buildLogoutRequest(UserSessionModel userSession, UriInfo uriInfo, RealmModel realm, String singleLogoutServiceUrl) {
+        SAML2LogoutRequestBuilder logoutBuilder = new SAML2LogoutRequestBuilder()
+                .assertionExpiration(realm.getAccessCodeLifespan())
+                .issuer(getEntityId(uriInfo, realm))
+                .sessionIndex(userSession.getNote(SAMLEndpoint.SAML_FEDERATED_SESSION_INDEX))
+                .userPrincipal(userSession.getNote(SAMLEndpoint.SAML_FEDERATED_SUBJECT), userSession.getNote(SAMLEndpoint.SAML_FEDERATED_SUBJECT_NAMEFORMAT))
+                .destination(singleLogoutServiceUrl);
+        return logoutBuilder;
+    }
+
+    private JaxrsSAML2BindingBuilder buildLogoutBinding(UserSessionModel userSession, RealmModel realm) {
+        JaxrsSAML2BindingBuilder binding = new JaxrsSAML2BindingBuilder()
+                .relayState(userSession.getId());
+        if (getConfig().isWantAuthnRequestsSigned()) {
+            binding.signWith(realm.getPrivateKey(), realm.getPublicKey(), realm.getCertificate())
+                    .signatureAlgorithm(getSignatureAlgorithm())
+                    .signDocument();
+        }
+        return binding;
+    }
+
+    @Override
+    public Response export(UriInfo uriInfo, RealmModel realm, String format) {
+
+        String authnBinding = JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get();
+
+        if (getConfig().isPostBindingAuthnRequest()) {
+            authnBinding = JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get();
+        }
+
+        String endpoint = uriInfo.getBaseUriBuilder()
+                .path("realms").path(realm.getName())
+                .path("broker")
+                .path(getConfig().getAlias())
+                .path("endpoint")
+                .build().toString();
+
+
+
+        String descriptor =
+                "<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"" + getEntityId(uriInfo, realm) + "\">\n" +
+                "    <SPSSODescriptor AuthnRequestsSigned=\"" + getConfig().isWantAuthnRequestsSigned() + "\"\n" +
+                "            protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol http://schemas.xmlsoap.org/ws/2003/07/secext\">\n" +
+                "        <NameIDFormat>" + getConfig().getNameIDPolicyFormat() + "\n" +
+                "        </NameIDFormat>\n" +
+                "        <SingleLogoutService Binding=\"" + authnBinding + "\" Location=\"" + endpoint + "\"/>\n" +
+                "        <AssertionConsumerService\n" +
+                "                Binding=\"" + authnBinding + "\" Location=\"" + endpoint + "\"\n" +
+                "                index=\"1\" isDefault=\"true\" />\n";
+        if (getConfig().isWantAuthnRequestsSigned()) {
+            descriptor +=
+                "        <KeyDescriptor use=\"signing\">\n" +
+                "            <dsig:KeyInfo xmlns:dsig=\"http://www.w3.org/2000/09/xmldsig#\">\n" +
+                "                <dsig:X509Data>\n" +
+                "                    <dsig:X509Certificate>\n" + realm.getCertificatePem() + "\n" +
+                "                    </dsig:X509Certificate>\n" +
+                "                </dsig:X509Data>\n" +
+                "            </dsig:KeyInfo>\n" +
+                "        </KeyDescriptor>\n";
+        }
+        descriptor +=
+                "    </SPSSODescriptor>\n" +
+                "</EntityDescriptor>\n";
+        return Response.ok(descriptor, MediaType.APPLICATION_XML_TYPE).build();
+    }
+
+    public SignatureAlgorithm getSignatureAlgorithm() {
+        String alg = getConfig().getSignatureAlgorithm();
+        if (alg != null) {
+            SignatureAlgorithm algorithm = SignatureAlgorithm.valueOf(alg);
+            if (algorithm != null) return algorithm;
+        }
+        return SignatureAlgorithm.RSA_SHA256;
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/SAMLIdentityProviderConfig.java

@@ -0,0 +1,130 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.saml;
+
+import org.keycloak.models.IdentityProviderModel;
+
+/**
+ * @author Pedro Igor
+ */
+public class SAMLIdentityProviderConfig extends IdentityProviderModel {
+
+    public SAMLIdentityProviderConfig() {
+    }
+
+    public SAMLIdentityProviderConfig(IdentityProviderModel identityProviderModel) {
+        super(identityProviderModel);
+    }
+
+    public String getSingleSignOnServiceUrl() {
+        return getConfig().get("singleSignOnServiceUrl");
+    }
+
+    public void setSingleSignOnServiceUrl(String singleSignOnServiceUrl) {
+        getConfig().put("singleSignOnServiceUrl", singleSignOnServiceUrl);
+    }
+
+    public String getSingleLogoutServiceUrl() {
+        return getConfig().get("singleLogoutServiceUrl");
+    }
+
+    public void setSingleLogoutServiceUrl(String singleLogoutServiceUrl) {
+        getConfig().put("singleLogoutServiceUrl", singleLogoutServiceUrl);
+    }
+
+    public boolean isValidateSignature() {
+        return Boolean.valueOf(getConfig().get("validateSignature"));
+    }
+
+    public void setValidateSignature(boolean validateSignature) {
+        getConfig().put("validateSignature", String.valueOf(validateSignature));
+    }
+
+    public boolean isForceAuthn() {
+        return Boolean.valueOf(getConfig().get("forceAuthn"));
+    }
+
+    public void setForceAuthn(boolean forceAuthn) {
+        getConfig().put("forceAuthn", String.valueOf(forceAuthn));
+    }
+
+    public String getSigningCertificate() {
+        return getConfig().get("signingCertificate");
+    }
+
+    public void setSigningCertificate(String signingCertificate) {
+        getConfig().put("signingCertificate", signingCertificate);
+    }
+
+    public String getNameIDPolicyFormat() {
+        return getConfig().get("nameIDPolicyFormat");
+    }
+
+    public void setNameIDPolicyFormat(String nameIDPolicyFormat) {
+        getConfig().put("nameIDPolicyFormat", nameIDPolicyFormat);
+    }
+
+    public boolean isWantAuthnRequestsSigned() {
+        return Boolean.valueOf(getConfig().get("wantAuthnRequestsSigned"));
+    }
+
+    public void setWantAuthnRequestsSigned(boolean wantAuthnRequestsSigned) {
+        getConfig().put("wantAuthnRequestsSigned", String.valueOf(wantAuthnRequestsSigned));
+    }
+
+    public String getSignatureAlgorithm() {
+        return getConfig().get("signatureAlgorithm");
+    }
+
+    public void setSignatureAlgorithm(String signatureAlgorithm) {
+        getConfig().put("signatureAlgorithm", signatureAlgorithm);
+    }
+
+    public String getEncryptionPublicKey() {
+        return getConfig().get("encryptionPublicKey");
+    }
+
+    public void setEncryptionPublicKey(String encryptionPublicKey) {
+        getConfig().put("encryptionPublicKey", encryptionPublicKey);
+    }
+
+    public boolean isPostBindingAuthnRequest() {
+        return Boolean.valueOf(getConfig().get("postBindingAuthnRequest"));
+    }
+
+    public void setPostBindingAuthnRequest(boolean postBindingAuthnRequest) {
+        getConfig().put("postBindingAuthnRequest", String.valueOf(postBindingAuthnRequest));
+    }
+
+    public boolean isPostBindingResponse() {
+        return Boolean.valueOf(getConfig().get("postBindingResponse"));
+    }
+
+    public void setPostBindingResponse(boolean postBindingResponse) {
+        getConfig().put("postBindingResponse", String.valueOf(postBindingResponse));
+    }
+
+    public boolean isBackchannelSupported() {
+        return Boolean.valueOf(getConfig().get("backchannelSupported"));
+    }
+
+    public void setBackchannelSupported(boolean backchannel) {
+        getConfig().put("backchannelSupported", String.valueOf(backchannel));
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/SAMLIdentityProviderFactory.java

@@ -0,0 +1,162 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.broker.saml;
+
+import org.keycloak.broker.provider.AbstractIdentityProviderFactory;
+import org.keycloak.broker.saml.mappers.UsernameTemplateMapper;
+import org.keycloak.dom.saml.v2.metadata.EndpointType;
+import org.keycloak.dom.saml.v2.metadata.EntitiesDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.EntityDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.IDPSSODescriptorType;
+import org.keycloak.dom.saml.v2.metadata.KeyDescriptorType;
+import org.keycloak.dom.saml.v2.metadata.KeyTypes;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.IdentityProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
+import org.keycloak.saml.common.exceptions.ParsingException;
+import org.keycloak.saml.common.util.DocumentUtil;
+import org.keycloak.saml.processing.core.parsers.saml.SAMLParser;
+import org.w3c.dom.Element;
+
+import javax.xml.namespace.QName;
+import java.io.InputStream;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Pedro Igor
+ */
+public class SAMLIdentityProviderFactory extends AbstractIdentityProviderFactory<SAMLIdentityProvider> {
+
+    public static final String PROVIDER_ID = "saml";
+
+    @Override
+    public String getName() {
+        return "SAML v2.0";
+    }
+
+    @Override
+    public SAMLIdentityProvider create(IdentityProviderModel model) {
+        return new SAMLIdentityProvider(new SAMLIdentityProviderConfig(model));
+    }
+
+    @Override
+    public Map<String, String> parseConfig(InputStream inputStream) {
+        try {
+            Object parsedObject = new SAMLParser().parse(inputStream);
+            EntityDescriptorType entityType;
+
+            if (EntitiesDescriptorType.class.isInstance(parsedObject)) {
+                entityType = (EntityDescriptorType) ((EntitiesDescriptorType) parsedObject).getEntityDescriptor().get(0);
+            } else {
+                entityType = (EntityDescriptorType) parsedObject;
+            }
+
+            List<EntityDescriptorType.EDTChoiceType> choiceType = entityType.getChoiceType();
+
+            if (!choiceType.isEmpty()) {
+                IDPSSODescriptorType idpDescriptor = null;
+
+                //Metadata documents can contain multiple Descriptors (See ADFS metadata documents) such as RoleDescriptor, SPSSODescriptor, IDPSSODescriptor.
+                //So we need to loop through to find the IDPSSODescriptor.
+                for(EntityDescriptorType.EDTChoiceType edtChoiceType : entityType.getChoiceType()) {
+                    List<EntityDescriptorType.EDTDescriptorChoiceType> descriptors = edtChoiceType.getDescriptors();
+
+                    if(!descriptors.isEmpty() && descriptors.get(0).getIdpDescriptor() != null) {
+                        idpDescriptor = descriptors.get(0).getIdpDescriptor();
+                    }
+                }
+
+                if (idpDescriptor != null) {
+                    SAMLIdentityProviderConfig samlIdentityProviderConfig = new SAMLIdentityProviderConfig();
+                    String singleSignOnServiceUrl = null;
+                    boolean postBinding = false;
+                    for (EndpointType endpoint : idpDescriptor.getSingleSignOnService()) {
+                        if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
+                            singleSignOnServiceUrl = endpoint.getLocation().toString();
+                            postBinding = true;
+                            break;
+                        } else if (endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())){
+                            singleSignOnServiceUrl = endpoint.getLocation().toString();
+                        }
+                    }
+                    String singleLogoutServiceUrl = null;
+                    for (EndpointType endpoint : idpDescriptor.getSingleLogoutService()) {
+                        if (postBinding && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_POST_BINDING.get())) {
+                            singleLogoutServiceUrl = endpoint.getLocation().toString();
+                            break;
+                        } else if (!postBinding && endpoint.getBinding().toString().equals(JBossSAMLURIConstants.SAML_HTTP_REDIRECT_BINDING.get())){
+                            singleLogoutServiceUrl = endpoint.getLocation().toString();
+                            break;
+                        }
+
+                    }
+                    samlIdentityProviderConfig.setSingleLogoutServiceUrl(singleLogoutServiceUrl);
+                    samlIdentityProviderConfig.setSingleSignOnServiceUrl(singleSignOnServiceUrl);
+                    samlIdentityProviderConfig.setWantAuthnRequestsSigned(idpDescriptor.isWantAuthnRequestsSigned());
+                    samlIdentityProviderConfig.setValidateSignature(idpDescriptor.isWantAuthnRequestsSigned());
+                    samlIdentityProviderConfig.setPostBindingResponse(postBinding);
+                    samlIdentityProviderConfig.setPostBindingAuthnRequest(postBinding);
+
+                    List<KeyDescriptorType> keyDescriptor = idpDescriptor.getKeyDescriptor();
+                    String defaultCertificate = null;
+
+                    if (keyDescriptor != null) {
+                        for (KeyDescriptorType keyDescriptorType : keyDescriptor) {
+                            Element keyInfo = keyDescriptorType.getKeyInfo();
+                            Element x509KeyInfo = DocumentUtil.getChildElement(keyInfo, new QName("dsig", "X509Certificate"));
+
+                            if (KeyTypes.SIGNING.equals(keyDescriptorType.getUse())) {
+                                samlIdentityProviderConfig.setSigningCertificate(x509KeyInfo.getTextContent());
+                            } else if (KeyTypes.ENCRYPTION.equals(keyDescriptorType.getUse())) {
+                                samlIdentityProviderConfig.setEncryptionPublicKey(x509KeyInfo.getTextContent());
+                            } else if (keyDescriptorType.getUse() ==  null) {
+                                defaultCertificate = x509KeyInfo.getTextContent();
+                            }
+                        }
+                    }
+
+                    if (defaultCertificate != null) {
+                        if (samlIdentityProviderConfig.getSigningCertificate() == null) {
+                            samlIdentityProviderConfig.setSigningCertificate(defaultCertificate);
+                        }
+
+                        if (samlIdentityProviderConfig.getEncryptionPublicKey() == null) {
+                            samlIdentityProviderConfig.setEncryptionPublicKey(defaultCertificate);
+                        }
+                    }
+
+                    return samlIdentityProviderConfig.getConfig();
+                }
+            }
+        } catch (ParsingException pe) {
+            throw new RuntimeException("Could not parse IdP SAML Metadata", pe);
+        }
+
+        return new HashMap<String, String>();
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/mappers/AttributeToRoleMapper.java

@@ -0,0 +1,140 @@
+package org.keycloak.broker.saml.mappers;
+
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.provider.HardcodedRoleMapper;
+import org.keycloak.broker.provider.IdentityBrokerException;
+import org.keycloak.broker.saml.SAMLEndpoint;
+import org.keycloak.broker.saml.SAMLIdentityProviderFactory;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.AttributeStatementType;
+import org.keycloak.dom.saml.v2.assertion.AttributeType;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.representations.JsonWebToken;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class AttributeToRoleMapper extends AbstractIdentityProviderMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {SAMLIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    public static final String ATTRIBUTE_NAME = "attribute.name";
+    public static final String ATTRIBUTE_FRIENDLY_NAME = "attribute.friendly.name";
+    public static final String ATTRIBUTE_VALUE = "attribute.value";
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_NAME);
+        property.setLabel("Attribute Name");
+        property.setHelpText("Name of attribute to search for in assertion.  You can leave this blank and specify a friendly name instead.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_FRIENDLY_NAME);
+        property.setLabel("Friendly Name");
+        property.setHelpText("Friendly name of attribute to search for in assertion.  You can leave this blank and specify a name instead.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_VALUE);
+        property.setLabel("Attribute Value");
+        property.setHelpText("Value the attribute must have.  If the attribute is a list, then the value must be contained in the list.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(HardcodedRoleMapper.ROLE);
+        property.setLabel("Role");
+        property.setHelpText("Role to grant to user.  Click 'Select Role' button to browse roles, or just type it in the textbox.  To reference an application role the syntax is appname.approle, i.e. myapp.myrole");
+        property.setType(ProviderConfigProperty.ROLE_TYPE);
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "saml-role-idp-mapper";
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Role Mapper";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "SAML Attribute to Role";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
+        if (isAttributePresent(mapperModel, context)) {
+            RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
+            if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+            user.grantRole(role);
+        }
+    }
+
+    protected boolean isAttributePresent(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String name = mapperModel.getConfig().get(ATTRIBUTE_NAME);
+        if (name != null && name.trim().equals("")) name = null;
+        String friendly = mapperModel.getConfig().get(ATTRIBUTE_FRIENDLY_NAME);
+        if (friendly != null && friendly.trim().equals("")) friendly = null;
+        String desiredValue = mapperModel.getConfig().get(ATTRIBUTE_VALUE);
+        AssertionType assertion = (AssertionType)context.getContextData().get(SAMLEndpoint.SAML_ASSERTION);
+        for (AttributeStatementType statement : assertion.getAttributeStatements()) {
+            for (AttributeStatementType.ASTChoiceType choice : statement.getAttributes()) {
+                AttributeType attr = choice.getAttribute();
+                if (name != null && !name.equals(attr.getName())) continue;
+                if (friendly != null && !name.equals(attr.getFriendlyName())) continue;
+                for (Object val : attr.getAttributeValue()) {
+                    if (val.equals(desiredValue)) return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
+        if (!isAttributePresent(mapperModel, context)) {
+            RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
+            if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
+            user.deleteRoleMapping(role);
+        }
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "If a claim exists, grant the user the specified realm or application role.";
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/mappers/UserAttributeMapper.java

@@ -0,0 +1,129 @@
+package org.keycloak.broker.saml.mappers;
+
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.saml.SAMLEndpoint;
+import org.keycloak.broker.saml.SAMLIdentityProviderFactory;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.AttributeStatementType;
+import org.keycloak.dom.saml.v2.assertion.AttributeType;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class UserAttributeMapper extends AbstractIdentityProviderMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {SAMLIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    public static final String ATTRIBUTE_NAME = "attribute.name";
+    public static final String ATTRIBUTE_FRIENDLY_NAME = "attribute.friendly.name";
+    public static final String USER_ATTRIBUTE = "user.attribute";
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_NAME);
+        property.setLabel("Attribute Name");
+        property.setHelpText("Name of attribute to search for in assertion.  You can leave this blank and specify a friendly name instead.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(ATTRIBUTE_FRIENDLY_NAME);
+        property.setLabel("Friendly Name");
+        property.setHelpText("Friendly name of attribute to search for in assertion.  You can leave this blank and specify a name instead.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+        property = new ProviderConfigProperty();
+        property.setName(USER_ATTRIBUTE);
+        property.setLabel("User Attribute Name");
+        property.setHelpText("User attribute name to store saml attribute.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "saml-user-attribute-idp-mapper";
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Attribute Importer";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(USER_ATTRIBUTE);
+        Object value = getAttribute(mapperModel, context);
+        if (value != null) {
+            user.setSingleAttribute(attribute, value.toString());
+        }
+    }
+
+    protected String getAttribute(IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String name = mapperModel.getConfig().get(ATTRIBUTE_NAME);
+        if (name != null && name.trim().equals("")) name = null;
+        String friendly = mapperModel.getConfig().get(ATTRIBUTE_FRIENDLY_NAME);
+        if (friendly != null && friendly.trim().equals("")) friendly = null;
+        AssertionType assertion = (AssertionType)context.getContextData().get(SAMLEndpoint.SAML_ASSERTION);
+        for (AttributeStatementType statement : assertion.getAttributeStatements()) {
+            for (AttributeStatementType.ASTChoiceType choice : statement.getAttributes()) {
+                AttributeType attr = choice.getAttribute();
+                if (name != null && !name.equals(attr.getName())) continue;
+                if (friendly != null && !friendly.equals(attr.getFriendlyName())) continue;
+
+                List<Object> attributeValue = attr.getAttributeValue();
+                if (attributeValue == null || attributeValue.isEmpty()) return null;
+                return attributeValue.get(0).toString();
+            }
+        }
+        return null;
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        String attribute = mapperModel.getConfig().get(USER_ATTRIBUTE);
+        Object value = getAttribute(mapperModel, context);
+        String current = user.getFirstAttribute(attribute);
+        if (value != null && !value.equals(current)) {
+            user.setSingleAttribute(attribute, value.toString());
+        } else if (value == null) {
+            user.removeAttribute(attribute);
+        }
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Import declared saml attribute if it exists in assertion into the specified user attribute.";
+    }
+
+}

broker/saml/src/main/java/org/keycloak/broker/saml/mappers/UsernameTemplateMapper.java

@@ -0,0 +1,133 @@
+package org.keycloak.broker.saml.mappers;
+
+import org.keycloak.broker.provider.AbstractIdentityProviderMapper;
+import org.keycloak.broker.provider.BrokeredIdentityContext;
+import org.keycloak.broker.saml.SAMLEndpoint;
+import org.keycloak.broker.saml.SAMLIdentityProviderFactory;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.AttributeStatementType;
+import org.keycloak.dom.saml.v2.assertion.AttributeType;
+import org.keycloak.dom.saml.v2.assertion.NameIDType;
+import org.keycloak.dom.saml.v2.assertion.SubjectType;
+import org.keycloak.models.IdentityProviderMapperModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.provider.ProviderConfigProperty;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class UsernameTemplateMapper extends AbstractIdentityProviderMapper {
+
+    public static final String[] COMPATIBLE_PROVIDERS = {SAMLIdentityProviderFactory.PROVIDER_ID};
+
+    private static final List<ProviderConfigProperty> configProperties = new ArrayList<ProviderConfigProperty>();
+
+    public static final String TEMPLATE = "template";
+
+    static {
+        ProviderConfigProperty property;
+        property = new ProviderConfigProperty();
+        property.setName(TEMPLATE);
+        property.setLabel("Template");
+        property.setHelpText("Template to use to format the username to import.  Substitutions are enclosed in ${}.  For example: '${ALIAS}.${NAMEID}'.  ALIAS is the provider alias.  NAMEID is that SAML name id assertion.  ATTRIBUTE.<NAME> references a SAML attribute where name is the attribute name or friendly name.");
+        property.setType(ProviderConfigProperty.STRING_TYPE);
+        property.setDefaultValue("${ALIAS}.${NAMEID}");
+        configProperties.add(property);
+    }
+
+    public static final String PROVIDER_ID = "saml-username-idp-mapper";
+
+    @Override
+    public List<ProviderConfigProperty> getConfigProperties() {
+        return configProperties;
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public String[] getCompatibleProviders() {
+        return COMPATIBLE_PROVIDERS;
+    }
+
+    @Override
+    public String getDisplayCategory() {
+        return "Preprocessor";
+    }
+
+    @Override
+    public String getDisplayType() {
+        return "Username Template Importer";
+    }
+
+    @Override
+    public void importNewUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+
+    }
+
+    @Override
+    public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+
+    }
+    static Pattern substitution = Pattern.compile("\\$\\{([^}]+)\\}");
+
+    @Override
+    public void preprocessFederatedIdentity(KeycloakSession session, RealmModel realm, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
+        AssertionType assertion = (AssertionType)context.getContextData().get(SAMLEndpoint.SAML_ASSERTION);
+        String template = mapperModel.getConfig().get(TEMPLATE);
+        Matcher m = substitution.matcher(template);
+        StringBuffer sb = new StringBuffer();
+        while (m.find()) {
+            String variable = m.group(1);
+            if (variable.equals("ALIAS")) {
+                m.appendReplacement(sb, context.getIdpConfig().getAlias());
+            } else if (variable.equals("UUID")) {
+                m.appendReplacement(sb, KeycloakModelUtils.generateId());
+            } else if (variable.equals("NAMEID")) {
+                SubjectType subject = assertion.getSubject();
+                SubjectType.STSubType subType = subject.getSubType();
+                NameIDType subjectNameID = (NameIDType) subType.getBaseID();
+                m.appendReplacement(sb, subjectNameID.getValue());
+            } else if (variable.startsWith("ATTRIBUTE.")) {
+                String name = variable.substring("ATTRIBUTE.".length());
+                String value = "";
+                for (AttributeStatementType statement : assertion.getAttributeStatements()) {
+                    for (AttributeStatementType.ASTChoiceType choice : statement.getAttributes()) {
+                        AttributeType attr = choice.getAttribute();
+                        if (name.equals(attr.getName()) || name.equals(attr.getFriendlyName())) {
+                            List<Object> attributeValue = attr.getAttributeValue();
+                            if (attributeValue != null && !attributeValue.isEmpty()) {
+                                value = attributeValue.get(0).toString();
+                            }
+                            break;
+                        }
+                    }
+                }
+                m.appendReplacement(sb, value);
+            } else {
+                m.appendReplacement(sb, m.group(1));
+            }
+
+        }
+        m.appendTail(sb);
+        context.setModelUsername(sb.toString());
+
+    }
+
+    @Override
+    public String getHelpText() {
+        return "Format the username to import.";
+    }
+
+}

broker/saml/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderFactory

@@ -0,0 +1 @@
+org.keycloak.broker.saml.SAMLIdentityProviderFactory

broker/saml/src/main/resources/META-INF/services/org.keycloak.broker.provider.IdentityProviderMapper

@@ -0,0 +1,3 @@
+org.keycloak.broker.saml.mappers.AttributeToRoleMapper
+org.keycloak.broker.saml.mappers.UserAttributeMapper
+org.keycloak.broker.saml.mappers.UsernameTemplateMapper

client-api/pom.xml

@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-client-api</artifactId>
+    <name>Keycloak Client API</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+</project>

client-api/src/main/java/org/keycloak/client/registration/ClientRegistration.java

@@ -0,0 +1,275 @@
+package org.keycloak.client.registration;
+
+import org.apache.http.HttpHeaders;
+import org.apache.http.HttpRequest;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.HttpDelete;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpPut;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.common.util.Base64;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.IOException;
+import java.io.InputStream;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class ClientRegistration {
+
+    private String clientRegistrationUrl;
+    private HttpClient httpClient;
+    private Auth auth;
+
+    public static ClientRegistrationBuilder create() {
+        return new ClientRegistrationBuilder();
+    }
+
+    private ClientRegistration() {
+    }
+
+    public ClientRepresentation create(ClientRepresentation client) throws ClientRegistrationException {
+        String content = serialize(client);
+        InputStream resultStream = doPost(content);
+        return deserialize(resultStream, ClientRepresentation.class);
+    }
+
+    public ClientRepresentation get() throws ClientRegistrationException {
+        if (auth instanceof ClientIdSecretAuth) {
+            String clientId = ((ClientIdSecretAuth) auth).clientId;
+            return get(clientId);
+        } else {
+            throw new ClientRegistrationException("Requires client authentication");
+        }
+    }
+
+    public ClientRepresentation get(String clientId) throws ClientRegistrationException {
+        InputStream resultStream = doGet(clientId);
+        return resultStream != null ? deserialize(resultStream, ClientRepresentation.class) : null;
+    }
+
+    public void update(ClientRepresentation client) throws ClientRegistrationException {
+        String content = serialize(client);
+        doPut(content, client.getClientId());
+    }
+
+    public void delete() throws ClientRegistrationException {
+        if (auth instanceof ClientIdSecretAuth) {
+            String clientId = ((ClientIdSecretAuth) auth).clientId;
+            delete(clientId);
+        } else {
+            throw new ClientRegistrationException("Requires client authentication");
+        }
+    }
+
+    public void delete(String clientId) throws ClientRegistrationException {
+        doDelete(clientId);
+    }
+
+    public void close() throws ClientRegistrationException {
+        if (httpClient instanceof CloseableHttpClient) {
+            try {
+                ((CloseableHttpClient) httpClient).close();
+            } catch (IOException e) {
+                throw new ClientRegistrationException("Failed to close http client", e);
+            }
+        }
+    }
+
+    private InputStream doPost(String content) throws ClientRegistrationException {
+        try {
+            HttpPost request = new HttpPost(clientRegistrationUrl);
+
+            request.setHeader(HttpHeaders.CONTENT_TYPE, "application/json");
+            request.setHeader(HttpHeaders.ACCEPT, "application/json");
+            request.setEntity(new StringEntity(content));
+
+            auth.addAuth(request);
+
+            HttpResponse response = httpClient.execute(request);
+            InputStream responseStream = null;
+            if (response.getEntity() != null) {
+                responseStream = response.getEntity().getContent();
+            }
+
+            if (response.getStatusLine().getStatusCode() == 201) {
+                return responseStream;
+            } else {
+                responseStream.close();
+                throw new HttpErrorException(response.getStatusLine());
+            }
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to send request", e);
+        }
+    }
+
+    private InputStream doGet(String endpoint) throws ClientRegistrationException {
+        try {
+            HttpGet request = new HttpGet(clientRegistrationUrl + "/" + endpoint);
+
+            request.setHeader(HttpHeaders.ACCEPT, "application/json");
+
+            auth.addAuth(request);
+
+            HttpResponse response = httpClient.execute(request);
+            InputStream responseStream = null;
+            if (response.getEntity() != null) {
+                responseStream = response.getEntity().getContent();
+            }
+
+            if (response.getStatusLine().getStatusCode() == 200) {
+                return responseStream;
+            } else if (response.getStatusLine().getStatusCode() == 404) {
+                responseStream.close();
+                return null;
+            } else {
+                responseStream.close();
+                throw new HttpErrorException(response.getStatusLine());
+            }
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to send request", e);
+        }
+    }
+
+    private void doPut(String content, String endpoint) throws ClientRegistrationException {
+        try {
+            HttpPut request = new HttpPut(clientRegistrationUrl + "/" + endpoint);
+
+            request.setHeader(HttpHeaders.CONTENT_TYPE, "application/json");
+            request.setHeader(HttpHeaders.ACCEPT, "application/json");
+            request.setEntity(new StringEntity(content));
+
+            auth.addAuth(request);
+
+            HttpResponse response = httpClient.execute(request);
+            if (response.getEntity() != null) {
+                response.getEntity().getContent().close();
+            }
+
+            if (response.getStatusLine().getStatusCode() != 200) {
+                throw new HttpErrorException(response.getStatusLine());
+            }
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to send request", e);
+        }
+    }
+
+    private void doDelete(String endpoint) throws ClientRegistrationException {
+        try {
+            HttpDelete request = new HttpDelete(clientRegistrationUrl + "/" + endpoint);
+
+            auth.addAuth(request);
+
+            HttpResponse response = httpClient.execute(request);
+            if (response.getEntity() != null) {
+                response.getEntity().getContent().close();
+            }
+
+            if (response.getStatusLine().getStatusCode() != 200) {
+                throw new HttpErrorException(response.getStatusLine());
+            }
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to send request", e);
+        }
+    }
+
+    private String serialize(ClientRepresentation client) throws ClientRegistrationException {
+        try {
+            return JsonSerialization.writeValueAsString(client);
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to write json object", e);
+        }
+    }
+
+    private <T> T deserialize(InputStream inputStream, Class<T> clazz) throws ClientRegistrationException {
+        try {
+            return JsonSerialization.readValue(inputStream, clazz);
+        } catch (IOException e) {
+            throw new ClientRegistrationException("Failed to read json object", e);
+        }
+    }
+
+    public static class ClientRegistrationBuilder {
+
+        private String realm;
+
+        private String authServerUrl;
+
+        private Auth auth;
+
+        private HttpClient httpClient;
+
+        public ClientRegistrationBuilder realm(String realm) {
+            this.realm = realm;
+            return this;
+        }
+        public ClientRegistrationBuilder authServerUrl(String authServerUrl) {
+            this.authServerUrl = authServerUrl;
+            return this;
+        }
+
+        public ClientRegistrationBuilder auth(String token) {
+            this.auth = new TokenAuth(token);
+            return this;
+        }
+
+        public ClientRegistrationBuilder auth(String clientId, String clientSecret) {
+            this.auth = new ClientIdSecretAuth(clientId, clientSecret);
+            return this;
+        }
+
+        public ClientRegistrationBuilder httpClient(HttpClient httpClient) {
+            this.httpClient = httpClient;
+            return this;
+        }
+
+        public ClientRegistration build() {
+            ClientRegistration clientRegistration = new ClientRegistration();
+            clientRegistration.clientRegistrationUrl = authServerUrl + "/realms/" + realm + "/client-registration/default";
+
+            clientRegistration.httpClient = httpClient != null ? httpClient : HttpClients.createDefault();
+            clientRegistration.auth = auth;
+
+            return clientRegistration;
+        }
+
+    }
+
+    public interface Auth {
+        void addAuth(HttpRequest httpRequest);
+    }
+
+    public static class AuthorizationHeaderAuth implements Auth {
+        private String credentials;
+
+        public AuthorizationHeaderAuth(String credentials) {
+            this.credentials = credentials;
+        }
+
+        public void addAuth(HttpRequest httpRequest) {
+            httpRequest.setHeader(HttpHeaders.AUTHORIZATION, credentials);
+        }
+    }
+
+    public static class TokenAuth extends AuthorizationHeaderAuth {
+        public TokenAuth(String token) {
+            super("Bearer " + token);
+        }
+    }
+
+    public static class ClientIdSecretAuth extends AuthorizationHeaderAuth {
+        private String clientId;
+
+        public ClientIdSecretAuth(String clientId, String clientSecret) {
+            super("Basic " + Base64.encodeBytes((clientId + ":" + clientSecret).getBytes()));
+            this.clientId = clientId;
+        }
+    }
+
+}

client-api/src/main/java/org/keycloak/client/registration/ClientRegistrationException.java

@@ -0,0 +1,16 @@
+package org.keycloak.client.registration;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class ClientRegistrationException extends Exception {
+
+    public ClientRegistrationException(String s, Throwable throwable) {
+        super(s, throwable);
+    }
+
+    public ClientRegistrationException(String s) {
+        super(s);
+    }
+
+}

client-api/src/main/java/org/keycloak/client/registration/HttpErrorException.java

@@ -0,0 +1,22 @@
+package org.keycloak.client.registration;
+
+import org.apache.http.StatusLine;
+
+import java.io.IOException;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class HttpErrorException extends IOException {
+
+    private StatusLine statusLine;
+
+    public HttpErrorException(StatusLine statusLine) {
+        this.statusLine = statusLine;
+    }
+
+    public StatusLine getStatusLine() {
+        return statusLine;
+    }
+
+}

common/pom.xml

@@ -0,0 +1,94 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-common</artifactId>
+    <name>Keycloak Common</name>
+    <packaging>jar</packaging>
+    <description>Common library and dependencies shared with server and all adapters</description>
+
+    <properties>
+        <timestamp>${maven.build.timestamp}</timestamp>
+        <maven.build.timestamp.format>yyyy-MM-dd HH:mm</maven.build.timestamp.format>
+        <keycloak.osgi.export>
+            org.keycloak.common.*
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            *;resolution:=optional
+        </keycloak.osgi.import>
+    </properties>
+    <dependencies>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk15on</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+                <filtering>true</filtering>
+            </resource>
+        </resources>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-ClassPath>.</Bundle-ClassPath>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

common/src/main/java/org/keycloak/common/ClientConnection.java

@@ -1,13 +1,13 @@
-package org.keycloak;
-
-/**
- * Information about the client connection
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public interface ClientConnection {
-    String getRemoteAddr();
-    String getRemoteHost();
-    int getReportPort();
-}
+package org.keycloak.common;
+
+/**
+ * Information about the client connection
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface ClientConnection {
+    String getRemoteAddr();
+    String getRemoteHost();
+    int getReportPort();
+}

common/src/main/java/org/keycloak/common/VerificationException.java

@@ -1,4 +1,4 @@
-package org.keycloak;
+package org.keycloak.common;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

common/src/main/java/org/keycloak/common/Version.java

@@ -0,0 +1,37 @@
+package org.keycloak.common;
+
+import org.keycloak.common.util.Time;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Version {
+    public static final String UNKNOWN = "UNKNOWN";
+    public static String VERSION;
+    public static String RESOURCES_VERSION;
+    public static String BUILD_TIME;
+
+    static {
+        Properties props = new Properties();
+        InputStream is = Version.class.getResourceAsStream("/keycloak-version.properties");
+        try {
+            props.load(is);
+            Version.VERSION = props.getProperty("version");
+            Version.BUILD_TIME = props.getProperty("build-time");
+            Version.RESOURCES_VERSION = Version.VERSION.toLowerCase();
+            if (Version.RESOURCES_VERSION.endsWith("-snapshot")) {
+                Version.RESOURCES_VERSION = Version.RESOURCES_VERSION.replace("-snapshot", "-" + Time.currentTime());
+            }
+        } catch (IOException e) {
+            Version.VERSION= Version.UNKNOWN;
+            Version.BUILD_TIME= Version.UNKNOWN;
+        }
+
+    }
+
+}

common/src/main/java/org/keycloak/common/constants/GenericConstants.java

@@ -0,0 +1,10 @@
+package org.keycloak.common.constants;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class GenericConstants {
+
+    public static final String PROTOCOL_CLASSPATH = "classpath:";
+
+}

common/src/main/java/org/keycloak/common/constants/KerberosConstants.java

@@ -0,0 +1,61 @@
+package org.keycloak.common.constants;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosConstants {
+
+    /**
+     *  Value of HTTP Headers "WWW-Authenticate" or "Authorization" used for SPNEGO/Kerberos
+     **/
+    public static final String NEGOTIATE = "Negotiate";
+
+
+    /**
+     * OID of SPNEGO mechanism. See http://www.oid-info.com/get/1.3.6.1.5.5.2
+     */
+    public static final String SPNEGO_OID = "1.3.6.1.5.5.2";
+
+
+    /**
+     * OID of Kerberos v5 mechanism. See http://www.oid-info.com/get/1.2.840.113554.1.2.2
+     */
+    public static final String KRB5_OID = "1.2.840.113554.1.2.2";
+
+
+    /**
+     * OID of Kerberos v5 name. See http://www.oid-info.com/get/1.2.840.113554.1.2.2.1
+     */
+    public static final String KRB5_NAME_OID = "1.2.840.113554.1.2.2.1";
+
+
+    /**
+     * Configuration federation provider model attributes.
+     */
+    public static final String ALLOW_KERBEROS_AUTHENTICATION = "allowKerberosAuthentication";
+    public static final String KERBEROS_REALM = "kerberosRealm";
+    public static final String SERVER_PRINCIPAL = "serverPrincipal";
+    public static final String KEYTAB = "keyTab";
+    public static final String DEBUG = "debug";
+    public static final String ALLOW_PASSWORD_AUTHENTICATION = "allowPasswordAuthentication";
+    public static final String UPDATE_PROFILE_FIRST_LOGIN = "updateProfileFirstLogin";
+    public static final String USE_KERBEROS_FOR_PASSWORD_AUTHENTICATION = "useKerberosForPasswordAuthentication";
+
+
+    /**
+     * Internal attribute used in "state" map . Contains token to be passed in HTTP Response back to browser to continue handshake
+     */
+    public static final String RESPONSE_TOKEN = "SpnegoResponseToken";
+
+
+    /**
+     * Internal attribute used in "userSession.note" map and in accessToken claims . Contains credential from SPNEGO/Kerberos successful authentication
+     */
+    public static final String GSS_DELEGATION_CREDENTIAL = "gss_delegation_credential";
+
+    /**
+     * Display name for the above in admin console and consent screens
+     */
+    public static final String GSS_DELEGATION_CREDENTIAL_DISPLAY_NAME = "gss delegation credential";
+
+}

common/src/main/java/org/keycloak/common/constants/ServiceAccountConstants.java

@@ -0,0 +1,19 @@
+package org.keycloak.common.constants;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface ServiceAccountConstants {
+
+    String CLIENT_AUTH = "client_auth";
+
+    String SERVICE_ACCOUNT_USER_PREFIX = "service-account-";
+
+    String CLIENT_ID_PROTOCOL_MAPPER = "Client ID";
+    String CLIENT_HOST_PROTOCOL_MAPPER = "Client Host";
+    String CLIENT_ADDRESS_PROTOCOL_MAPPER = "Client IP Address";
+    String CLIENT_ID = "clientId";
+    String CLIENT_HOST = "clientHost";
+    String CLIENT_ADDRESS = "clientAddress";
+
+}

common/src/main/java/org/keycloak/common/enums/RelativeUrlsUsed.java

@@ -0,0 +1,36 @@
+package org.keycloak.common.enums;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public enum RelativeUrlsUsed {
+
+    /**
+     * Always use relative URI and resolve them later based on browser HTTP request
+     */
+    ALL_REQUESTS,
+
+    /**
+     * Use relative Uris just for browser requests and resolve those based on browser HTTP requests.
+     * Backend request (like refresh token request, codeToToken request etc) will use the URI based on current hostname
+     */
+    BROWSER_ONLY,
+
+    /**
+     * Relative Uri not used. Configuration contains absolute URI
+     */
+    NEVER;
+
+    public boolean useRelative(boolean isBrowserReq) {
+        switch (this) {
+            case ALL_REQUESTS:
+                return true;
+            case NEVER:
+                return false;
+            case BROWSER_ONLY:
+                return isBrowserReq;
+            default:
+                return true;
+        }
+    }
+}

common/src/main/java/org/keycloak/common/enums/SslRequired.java

@@ -1,6 +1,6 @@
-package org.keycloak.enums;
+package org.keycloak.common.enums;
 
-import org.keycloak.ClientConnection;
+import org.keycloak.common.ClientConnection;
 
 import java.net.InetAddress;
 import java.net.UnknownHostException;

common/src/main/java/org/keycloak/common/util/Base64Url.java

@@ -1,44 +1,42 @@
-package org.keycloak.util;
-
-
-import net.iharder.Base64;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Base64Url {
-    public static String encode(byte[] bytes) {
-        String s = Base64.encodeBytes(bytes);
-        s = s.split("=")[0]; // Remove any trailing '='s
-        s = s.replace('+', '-'); // 62nd char of encoding
-        s = s.replace('/', '_'); // 63rd char of encoding
-        return s;
-    }
-
-    public static byte[] decode(String s) {
-        s = s.replace('-', '+'); // 62nd char of encoding
-        s = s.replace('_', '/'); // 63rd char of encoding
-        switch (s.length() % 4) // Pad with trailing '='s
-        {
-            case 0:
-                break; // No pad chars in this case
-            case 2:
-                s += "==";
-                break; // Two pad chars
-            case 3:
-                s += "=";
-                break; // One pad char
-            default:
-                throw new RuntimeException(
-                        "Illegal base64url string!");
-        }
-        try {
-            return Base64.decode(s);
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-
-}
+package org.keycloak.common.util;
+
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Base64Url {
+    public static String encode(byte[] bytes) {
+        String s = Base64.encodeBytes(bytes);
+        s = s.split("=")[0]; // Remove any trailing '='s
+        s = s.replace('+', '-'); // 62nd char of encoding
+        s = s.replace('/', '_'); // 63rd char of encoding
+        return s;
+    }
+
+    public static byte[] decode(String s) {
+        s = s.replace('-', '+'); // 62nd char of encoding
+        s = s.replace('_', '/'); // 63rd char of encoding
+        switch (s.length() % 4) // Pad with trailing '='s
+        {
+            case 0:
+                break; // No pad chars in this case
+            case 2:
+                s += "==";
+                break; // Two pad chars
+            case 3:
+                s += "=";
+                break; // One pad char
+            default:
+                throw new RuntimeException(
+                        "Illegal base64url string!");
+        }
+        try {
+            return Base64.decode(s);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+
+}

common/src/main/java/org/keycloak/common/util/BouncyIntegration.java

@@ -1,4 +1,4 @@
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 

common/src/main/java/org/keycloak/common/util/CertificateUtils.java

@@ -0,0 +1,165 @@
+package org.keycloak.common.util;
+
+import java.math.BigInteger;
+import java.security.KeyPair;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
+import java.security.cert.X509Certificate;
+import java.util.Calendar;
+import java.util.Date;
+
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.BasicConstraints;
+import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.KeyPurposeId;
+import org.bouncycastle.asn1.x509.KeyUsage;
+import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cert.X509ExtensionUtils;
+import org.bouncycastle.cert.X509v1CertificateBuilder;
+import org.bouncycastle.cert.X509v3CertificateBuilder;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
+import org.bouncycastle.crypto.util.PrivateKeyFactory;
+import org.bouncycastle.operator.ContentSigner;
+import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
+import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.bc.BcDigestCalculatorProvider;
+import org.bouncycastle.operator.bc.BcRSAContentSignerBuilder;
+import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
+
+/**
+ * The Class CertificateUtils provides utility functions for generation of V1 and V3 {@link java.security.cert.X509Certificate}
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author <a href="mailto:giriraj.sharma27@gmail.com">Giriraj Sharma</a>
+ * @version $Revision: 2 $
+ */
+public class CertificateUtils {
+    static {
+        BouncyIntegration.init();
+    }
+
+    /**
+     * Generates version 3 {@link java.security.cert.X509Certificate}.
+     *
+     * @param keyPair the key pair
+     * @param caPrivateKey the CA private key
+     * @param caCert the CA certificate
+     * @param subject the subject name
+     * 
+     * @return the x509 certificate
+     * 
+     * @throws Exception the exception
+     */
+    public static X509Certificate generateV3Certificate(KeyPair keyPair, PrivateKey caPrivateKey, X509Certificate caCert,
+            String subject) throws Exception {
+
+        try {
+            X500Name subjectDN = new X500Name("CN=" + subject);
+
+            // Serial Number
+            SecureRandom random = SecureRandom.getInstance("SHA1PRNG");
+            BigInteger serialNumber = BigInteger.valueOf(Math.abs(random.nextInt()));
+
+            // Validity
+            Date notBefore = new Date(System.currentTimeMillis());
+            Date notAfter = new Date(System.currentTimeMillis() + (((1000L * 60 * 60 * 24 * 30)) * 12) * 3);
+
+            // SubjectPublicKeyInfo
+            SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo(ASN1Sequence.getInstance(keyPair.getPublic()
+                    .getEncoded()));
+
+            X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(new X500Name(caCert.getSubjectDN().getName()),
+                    serialNumber, notBefore, notAfter, subjectDN, subjPubKeyInfo);
+
+            DigestCalculator digCalc = new BcDigestCalculatorProvider()
+                    .get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
+            X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);
+
+            // Subject Key Identifier
+            certGen.addExtension(Extension.subjectKeyIdentifier, false,
+                    x509ExtensionUtils.createSubjectKeyIdentifier(subjPubKeyInfo));
+
+            // Authority Key Identifier
+            certGen.addExtension(Extension.authorityKeyIdentifier, false,
+                    x509ExtensionUtils.createAuthorityKeyIdentifier(subjPubKeyInfo));
+
+            // Key Usage
+            certGen.addExtension(Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign
+                    | KeyUsage.cRLSign));
+
+            // Extended Key Usage
+            KeyPurposeId[] EKU = new KeyPurposeId[2];
+            EKU[0] = KeyPurposeId.id_kp_emailProtection;
+            EKU[1] = KeyPurposeId.id_kp_serverAuth;
+
+            certGen.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(EKU));
+
+            // Basic Constraints
+            certGen.addExtension(Extension.basicConstraints, true, new BasicConstraints(0));
+
+            // Content Signer
+            ContentSigner sigGen = new JcaContentSignerBuilder("SHA1WithRSAEncryption").setProvider("BC").build(caPrivateKey);
+
+            // Certificate
+            return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certGen.build(sigGen));
+        } catch (Exception e) {
+            throw new RuntimeException("Error creating X509v3Certificate.", e);
+        }
+    }
+
+    /**
+     * Generate version 1 self signed {@link java.security.cert.X509Certificate}..
+     *
+     * @param caKeyPair the CA key pair
+     * @param subject the subject name
+     * 
+     * @return the x509 certificate
+     * 
+     * @throws Exception the exception
+     */
+    public static X509Certificate generateV1SelfSignedCertificate(KeyPair caKeyPair, String subject) throws Exception {
+
+        try {
+            X500Name subjectDN = new X500Name("CN=" + subject);
+            BigInteger serialNumber = BigInteger.valueOf(System.currentTimeMillis());
+            Date validityStartDate = new Date(System.currentTimeMillis() - 100000);
+            Calendar calendar = Calendar.getInstance();
+            calendar.add(Calendar.YEAR, 10);
+            Date validityEndDate = new Date(calendar.getTime().getTime());
+            SubjectPublicKeyInfo subPubKeyInfo = SubjectPublicKeyInfo.getInstance(caKeyPair.getPublic().getEncoded());
+
+            X509v1CertificateBuilder builder = new X509v1CertificateBuilder(subjectDN, serialNumber, validityStartDate,
+                    validityEndDate, subjectDN, subPubKeyInfo);
+            X509CertificateHolder holder = builder.build(createSigner(caKeyPair.getPrivate()));
+
+            return new JcaX509CertificateConverter().getCertificate(holder);
+        } catch (Exception e) {
+            throw new RuntimeException("Error creating X509v1Certificate.", e);
+        }
+    }
+
+    /**
+     * Creates the content signer for generation of Version 1 {@link java.security.cert.X509Certificate}.
+     *
+     * @param privateKey the private key
+     *
+     * @return the content signer
+     */
+    public static ContentSigner createSigner(PrivateKey privateKey) {
+        try {
+            AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256WithRSAEncryption");
+            AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
+
+            return new BcRSAContentSignerBuilder(sigAlgId, digAlgId)
+                    .build(PrivateKeyFactory.createKey(privateKey.getEncoded()));
+        } catch (Exception e) {
+            throw new RuntimeException("Could not create content signer.", e);
+        }
+    }
+}

common/src/main/java/org/keycloak/common/util/CollectionUtil.java

@@ -1,4 +1,4 @@
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.util.Collection;
 import java.util.Iterator;

common/src/main/java/org/keycloak/common/util/DerUtils.java

@@ -1,4 +1,4 @@
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.io.DataInputStream;
 import java.io.InputStream;

common/src/main/java/org/keycloak/common/util/Encode.java

@@ -1,4 +1,4 @@
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;

common/src/main/java/org/keycloak/common/util/EnvUtil.java

@@ -1,37 +1,37 @@
-package org.keycloak.util;
-
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public final class EnvUtil {
-    private static final Pattern p = Pattern.compile("[$][{]([^}]+)[}]");
-
-    private EnvUtil() {
-
-    }
-
-    /**
-     * Replaces any ${} strings with their corresponding environent variable.
-     *
-     * @param val
-     * @return
-     */
-    public static String replace(String val) {
-        Matcher matcher = p.matcher(val);
-        StringBuffer buf = new StringBuffer();
-        while (matcher.find()) {
-            String envVar = matcher.group(1);
-            String envVal = System.getProperty(envVar);
-            if (envVal == null) envVal = "NOT-SPECIFIED";
-            matcher.appendReplacement(buf, envVal.replace("\\", "\\\\"));
-        }
-        matcher.appendTail(buf);
-        return buf.toString();
-    }
-}
-
-
+package org.keycloak.common.util;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public final class EnvUtil {
+    private static final Pattern p = Pattern.compile("[$][{]([^}]+)[}]");
+
+    private EnvUtil() {
+
+    }
+
+    /**
+     * Replaces any ${} strings with their corresponding environent variable.
+     *
+     * @param val
+     * @return
+     */
+    public static String replace(String val) {
+        Matcher matcher = p.matcher(val);
+        StringBuffer buf = new StringBuffer();
+        while (matcher.find()) {
+            String envVar = matcher.group(1);
+            String envVal = System.getProperty(envVar);
+            if (envVal == null) envVal = "NOT-SPECIFIED";
+            matcher.appendReplacement(buf, envVal.replace("\\", "\\\\"));
+        }
+        matcher.appendTail(buf);
+        return buf.toString();
+    }
+}
+
+

common/src/main/java/org/keycloak/common/util/FindFile.java

@@ -0,0 +1,37 @@
+package org.keycloak.common.util;
+
+import org.keycloak.common.constants.GenericConstants;
+
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class FindFile {
+    public static InputStream findFile(String keycloakConfigFile) {
+        if (keycloakConfigFile.startsWith(GenericConstants.PROTOCOL_CLASSPATH)) {
+            String classPathLocation = keycloakConfigFile.replace(GenericConstants.PROTOCOL_CLASSPATH, "");
+            // Try current class classloader first
+            InputStream is = FindFile.class.getClassLoader().getResourceAsStream(classPathLocation);
+            if (is == null) {
+                is = Thread.currentThread().getContextClassLoader().getResourceAsStream(classPathLocation);
+            }
+
+            if (is != null) {
+                return is;
+            } else {
+                throw new RuntimeException("Unable to find config from classpath: " + keycloakConfigFile);
+            }
+        } else {
+            // Fallback to file
+            try {
+                return new FileInputStream(keycloakConfigFile);
+            } catch (FileNotFoundException fnfe) {
+                throw new RuntimeException(fnfe);
+            }
+        }
+    }
+}

common/src/main/java/org/keycloak/common/util/HostUtils.java

@@ -0,0 +1,74 @@
+package org.keycloak.common.util;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class HostUtils {
+
+    // Best effort to find the most proper hostname of this server.
+    public static String getHostName() {
+        return getHostNameImpl().trim().toLowerCase();
+    }
+
+    public static String getIpAddress() {
+        try {
+            String hostname = getHostName();
+            return InetAddress.getByName(hostname).getHostAddress();
+        } catch (UnknownHostException uhe) {
+            throw new IllegalStateException(uhe);
+        }
+    }
+
+    private static String getHostNameImpl() {
+        // Return bind address if available
+        String bindAddr = System.getProperty("jboss.bind.address");
+        if (bindAddr != null && !bindAddr.trim().equals("0.0.0.0")) {
+            return bindAddr;
+        }
+
+        // Fallback to qualified name
+        String qualifiedHostName = System.getProperty("jboss.qualified.host.name");
+        if (qualifiedHostName != null) {
+            return qualifiedHostName;
+        }
+
+        // If not on jboss env, let's try other possible fallbacks
+        // POSIX-like OSes including Mac should have this set
+        qualifiedHostName = System.getenv("HOSTNAME");
+        if (qualifiedHostName != null) {
+            return qualifiedHostName;
+        }
+
+        // Certain versions of Windows
+        qualifiedHostName = System.getenv("COMPUTERNAME");
+        if (qualifiedHostName != null) {
+            return qualifiedHostName;
+        }
+
+        try {
+            return NetworkUtils.canonize(getLocalHost().getHostName());
+        } catch (UnknownHostException uhe) {
+            uhe.printStackTrace();
+            return "unknown-host.unknown-domain";
+        }
+    }
+
+    /**
+     * Methods returns InetAddress for localhost
+     *
+     * @return InetAddress of the localhost
+     * @throws UnknownHostException if localhost could not be resolved
+     */
+    private static InetAddress getLocalHost() throws UnknownHostException {
+        InetAddress addr;
+        try {
+            addr = InetAddress.getLocalHost();
+        } catch (ArrayIndexOutOfBoundsException e) {  //this is workaround for mac osx bug see AS7-3223 and JGRP-1404
+            addr = InetAddress.getByName(null);
+        }
+        return addr;
+    }
+}

common/src/main/java/org/keycloak/common/util/HtmlUtils.java

@@ -0,0 +1,55 @@
+/*
+ * JBoss, Home of Professional Open Source
+ *
+ * Copyright 2013 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.common.util;
+
+/**
+ * @author pedroigor
+ */
+public class HtmlUtils {
+
+    /**
+     * <p>Escapes the value for a HTML element attribute.</p>
+     *
+     * @param value
+     * @return
+     */
+    public static String escapeAttribute(String value) {
+        StringBuilder escaped = new StringBuilder();
+
+        for (int i = 0; i < value.length(); i++) {
+            char chr = value.charAt(i);
+
+            if (chr == '<') {
+                escaped.append("&lt;");
+            } else if (chr == '>') {
+                escaped.append("&gt;");
+            } else if (chr == '"') {
+                escaped.append("&quot;");
+            } else if (chr == '\'') {
+                escaped.append("&apos;");
+            } else if (chr == '&') {
+                escaped.append("&amp;");
+            } else {
+                escaped.append(chr);
+            }
+        }
+
+        return escaped.toString();
+    }
+
+}

common/src/main/java/org/keycloak/common/util/KerberosSerializationUtils.java

@@ -0,0 +1,195 @@
+package org.keycloak.common.util;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.ObjectInput;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutput;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.lang.reflect.Method;
+
+import javax.security.auth.kerberos.KerberosTicket;
+
+import org.ietf.jgss.GSSCredential;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSManager;
+import org.ietf.jgss.Oid;
+import org.keycloak.common.constants.KerberosConstants;
+import org.keycloak.common.util.reflections.Reflections;
+import sun.security.jgss.GSSCredentialImpl;
+import sun.security.jgss.GSSManagerImpl;
+import sun.security.jgss.krb5.Krb5InitCredential;
+import sun.security.jgss.krb5.Krb5NameElement;
+import sun.security.jgss.spi.GSSCredentialSpi;
+import sun.security.krb5.Credentials;
+
+/**
+ * Provides serialization/deserialization of kerberos {@link org.ietf.jgss.GSSCredential}, so it can be transmitted from auth-server to the application
+ * and used for further calls to kerberos-secured services
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosSerializationUtils {
+
+    public static final Oid KRB5_OID;
+    public static final Oid KRB5_NAME_OID;
+    public static final String JAVA_INFO;
+
+    static {
+        try {
+            KRB5_OID = new Oid(KerberosConstants.KRB5_OID);
+            KRB5_NAME_OID = new Oid(KerberosConstants.KRB5_NAME_OID);
+        } catch (GSSException e) {
+            throw new RuntimeException(e);
+        }
+
+        String javaVersion = System.getProperty("java.version");
+        String javaRuntimeVersion = System.getProperty("java.runtime.version");
+        String javaVendor = System.getProperty("java.vendor");
+        String os = System.getProperty("os.version");
+        JAVA_INFO = "Java version: " + javaVersion + ", runtime version: " + javaRuntimeVersion + ", vendor: " + javaVendor + ", os: " + os;
+    }
+
+    private KerberosSerializationUtils() {
+    }
+
+    public static String serializeCredential(GSSCredential gssCredential) throws KerberosSerializationException {
+        try {
+            if (gssCredential == null) {
+                throw new KerberosSerializationException("Null credential given as input");
+            }
+
+            if (!(gssCredential instanceof GSSCredentialImpl)) {
+                throw new KerberosSerializationException("Unknown credential type: " + gssCredential.getClass());
+            }
+
+            GSSCredentialImpl gssCredImpl = (GSSCredentialImpl) gssCredential;
+            Oid[] mechs = gssCredImpl.getMechs();
+
+            for (Oid oid : mechs) {
+                if (oid.equals(KRB5_OID)) {
+                    int usage = gssCredImpl.getUsage(oid);
+                    boolean initiate = (usage == GSSCredential.INITIATE_ONLY || usage == GSSCredential.INITIATE_AND_ACCEPT);
+
+                    GSSCredentialSpi credentialSpi = gssCredImpl.getElement(oid, initiate);
+                    if (credentialSpi instanceof Krb5InitCredential) {
+                        Krb5InitCredential credential = (Krb5InitCredential) credentialSpi;
+                        KerberosTicket kerberosTicket = new KerberosTicket(credential.getEncoded(),
+                                credential.getClient(),
+                                credential.getServer(),
+                                credential.getSessionKey().getEncoded(),
+                                credential.getSessionKeyType(),
+                                credential.getFlags(),
+                                credential.getAuthTime(),
+                                credential.getStartTime(),
+                                credential.getEndTime(),
+                                credential.getRenewTill(),
+                                credential.getClientAddresses());
+                        return serialize(kerberosTicket);
+                    } else {
+                        throw new KerberosSerializationException("Unsupported type of credentialSpi: " + credentialSpi.getClass());
+                    }
+                }
+            }
+
+            throw new KerberosSerializationException("Kerberos credential not found. Available mechanisms: " + mechs);
+        } catch (IOException e) {
+            throw new KerberosSerializationException("Exception occured", e);
+        } catch (GSSException e) {
+            throw new KerberosSerializationException("Exception occured", e);
+        }
+    }
+
+
+    public static GSSCredential deserializeCredential(String serializedCred) throws KerberosSerializationException {
+        if (serializedCred == null) {
+            throw new KerberosSerializationException("Null credential given as input. Did you enable kerberos credential delegation for your web browser and mapping of gss credential to access token?");
+        }
+
+        try {
+            Object deserializedCred = deserialize(serializedCred);
+            if (!(deserializedCred instanceof KerberosTicket)) {
+                throw new KerberosSerializationException("Deserialized object is not KerberosTicket! Type is: " + deserializedCred);
+            }
+
+            KerberosTicket ticket = (KerberosTicket) deserializedCred;
+            String fullName = ticket.getClient().getName();
+
+            Method getInstance = Reflections.findDeclaredMethod(Krb5NameElement.class, "getInstance", String.class, Oid.class);
+            Krb5NameElement krb5Name = Reflections.invokeMethod(true, getInstance, Krb5NameElement.class, null, fullName, KRB5_NAME_OID);
+
+            Credentials krb5CredsInternal = new Credentials(
+                    ticket.getEncoded(),
+                    ticket.getClient().getName(),
+                    ticket.getServer().getName(),
+                    ticket.getSessionKey().getEncoded(),
+                    ticket.getSessionKeyType(),
+                    ticket.getFlags(),
+                    ticket.getAuthTime(),
+                    ticket.getStartTime(),
+                    ticket.getEndTime(),
+                    ticket.getRenewTill(),
+                    ticket.getClientAddresses()
+            );
+
+            Method getInstance2 = Reflections.findDeclaredMethod(Krb5InitCredential.class, "getInstance", Krb5NameElement.class, Credentials.class);
+            Krb5InitCredential initCredential = Reflections.invokeMethod(true, getInstance2, Krb5InitCredential.class, null, krb5Name, krb5CredsInternal);
+
+            GSSManagerImpl manager = (GSSManagerImpl) GSSManager.getInstance();
+            return new GSSCredentialImpl(manager, initCredential);
+        } catch (Exception ioe) {
+            throw new KerberosSerializationException("Exception occured", ioe);
+        }
+    }
+
+
+    private static String serialize(Serializable obj) throws IOException {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        ObjectOutput out = null;
+        try {
+            out = new ObjectOutputStream(bos);
+            out.writeObject(obj);
+            byte[] objBytes = bos.toByteArray();
+            return Base64.encodeBytes(objBytes);
+        } finally {
+            try {
+                if (out != null) {
+                    out.close();
+                }
+            } catch (IOException ex) {
+                ex.printStackTrace();
+            }
+        }
+    }
+
+    private static Object deserialize(String serialized) throws ClassNotFoundException, IOException {
+        byte[] bytes = Base64.decode(serialized);
+        ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
+        ObjectInput in = null;
+        try {
+            in = new ObjectInputStream(bis);
+            return in.readObject();
+        } finally {
+            try {
+                if (in != null) {
+                    in.close();
+                }
+            } catch (IOException ex) {
+                ex.printStackTrace();
+            }
+        }
+    }
+
+    public static class KerberosSerializationException extends RuntimeException {
+
+        public KerberosSerializationException(String message, Throwable cause) {
+            super(message + ", " + JAVA_INFO, cause);
+        }
+
+        public KerberosSerializationException(String message) {
+            super(message + ", " + JAVA_INFO);
+        }
+    }
+}

common/src/main/java/org/keycloak/common/util/KeystoreUtil.java

@@ -0,0 +1,56 @@
+package org.keycloak.common.util;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+
+import org.keycloak.common.constants.GenericConstants;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeystoreUtil {
+    static {
+        BouncyIntegration.init();
+    }
+
+    public enum KeystoreFormat {
+        JKS,
+        PKCS12
+    }
+
+    public static KeyStore loadKeyStore(String filename, String password) throws Exception {
+        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        InputStream trustStream = (filename.startsWith(GenericConstants.PROTOCOL_CLASSPATH))
+                ?KeystoreUtil.class.getResourceAsStream(filename.replace(GenericConstants.PROTOCOL_CLASSPATH, ""))
+                :new FileInputStream(new File(filename));
+        trustStore.load(trustStream, password.toCharArray());
+        trustStream.close();
+        return trustStore;
+    }
+
+    public static PrivateKey loadPrivateKeyFromKeystore(String keystoreFile, String storePassword, String keyPassword, String keyAlias, KeystoreFormat format) {
+        InputStream stream = FindFile.findFile(keystoreFile);
+
+        try {
+            KeyStore keyStore = null;
+            if (format == KeystoreFormat.JKS) {
+                keyStore = KeyStore.getInstance(format.toString());
+            } else {
+                keyStore = KeyStore.getInstance(format.toString(), "BC");
+            }
+
+            keyStore.load(stream, storePassword.toCharArray());
+            PrivateKey key = (PrivateKey) keyStore.getKey(keyAlias, keyPassword.toCharArray());
+            if (key == null) {
+                throw new RuntimeException("Couldn't load key with alias '" + keyAlias + "' from keystore");
+            }
+            return key;
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to load private key: " + e.getMessage(), e);
+        }
+    }
+}

common/src/main/java/org/keycloak/common/util/MimeTypeUtil.java

@@ -0,0 +1,29 @@
+package org.keycloak.common.util;
+
+import javax.activation.MimetypesFileTypeMap;
+import java.io.File;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MimeTypeUtil {
+
+    private static MimetypesFileTypeMap map = new MimetypesFileTypeMap();
+    static {
+        map.addMimeTypes("text/css css CSS");
+        map.addMimeTypes("text/javascript js JS");
+        map.addMimeTypes("text/javascript js JS");
+        map.addMimeTypes("image/png png PNG");
+        map.addMimeTypes("image/svg+xml svg SVG");
+        map.addMimeTypes("text/html html htm HTML HTM");
+    }
+
+    public static String getContentType(File file) {
+        return map.getContentType(file);
+    }
+
+    public static String getContentType(String path) {
+        return map.getContentType(path);
+    }
+
+}

common/src/main/java/org/keycloak/common/util/MultivaluedHashMap.java

@@ -1,4 +1,4 @@
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.util.ArrayList;
 import java.util.Collection;

common/src/main/java/org/keycloak/common/util/NetworkUtils.java

@@ -0,0 +1,446 @@
+package org.keycloak.common.util;
+
+/*
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2011, Red Hat, Inc., and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+
+import java.net.Inet4Address;
+import java.net.Inet6Address;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.util.Arrays;
+import java.util.Locale;
+
+/**
+ * Utility methods related to networking.
+ *
+ * @author Brian Stansberry (c) 2011 Red Hat Inc.
+ */
+public class NetworkUtils {
+
+    private static final int MAX_GROUP_LENGTH = 4;
+    private static final int IPV6_LEN = 8;
+    private static final boolean can_bind_to_mcast_addr; // are we running on Linux ?
+
+    static {
+        can_bind_to_mcast_addr = checkForLinux() || checkForSolaris() || checkForHp();
+    }
+
+    public static String formatPossibleIpv6Address(String address) {
+        if(address == null) {
+            return null;
+        }
+        String ipv6Address;
+        if (address.startsWith("[") && address.endsWith("]")) {
+            ipv6Address = address.substring(0, address.lastIndexOf(']')).substring(1);
+        } else {
+            ipv6Address = address;
+        }
+        // Definitely not an IPv6, return untouched input.
+        if (!mayBeIPv6Address(ipv6Address)) {
+            return ipv6Address;
+        }
+        return '[' + canonize(ipv6Address) + ']';
+    }
+
+    /**
+     * <p>Convert IPv6 adress into RFC 5952 form.
+     * E.g. 2001:db8:0:1:0:0:0:1 -> 2001:db8:0:1::1</p>
+     *
+     * <p>Method is null safe, and if IPv4 address or host name is passed to the
+     * method it is returned wihout any processing.</p>
+     *
+     * <p>Method also supports IPv4 in IPv6 (e.g. 0:0:0:0:0:ffff:192.0.2.1 ->
+     * ::ffff:192.0.2.1), and zone ID (e.g. fe80:0:0:0:f0f0:c0c0:1919:1234%4
+     * -> fe80::f0f0:c0c0:1919:1234%4).</p>
+     *
+     * @param ipv6Address String representing valid IPv6 address.
+     * @return String representing IPv6 in canonical form.
+     * @throws IllegalArgumentException if IPv6 format is unacceptable.
+     */
+    public static String canonize(String ipv6Address) throws IllegalArgumentException {
+
+        if (ipv6Address == null) {
+            return null;
+        }
+
+        // Definitely not an IPv6, return untouched input.
+        if (!mayBeIPv6Address(ipv6Address)) {
+            return ipv6Address;
+        }
+
+        // Length without zone ID (%zone) or IPv4 address
+        int ipv6AddressLength = ipv6Address.length();
+        if (isIPv4AddressInIPv6(ipv6Address)) {
+            // IPv4 in IPv6
+            // e.g. 0:0:0:0:0:FFFF:127.0.0.1
+            int lastColonPos = ipv6Address.lastIndexOf(":");
+            int lastColonsPos = ipv6Address.lastIndexOf("::");
+            if (lastColonsPos >= 0 && lastColonPos == lastColonsPos + 1) {
+                // IPv6 part ends with two consecutive colons, last colon is part of IPv6 format.
+                // e.g. ::127.0.0.1
+                ipv6AddressLength = lastColonPos + 1;
+            } else {
+                // IPv6 part ends with only one colon, last colon is not part of IPv6 format.
+                // e.g. ::FFFF:127.0.0.1
+                ipv6AddressLength = lastColonPos;
+            }
+        } else if (ipv6Address.contains(":") && ipv6Address.contains("%")) {
+            // Zone ID
+            // e.g. fe80:0:0:0:f0f0:c0c0:1919:1234%4
+            ipv6AddressLength = ipv6Address.lastIndexOf("%");
+        }
+
+        StringBuilder result = new StringBuilder();
+        char [][] groups = new char[IPV6_LEN][MAX_GROUP_LENGTH];
+        int groupCounter = 0;
+        int charInGroupCounter = 0;
+
+        // Index of the current zeroGroup, -1 means not found.
+        int zeroGroupIndex = -1;
+        int zeroGroupLength = 0;
+
+        // maximum length zero group, if there is more then one, then first one
+        int maxZeroGroupIndex = -1;
+        int maxZeroGroupLength = 0;
+
+        boolean isZero = true;
+        boolean groupStart = true;
+
+        /*
+         *  Two consecutive colons, initial expansion.
+         *  e.g. 2001:db8:0:0:1::1 -> 2001:db8:0:0:1:0:0:1
+         */
+        StringBuilder expanded = new StringBuilder(ipv6Address);
+        int colonsPos = ipv6Address.indexOf("::");
+        int length = ipv6AddressLength;
+        int change = 0;
+
+        if (colonsPos >= 0 && colonsPos < ipv6AddressLength - 2) {
+            int colonCounter = 0;
+            for (int i = 0; i < ipv6AddressLength; i++) {
+                if (ipv6Address.charAt(i) == ':') {
+                    colonCounter++;
+                }
+            }
+
+            if (colonsPos == 0) {
+                expanded.insert(0, "0");
+                change = change + 1;
+            }
+
+            for (int i = 0; i < IPV6_LEN - colonCounter; i++) {
+                expanded.insert(colonsPos + 1, "0:");
+                change = change + 2;
+            }
+
+
+            if (colonsPos == ipv6AddressLength - 2) {
+                expanded.setCharAt(colonsPos + change + 1, '0');
+            } else {
+                expanded.deleteCharAt(colonsPos + change + 1);
+                change = change - 1;
+            }
+            length = length + change;
+        }
+
+
+        // Processing one char at the time
+        for (int charCounter = 0; charCounter < length; charCounter++) {
+            char c = expanded.charAt(charCounter);
+            if (c >= 'A' && c <= 'F') {
+                c = (char) (c + 32);
+            }
+            if (c != ':') {
+                groups[groupCounter][charInGroupCounter] = c;
+                if (!(groupStart && c == '0')) {
+                    ++charInGroupCounter;
+                    groupStart = false;
+                }
+                if (c != '0') {
+                    isZero = false;
+                }
+            }
+            if (c == ':' || charCounter == (length - 1)) {
+                // We reached end of current group
+                if (isZero) {
+                    ++zeroGroupLength;
+                    if (zeroGroupIndex == -1) {
+                        zeroGroupIndex = groupCounter;
+                    }
+                }
+
+                if (!isZero || charCounter == (length - 1)) {
+                    // We reached end of zero group
+                    if (zeroGroupLength > maxZeroGroupLength) {
+                        maxZeroGroupLength = zeroGroupLength;
+                        maxZeroGroupIndex = zeroGroupIndex;
+                    }
+                    zeroGroupLength = 0;
+                    zeroGroupIndex = -1;
+                }
+                ++groupCounter;
+                charInGroupCounter = 0;
+                isZero = true;
+                groupStart = true;
+            }
+        }
+
+        int numberOfGroups = groupCounter;
+
+        // Output results
+        for (groupCounter = 0; groupCounter < numberOfGroups; groupCounter++) {
+            if (maxZeroGroupLength <= 1 || groupCounter < maxZeroGroupIndex
+                    || groupCounter >= maxZeroGroupIndex + maxZeroGroupLength) {
+                for (int j = 0; j < MAX_GROUP_LENGTH; j++) {
+                    if (groups[groupCounter][j] != 0) {
+                        result.append(groups[groupCounter][j]);
+                    }
+                }
+                if (groupCounter < (numberOfGroups - 1)
+                        && (groupCounter != maxZeroGroupIndex - 1
+                        || maxZeroGroupLength <= 1)) {
+                    result.append(':');
+                }
+            } else if (groupCounter == maxZeroGroupIndex) {
+                result.append("::");
+            }
+        }
+
+        // Solve problem with three colons in IPv4 in IPv6 format
+        // e.g. 0:0:0:0:0:0:127.0.0.1 -> :::127.0.0.1 -> ::127.0.0.1
+        int resultLength = result.length();
+        if (result.charAt(resultLength - 1) == ':' && ipv6AddressLength < ipv6Address.length()
+                && ipv6Address.charAt(ipv6AddressLength) == ':') {
+            result.delete(resultLength - 1, resultLength);
+        }
+
+        /*
+         * Append IPv4 from IPv4-in-IPv6 format or Zone ID
+         */
+        for (int i = ipv6AddressLength; i < ipv6Address.length(); i++) {
+            result.append(ipv6Address.charAt(i));
+        }
+
+        return result.toString();
+    }
+
+    /**
+     * Heuristic check if string might be an IPv6 address.
+     *
+     * @param input Any string or null
+     * @return true, if input string contains only hex digits and at least two colons, before '.' or '%' character.
+     */
+    private static boolean mayBeIPv6Address(String input) {
+        if (input == null) {
+            return false;
+        }
+
+        boolean result = false;
+        int colonsCounter = 0;
+        int length = input.length();
+        for (int i = 0; i < length; i++) {
+            char c = input.charAt(i);
+            if (c == '.' || c == '%') {
+                // IPv4 in IPv6 or Zone ID detected, end of checking.
+                break;
+            }
+            if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f')
+                    || (c >= 'A' && c <= 'F') || c == ':')) {
+                return false;
+            } else if (c == ':') {
+                colonsCounter++;
+            }
+        }
+        if (colonsCounter >= 2) {
+            result = true;
+        }
+        return result;
+    }
+    /**
+     * Check if it is an IPv4 in IPv6 format.
+     * e.g. 0:0:0:0:0:FFFF:127.0.0.1
+     *
+     * @param ipv6Address the address
+     * @return true, if input string is an IPv4 address in IPv6 format.
+     */
+    private static boolean isIPv4AddressInIPv6(String ipv6Address) {
+        return (ipv6Address.contains(":") && ipv6Address.contains("."));
+    }
+
+    /**
+     * Formats input address. For IPV4 returns simply host address, for IPV6 formats address according to <a
+     * href="http://tools.ietf.org/html/rfc5952">RFC5952</a> rules. It does not embed IPV6 address in '[', ']', since those are part of IPV6 URI literal.
+     *
+     * @param inet
+     * @return
+     */
+    public static String formatAddress(InetAddress inet){
+        if(inet == null){
+            throw new NullPointerException();
+        }
+        if(inet instanceof Inet4Address){
+            return inet.getHostAddress();
+        } else if (inet instanceof Inet6Address){
+            byte[] byteRepresentation = inet.getAddress();
+            int[] hexRepresentation = new int[IPV6_LEN];
+
+            for(int i=0;i < hexRepresentation.length;i++){
+                hexRepresentation[i] = ( byteRepresentation[2*i] & 0xFF) << 8 | ( byteRepresentation[2*i+1] & 0xFF );
+            }
+            compactLongestZeroSequence(hexRepresentation);
+            return formatAddress6(hexRepresentation);
+        } else {
+            return inet.getHostAddress();
+        }
+    }
+
+    /**
+     * Converts socket address into string literal, which has form: 'address:port'. Example:<br>
+     * <ul>
+     *      <li>127.0.0.1:8080</li>
+     *      <li>dns.name.com:8080</li>
+     *      <li>[0fe:1::20]:8080</li>
+     *      <li>[::1]:8080</li>
+     * </ul>
+     * @param inet
+     * @return
+     */
+    public static String formatAddress(InetSocketAddress inet){
+        if(inet == null){
+            throw new NullPointerException();
+        }
+        StringBuilder result = new StringBuilder();
+        if(inet.isUnresolved()){
+            result.append(inet.getHostName());
+        }else{
+            result.append(formatPossibleIpv6Address(formatAddress(inet.getAddress())));
+        }
+        result.append(":").append(inet.getPort());
+        return result.toString();
+    }
+
+    /**
+     * Converts IPV6 int[] representation into valid IPV6 string literal. Sequence of '-1' values are converted into '::'.
+     * @param hexRepresentation
+     * @return
+     */
+    private static String formatAddress6(int[] hexRepresentation){
+        if(hexRepresentation == null){
+            throw new NullPointerException();
+        }
+        if(hexRepresentation.length != IPV6_LEN){
+            throw new IllegalArgumentException();
+        }
+        StringBuilder stringBuilder = new StringBuilder();
+        boolean inCompressedSection = false;
+        for(int i = 0;i<hexRepresentation.length;i++){
+            if(hexRepresentation[i] == -1){
+                if(!inCompressedSection){
+                    inCompressedSection = true;
+                    if(i == 0){
+                        stringBuilder.append("::");
+                    } else {
+                        stringBuilder.append(':');
+                    }
+                }
+            } else {
+                inCompressedSection = false;
+                stringBuilder.append(Integer.toHexString(hexRepresentation[i]));
+                if(i+1<hexRepresentation.length){
+                    stringBuilder.append(":");
+                }
+            }
+        }
+        return stringBuilder.toString();
+    }
+
+    public static boolean isBindingToMulticastDressSupported() {
+        return can_bind_to_mcast_addr;
+    }
+
+    private static void compactLongestZeroSequence(int[] hexRepresentatoin){
+        int bestRunStart = -1;
+        int bestRunLen = -1;
+        boolean inRun = false;
+        int runStart = -1;
+        for(int i=0;i<hexRepresentatoin.length;i++){
+
+            if(hexRepresentatoin[i] == 0){
+                if(!inRun){
+                    runStart = i;
+                    inRun = true;
+                }
+            } else {
+                if(inRun){
+                    inRun = false;
+                    int runLen = i - runStart;
+                    if(bestRunLen < 0){
+                        bestRunStart = runStart;
+                        bestRunLen = runLen;
+                    } else {
+                        if(runLen > bestRunLen){
+                            bestRunStart = runStart;
+                            bestRunLen = runLen;
+                        }
+                    }
+                }
+            }
+        }
+        if(bestRunStart >=0){
+            Arrays.fill(hexRepresentatoin, bestRunStart, bestRunStart + bestRunLen, -1);
+        }
+    }
+
+    private static boolean checkForLinux() {
+        return checkForPresence("os.name", "linux");
+    }
+
+    private static boolean checkForHp() {
+        return checkForPresence("os.name", "hp");
+    }
+
+    private static boolean checkForSolaris() {
+        return checkForPresence("os.name", "sun");
+    }
+
+    private static boolean checkForWindows() {
+        return checkForPresence("os.name", "win");
+    }
+
+    public static boolean checkForMac() {
+        return checkForPresence("os.name", "mac");
+    }
+
+    private static boolean checkForPresence(final String key, final String value) {
+        final String tmp = System.getProperty(key, value);
+        try {
+            return tmp != null && tmp.trim().toLowerCase(Locale.ENGLISH).startsWith(value);
+        } catch (Throwable t) {
+            return false;
+        }
+    }
+
+    // No instantiation
+    private NetworkUtils() {
+
+    }
+}

common/src/main/java/org/keycloak/common/util/ObjectUtil.java

@@ -0,0 +1,27 @@
+package org.keycloak.common.util;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ObjectUtil {
+
+    private ObjectUtil() {}
+
+    /**
+     *
+     * @param str1
+     * @param str2
+     * @return true if both strings are null or equal
+     */
+    public static boolean isEqualOrNull(Object str1, Object str2) {
+        if (str1 == null && str2 == null) {
+            return true;
+        }
+
+        if ((str1 != null && str2 == null) || (str1 == null && str2 != null)) {
+            return false;
+        }
+
+        return str1.equals(str2);
+    }
+}

common/src/main/java/org/keycloak/common/util/PathHelper.java

@@ -1,7 +1,7 @@
 /**
  *
  */
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.util.regex.Pattern;
 

common/src/main/java/org/keycloak/common/util/PemUtils.java

@@ -1,110 +1,108 @@
-package org.keycloak.util;
-
-
-import net.iharder.Base64;
-
-import java.io.ByteArrayInputStream;
-import java.io.DataInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-import java.security.cert.X509Certificate;
-
-/**
- * Utility classes to extract PublicKey, PrivateKey, and X509Certificate from openssl generated PEM files
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public final class PemUtils {
-    static {
-        BouncyIntegration.init();
-    }
-
-    private PemUtils() {
-    }
-
-    public static X509Certificate decodeCertificate(InputStream is) throws Exception {
-        byte[] der = pemToDer(is);
-        ByteArrayInputStream bis = new ByteArrayInputStream(der);
-        return DerUtils.decodeCertificate(bis);
-    }
-
-    public static X509Certificate decodeCertificate(String cert) throws Exception {
-        byte[] der = pemToDer(cert);
-        ByteArrayInputStream bis = new ByteArrayInputStream(der);
-        return DerUtils.decodeCertificate(bis);
-    }
-
-
-    /**
-     * Extract a public key from a PEM string
-     *
-     * @param pem
-     * @return
-     * @throws Exception
-     */
-    public static PublicKey decodePublicKey(String pem) throws Exception {
-        byte[] der = pemToDer(pem);
-        return DerUtils.decodePublicKey(der);
-    }
-
-    /**
-     * Extract a private key that is a PKCS8 pem string (base64 encoded PKCS8)
-     *
-     * @param pem
-     * @return
-     * @throws Exception
-     */
-    public static PrivateKey decodePrivateKey(String pem) throws Exception {
-        byte[] der = pemToDer(pem);
-        return DerUtils.decodePrivateKey(der);
-    }
-
-    public static PrivateKey decodePrivateKey(InputStream is) throws Exception {
-        String pem = pemFromStream(is);
-        return decodePrivateKey(pem);
-    }
-
-    /**
-     * Decode a PEM file to DER format
-     *
-     * @param is
-     * @return
-     * @throws java.io.IOException
-     */
-    public static byte[] pemToDer(InputStream is) throws IOException {
-        String pem = pemFromStream(is);
-        return pemToDer(pem);
-    }
-
-    /**
-     * Decode a PEM string to DER format
-     *
-     * @param pem
-     * @return
-     * @throws java.io.IOException
-     */
-    public static byte[] pemToDer(String pem) throws IOException {
-        pem = removeBeginEnd(pem);
-        return Base64.decode(pem);
-    }
-
-    public static String removeBeginEnd(String pem) {
-        pem = pem.replaceAll("-----BEGIN (.*)-----", "");
-        pem = pem.replaceAll("-----END (.*)----", "");
-        pem = pem.replaceAll("\r\n", "");
-        pem = pem.replaceAll("\n", "");
-        return pem.trim();
-    }
-
-
-    public static String pemFromStream(InputStream is) throws IOException {
-        DataInputStream dis = new DataInputStream(is);
-        byte[] keyBytes = new byte[dis.available()];
-        dis.readFully(keyBytes);
-        dis.close();
-        return new String(keyBytes, "utf-8");
-    }
-}
+package org.keycloak.common.util;
+
+
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+
+/**
+ * Utility classes to extract PublicKey, PrivateKey, and X509Certificate from openssl generated PEM files
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public final class PemUtils {
+    static {
+        BouncyIntegration.init();
+    }
+
+    private PemUtils() {
+    }
+
+    public static X509Certificate decodeCertificate(InputStream is) throws Exception {
+        byte[] der = pemToDer(is);
+        ByteArrayInputStream bis = new ByteArrayInputStream(der);
+        return DerUtils.decodeCertificate(bis);
+    }
+
+    public static X509Certificate decodeCertificate(String cert) throws Exception {
+        byte[] der = pemToDer(cert);
+        ByteArrayInputStream bis = new ByteArrayInputStream(der);
+        return DerUtils.decodeCertificate(bis);
+    }
+
+
+    /**
+     * Extract a public key from a PEM string
+     *
+     * @param pem
+     * @return
+     * @throws Exception
+     */
+    public static PublicKey decodePublicKey(String pem) throws Exception {
+        byte[] der = pemToDer(pem);
+        return DerUtils.decodePublicKey(der);
+    }
+
+    /**
+     * Extract a private key that is a PKCS8 pem string (base64 encoded PKCS8)
+     *
+     * @param pem
+     * @return
+     * @throws Exception
+     */
+    public static PrivateKey decodePrivateKey(String pem) throws Exception {
+        byte[] der = pemToDer(pem);
+        return DerUtils.decodePrivateKey(der);
+    }
+
+    public static PrivateKey decodePrivateKey(InputStream is) throws Exception {
+        String pem = pemFromStream(is);
+        return decodePrivateKey(pem);
+    }
+
+    /**
+     * Decode a PEM file to DER format
+     *
+     * @param is
+     * @return
+     * @throws java.io.IOException
+     */
+    public static byte[] pemToDer(InputStream is) throws IOException {
+        String pem = pemFromStream(is);
+        return pemToDer(pem);
+    }
+
+    /**
+     * Decode a PEM string to DER format
+     *
+     * @param pem
+     * @return
+     * @throws java.io.IOException
+     */
+    public static byte[] pemToDer(String pem) throws IOException {
+        pem = removeBeginEnd(pem);
+        return Base64.decode(pem);
+    }
+
+    public static String removeBeginEnd(String pem) {
+        pem = pem.replaceAll("-----BEGIN (.*)-----", "");
+        pem = pem.replaceAll("-----END (.*)----", "");
+        pem = pem.replaceAll("\r\n", "");
+        pem = pem.replaceAll("\n", "");
+        return pem.trim();
+    }
+
+
+    public static String pemFromStream(InputStream is) throws IOException {
+        DataInputStream dis = new DataInputStream(is);
+        byte[] keyBytes = new byte[dis.available()];
+        dis.readFully(keyBytes);
+        dis.close();
+        return new String(keyBytes, "utf-8");
+    }
+}

common/src/main/java/org/keycloak/common/util/ServerCookie.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.util;
+package org.keycloak.common.util;
 
 import java.io.Serializable;
 import java.text.DateFormat;
@@ -122,20 +122,23 @@ public class ServerCookie implements Serializable {
     private final static String OLD_COOKIE_PATTERN = "EEE, dd-MMM-yyyy HH:mm:ss z";
 
 
-    private final static DateFormat oldCookieFormat = new SimpleDateFormat(OLD_COOKIE_PATTERN, LOCALE_US);
+    private final static DateFormat OLD_COOKIE_FORMAT = new SimpleDateFormat(OLD_COOKIE_PATTERN, LOCALE_US);
+    static{
+        OLD_COOKIE_FORMAT.setTimeZone(GMT_ZONE);
+    }
 
     public static String formatOldCookie(Date d) {
         String ocf = null;
-        synchronized (oldCookieFormat) {
-            ocf = oldCookieFormat.format(d);
+        synchronized (OLD_COOKIE_FORMAT) {
+            ocf = OLD_COOKIE_FORMAT.format(d);
         }
         return ocf;
     }
 
     public static void formatOldCookie(Date d, StringBuffer sb,
                                        FieldPosition fp) {
-        synchronized (oldCookieFormat) {
-            oldCookieFormat.format(d, sb, fp);
+        synchronized (OLD_COOKIE_FORMAT) {
+            OLD_COOKIE_FORMAT.format(d, sb, fp);
         }
     }
 

common/src/main/java/org/keycloak/common/util/StreamUtil.java

@@ -1,35 +1,35 @@
-package org.keycloak.util;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public final class StreamUtil {
-
-    private StreamUtil() {
-    }
-
-    public static String readString(InputStream in) throws IOException
-    {
-        char[] buffer = new char[1024];
-        StringBuilder builder = new StringBuilder();
-        BufferedReader reader = new BufferedReader(new InputStreamReader(in));
-        int wasRead;
-        do
-        {
-            wasRead = reader.read(buffer, 0, 1024);
-            if (wasRead > 0)
-            {
-                builder.append(buffer, 0, wasRead);
-            }
-        }
-        while (wasRead > -1);
-
-        return builder.toString();
-    }
-}
+package org.keycloak.common.util;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public final class StreamUtil {
+
+    private StreamUtil() {
+    }
+
+    public static String readString(InputStream in) throws IOException
+    {
+        char[] buffer = new char[1024];
+        StringBuilder builder = new StringBuilder();
+        BufferedReader reader = new BufferedReader(new InputStreamReader(in));
+        int wasRead;
+        do
+        {
+            wasRead = reader.read(buffer, 0, 1024);
+            if (wasRead > 0)
+            {
+                builder.append(buffer, 0, wasRead);
+            }
+        }
+        while (wasRead > -1);
+
+        return builder.toString();
+    }
+}

common/src/main/java/org/keycloak/common/util/StringPropertyReplacer.java

@@ -19,7 +19,7 @@
   * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
   * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
   */
-package org.keycloak.util;
+package org.keycloak.common.util;
 
 import java.io.File;
 import java.util.Properties;

common/src/main/java/org/keycloak/common/util/SystemEnvProperties.java

@@ -0,0 +1,25 @@
+package org.keycloak.common.util;
+
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class SystemEnvProperties extends Properties {
+
+    @Override
+    public String getProperty(String key) {
+        if (key.startsWith("env.")) {
+            return System.getenv().get(key.substring(4));
+        } else {
+            return System.getProperty(key);
+        }
+    }
+
+    @Override
+    public String getProperty(String key, String defaultValue) {
+        String value = getProperty(key);
+        return value != null ? value : defaultValue;
+    }
+
+}

common/src/main/java/org/keycloak/common/util/Time.java

@@ -0,0 +1,28 @@
+package org.keycloak.common.util;
+
+import java.util.Date;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Time {
+
+    private static int offset;
+
+    public static int currentTime() {
+        return ((int) (System.currentTimeMillis() / 1000)) + offset;
+    }
+
+    public static Date toDate(int time) {
+        return new Date(((long) time ) * 1000);
+    }
+
+    public static long toMillis(int time) {
+        return ((long) time) * 1000;
+    }
+
+    public static void setOffset(int offset) {
+        Time.offset = offset;
+    }
+
+}

common/src/main/java/org/keycloak/common/util/UriUtils.java

@@ -0,0 +1,70 @@
+package org.keycloak.common.util;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.net.URLDecoder;
+import java.util.regex.Pattern;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UriUtils {
+
+    private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w-]+(\\.[\\w-]+)*(:[\\d]{2,5})?");
+
+    public static String getOrigin(URI uri) {
+        return getOrigin(uri.toString());
+    }
+
+    public static String getOrigin(String uri) {
+        String u = uri.toString();
+        int e = u.indexOf('/', 8);
+        return e != -1 ? u.substring(0, u.indexOf('/', 8)) : u;
+    }
+
+    public static boolean isOrigin(String url) {
+        return originPattern.matcher(url).matches();
+    }
+
+    public static MultivaluedHashMap<String, String> decodeQueryString(String queryString) {
+        MultivaluedHashMap<String, String> map = new MultivaluedHashMap<String, String>();
+        if (queryString == null || queryString.equals("")) return map;
+
+        String[] params = queryString.split("&");
+
+        for (String param : params)
+        {
+            if (param.indexOf('=') >= 0)
+            {
+                String[] nv = param.split("=", 2);
+                try
+                {
+                    String name = URLDecoder.decode(nv[0], "UTF-8");
+                    String val = nv.length > 1 ? nv[1] : "";
+                    map.add(name, URLDecoder.decode(val, "UTF-8"));
+                }
+                catch (UnsupportedEncodingException e)
+                {
+                    throw new RuntimeException(e);
+                }
+            }
+            else
+            {
+                try
+                {
+                    String name = URLDecoder.decode(param, "UTF-8");
+                    map.add(name, "");
+                }
+                catch (UnsupportedEncodingException e)
+                {
+                    throw new RuntimeException(e);
+                }
+            }
+        }
+        return map;
+    }
+
+    public static String stripQueryParam(String url, String name){
+        return url.replaceFirst("[\\?&]"+name+"=[^&]*$|"+name+"=[^&]*&", "");
+    }
+}

common/src/main/java/org/keycloak/common/util/reflections/Reflections.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.utils.reflection;
+package org.keycloak.common.util.reflections;
 
 import java.beans.Introspector;
 import java.io.Serializable;

common/src/main/java/org/keycloak/common/util/reflections/SetAccessiblePrivilegedAction.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.utils.reflection;
+package org.keycloak.common.util.reflections;
 
 import java.lang.reflect.AccessibleObject;
 import java.security.PrivilegedAction;

common/src/main/java/org/keycloak/common/util/reflections/Types.java

@@ -1,4 +1,4 @@
-package org.keycloak.models.utils.reflection;
+package org.keycloak.common.util.reflections;
 
 import java.lang.reflect.Type;
 

common/src/main/resources/keycloak-version.properties

@@ -0,0 +1,2 @@
+version=${product.version}
+build-time=${product.build-time}

connections/file/pom.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.6.1.Final</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-file</artifactId>
+    <name>Keycloak Connections File</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-single-file</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+</project>

connections/file/src/main/java/org/keycloak/connections/file/DefaultFileConnectionProvider.java

@@ -0,0 +1,86 @@
+/*
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.connections.file;
+
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * Provides the InMemoryModel and notifies the factory to save it when
+ * the session is done.
+ * 
+ * @author Stan Silvert ssilvert@redhat.com (C) 2015 Red Hat Inc.
+ */
+public class DefaultFileConnectionProvider implements FileConnectionProvider {
+
+    private final DefaultFileConnectionProviderFactory factory;
+    private final KeycloakSession session;
+    private final InMemoryModel inMemoryModel;
+
+    private boolean isRollbackOnly = false;
+
+    public DefaultFileConnectionProvider(DefaultFileConnectionProviderFactory factory,
+                                         KeycloakSession session,
+                                         InMemoryModel inMemoryModel) {
+        this.factory = factory;
+        this.session = session;
+        this.inMemoryModel = inMemoryModel;
+    }
+
+    @Override
+    public InMemoryModel getModel() {
+        return inMemoryModel;
+    }
+
+    @Override
+    public void sessionClosed(KeycloakSession session) {
+        factory.sessionClosed(session);
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public void begin() {
+    }
+
+    @Override
+    public void commit() {
+        factory.commit(session);
+    }
+
+    @Override
+    public void rollback() {
+        factory.rollback(session);
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        isRollbackOnly = true;
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return isRollbackOnly;
+    }
+
+    @Override
+    public boolean isActive() {
+        return factory.isActive(session);
+    }
+
+}

connections/file/src/main/java/org/keycloak/connections/file/DefaultFileConnectionProviderFactory.java

@@ -0,0 +1,210 @@
+/*
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.connections.file;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.codehaus.jackson.JsonToken;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.exportimport.util.ExportUtils;
+import org.keycloak.exportimport.util.ImportUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * This class dispenses a FileConnectionProvider to Keycloak sessions.  It
+ * makes sure that only one InMemoryModel is provided for each session and it
+ * handles thread contention for the file where the model is read or saved.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2015 Red Hat Inc.
+ */
+public class DefaultFileConnectionProviderFactory implements FileConnectionProviderFactory {
+
+    protected static final Logger logger = Logger.getLogger(DefaultFileConnectionProviderFactory.class);
+
+    private File kcdata;
+    private final Map<KeycloakSession, FileConnectionProvider> allProviders = new HashMap<KeycloakSession, FileConnectionProvider>();
+
+    @Override
+    public void init(Config.Scope config) {
+        String fileName = config.get("fileName");
+        if (fileName == null) {
+            fileName = "keycloak-model.json";
+        }
+
+        String directory = config.get("directory");
+        if (directory == null) {
+            directory = System.getProperty("jboss.server.data.dir");
+        }
+        if (directory == null) {
+            directory = ".";
+        }
+
+        kcdata = new File(directory, fileName);
+    }
+
+    public void sessionClosed(KeycloakSession session) {
+        synchronized(allProviders) {
+            allProviders.remove(session);
+            //logger.info("Removed session " + session.hashCode());
+            //logger.info("sessionClosed: Session count=" + allModels.size());
+        }
+    }
+
+    void readModelFile(KeycloakSession session) {
+        synchronized(allProviders) {
+            if (!kcdata.exists()) {
+                return;
+            }
+
+            FileInputStream fis = null;
+            try {
+                fis = new FileInputStream(kcdata);
+                Model model = JsonSerialization.readValue(fis, Model.class);
+                ImportUtils.importFromStream(session, JsonSerialization.mapper, fis, Strategy.IGNORE_EXISTING);
+                session.realms().getMigrationModel().setStoredVersion(model.getModelVersion());
+
+                ImportUtils.importRealms(session, model.getRealms(), Strategy.IGNORE_EXISTING);
+            } catch (IOException ioe) {
+                logger.error("Unable to read model file " + kcdata.getAbsolutePath(), ioe);
+            } finally {
+                //logger.info("Read model file for session=" + session.hashCode());
+                try {
+                    if (fis != null) {
+                        fis.close();
+                    }
+                } catch (IOException e) {
+                    logger.error("Failed to close output stream.", e);
+                }
+            }
+        }
+    }
+
+    void writeModelFile(KeycloakSession session) {
+        synchronized(allProviders) {
+            FileOutputStream outStream = null;
+
+            try {
+                outStream = new FileOutputStream(kcdata);
+                exportModel(session, outStream);
+            } catch (IOException e) {
+                logger.error("Unable to write model file " + kcdata.getAbsolutePath(), e);
+            } finally {
+                //logger.info("Wrote model file for session=" + session.hashCode());
+                try {
+                    if (outStream != null) {
+                        outStream.close();
+                    }
+                } catch (IOException e) {
+                    logger.error("Failed to close output stream.", e);
+                }
+            }
+        }
+    }
+
+    private void exportModel(KeycloakSession session, FileOutputStream outStream) throws IOException {
+        List<RealmModel> realms = session.realms().getRealms();
+        List<RealmRepresentation> reps = new ArrayList<RealmRepresentation>();
+        for (RealmModel realm : realms) {
+            reps.add(ExportUtils.exportRealm(session, realm, true));
+        }
+        Model model = new Model();
+        model.setRealms(reps);
+        model.setModelVersion(session.realms().getMigrationModel().getStoredVersion());
+        JsonSerialization.prettyMapper.writeValue(outStream, model);
+    }
+
+    @Override
+    public FileConnectionProvider create(KeycloakSession session) {
+        synchronized (allProviders) {
+            FileConnectionProvider fcProvider = allProviders.get(session);
+            if (fcProvider == null) {
+                InMemoryModel model = new InMemoryModel();
+                fcProvider = new DefaultFileConnectionProvider(this, session, model);
+                allProviders.put(session, fcProvider);
+                session.getTransaction().enlist(fcProvider);
+                readModelFile(session);
+                //logger.info("Added session " + session.hashCode() + " total sessions=" + allModels.size());
+            }
+
+            return fcProvider;
+        }
+    }
+
+    // commitCount is used for debugging.  This allows you to easily run a test
+    // to a particular point and then examine the JSON file.
+    //private static int commitCount = 0;
+    void commit(KeycloakSession session) {
+        //commitCount++;
+        synchronized (allProviders) {
+            // in case commit was somehow called twice on the same session
+            if (!allProviders.containsKey(session)) return;
+
+            try {
+                writeModelFile(session);
+            } finally {
+                allProviders.remove(session);
+                //logger.info("Removed session " + session.hashCode());
+                //logger.info("*** commitCount=" + commitCount);
+                //logger.info("commit(): Session count=" + allModels.size());
+            }
+
+    //     if (commitCount == 16) {Thread.dumpStack();System.exit(0);}
+        }
+    }
+
+    void rollback(KeycloakSession session) {
+        synchronized (allProviders) {
+            allProviders.remove(session);
+            //logger.info("rollback(): Session count=" + allModels.size());
+        }
+    }
+
+    boolean isActive(KeycloakSession session) {
+        synchronized (allProviders) {
+            return allProviders.containsKey(session);
+        }
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+
+    }
+
+}

connections/file/src/main/java/org/keycloak/connections/file/FileConnectionProvider.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.connections.file;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2015 Red Hat Inc.
+ */
+public interface FileConnectionProvider extends Provider, KeycloakTransaction {
+
+    InMemoryModel getModel();
+
+    void sessionClosed(KeycloakSession session);
+}

connections/file/src/main/java/org/keycloak/connections/file/FileConnectionProviderFactory.java

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.keycloak.connections.file;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2015 Red Hat Inc.
+ */
+public interface FileConnectionProviderFactory extends ProviderFactory<FileConnectionProvider> {
+}