Version bump

2014-09-18 13:24:54 +02:00
161 changed files with 230 additions and 989 deletions
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>
    <name>Connections Parent</name>
    <description/>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -1,15 +1,12 @@
 package org.keycloak.util;

 import java.net.URI;
-import java.util.regex.Pattern;

 /**
 * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
 */
 public class UriUtils {

-    private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w-]+(\\.[\\w-]+)*(:[\\d]{2,5})?");
-
    public static String getOrigin(URI uri) {
        return getOrigin(uri.toString());
    }
@@ -19,8 +16,4 @@ public class UriUtils {
        return u.substring(0, u.indexOf('/', 8));
    }

-    public static boolean isOrigin(String url) {
-        return originPattern.matcher(url).matches();
-    }
-
 }
@@ -1,46 +0,0 @@
-package org.keycloak.util;
-
-import org.junit.Test;
-
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class UriUtilsTest {
-
-    @Test
-    public void testOrigins() {
-        assertValid("http://test");
-        assertValid("http://test:8080");
-        assertValid("https://test");
-        assertValid("http://test.com");
-        assertValid("https://test.com");
-        assertValid("https://test.com:8080");
-        assertValid("http://sub.test.com");
-        assertValid("https://sub.test.com");
-        assertValid("https://sub.test.com:8080");
-        assertValid("http://192.168.123.123");
-        assertValid("https://192.168.123.123");
-        assertValid("https://192.168.123.123:8080");
-        assertValid("https://sub-sub.test.com");
-        assertValid("https://sub.test-test.com");
-
-        assertInvalid("https://test/");
-        assertInvalid("{");
-        assertInvalid("https://{}");
-        assertInvalid("https://)");
-        assertInvalid("http://test:test");
-        assertInvalid("http://test:8080:8080");
-    }
-
-    public void assertValid(String origin) {
-        assertTrue(UriUtils.isOrigin(origin));
-    }
-
-    public void assertInvalid(String origin) {
-        assertFalse(UriUtils.isOrigin(origin));
-    }
-
-}
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -30,7 +30,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Distribution</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -31,7 +31,6 @@
                <!ENTITY UserFederation SYSTEM "modules/user-federation.xml">
                <!ENTITY ExportImport SYSTEM "modules/export-import.xml">
                <!ENTITY ServerCache SYSTEM "modules/cache.xml">
-                <!ENTITY SecurityVulnerabilities SYSTEM "modules/security-vulnerabilities.xml">
                ]>

 <book>
@@ -120,7 +119,6 @@ This one is short
    &UserFederation;
    &ExportImport;
    &ServerCache;
-    &SecurityVulnerabilities;
    &Migration;

 </book>
@@ -44,7 +44,7 @@
                <listitem>
                    <para>
                        For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
-                        This switch is for oauth clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
+                        This switch is for oauth clients that only use the  <link linkend='direct-access-grant'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
@@ -1,155 +0,0 @@
-<chapter id="security_vulnerabilities">
-    <title>Security Vulnerabilities</title>
-    <para>
-        This chapter discusses possible security vulnerabilities Keycloak could have, how Keycloak mitigates those
-        vulnerabilities, and what steps you need to do to configure Keycloak to mitigate some vulnerabilities.  A good list
-        of potential vulnerabilities and what security implementations should do to mitigate them can be found in the
-        <ulink url="http://tools.ietf.org/html/rfc6819">OAuth 2.0 Thread Model</ulink> document put out by the IETF.  Many of those vulnerabilities are discussed here.
-    </para>
-    <section>
-        <title>SSL/HTTPS Requirement</title>
-        <para>
-            If you do not use SSL/HTTPS for all communication between the Keycloak auth server and the clients it secures
-            you will be very vulnerable to man in the middle attacks.  OAuth 2.0/OpenID Connect uses access tokens for
-            security.  Without SSL/HTTPS, attackers can sniff your network and obtain an access token.  Once they have an
-            access token they can do any operation that the token has been given permission for.
-        </para>
-        <para>
-            Keycloak has <link linkend="ssl_modes">three modes for SSL/HTTPS</link>.  SSL can be hard to set up, so out of the box, Keycloak allows
-            non-HTTPS communication over private IP addresses like localhost, 192.168.x.x, and other private IP addresses.
-            In production, you should make sure SSL is enabled and required across the board.
-        </para>
-        <para>
-            On the adapter/client side, Keycloak allows you to turn off the SSL trust manager.  The trust manager ensures
-            identity the client is talking to.  It checks the DNS domain name against the server's certificate.  In production
-            you should make sure that each of your client adapters is configured to use a truststore.  Otherwise you are vulnerable
-            to DNS man in the middle attacks.
-        </para>
-    </section>
-    <section>
-        <title>CSRF Attacks</title>
-        <para>
-            Cross-site request forgery (CSRF) is a web-based attack whereby HTTP
-            requests are transmitted from a user that the web site trusts or has
-            authenticated (e.g., via HTTP redirects or HTML forms).  Any site that uses
-            cookie based authentication is vulnerable for these types of attacks.  These attacks are mitigated
-            by matching a state cookie against a posted form or query parameter.
-        </para>
-        <para>
-            OAuth 2.0 login specification requires that a state cookie be used and matched against a transmitted state
-            parameter.  Keycloak fully implements this part of the specification so all logins are protected.
-        </para>
-        <para>
-            The Keycloak adminstration console is a pure Javascript/HTML5 application that makes REST calls to the
-            backend Keycloak admin API.  These calls all require bearer token authentication and are made via Javascript
-            Ajax calls.  CSRF does not apply here.  The admin REST API can also be configured to validate CORS origins
-            as well.
-        </para>
-        <para>
-            The only part of Keycloak that really falls into CSRF is the user account management pages.  To mitigate this
-            Keycloak sets a state cookie and also embeds the value of this state cookie within hidden form fields or
-            query parameters in action links.  This query or form parameter is checked against the state cookie to verify
-            that the call was made by the user.
-        </para>
-    </section>
-    <section>
-        <title>Clickjacking</title>
-        <para>
-            With clickjacking, a malicious site loads the target site in a
-            transparent iFrame overlaid on top of a set of dummy
-            buttons that are carefully constructed to be placed directly under
-            important buttons on the target site.  When a user clicks a visible
-            button, they are actually clicking a button (such as an "Authorize"
-            button) on the hidden page.  An attacker can steal a user's authentication credentials and
-            access their resources.
-        </para>
-        <para>
-            By default, every response by Keycloak sets some specific browser headers that can prevent this from happening
-            specifically <ulink url="http://tools.ietf.org/html/rfc7034">X-FRAME_OPTIONS</ulink> and <ulink url="http://www.w3.org/TR/CSP/">Content-Security-Policy</ulink>.  You
-            should take a look at both of these headers.  In the admin console you can specify the values these headers will
-            have.  By default, Keycloak only sets up a same-origin policy for iframes.
-        </para>
-    </section>
-    <section>
-        <title>Compromised Access Codes</title>
-        <para>
-            It would be very hard for an attacker to compromise Keycloak access codes.  Keycloak generates a cryptographically
-            strong random value for its access codes so it would be very hard to guess an access token.
-            An access code can only be turned into an access token once so it can't be replayed.  In the admin console
-            you can specify how long an access token is valid for.  This value should be really short.  Like a seconds.
-            Just long enough for the client to make the request to turn the code into an token.
-        </para>
-    </section>
-    <section>
-        <title>Compromised access and refresh tokens</title>
-        <para>
-            There's a few things you can do to mitigate access tokens and refresh tokens from being stolen.
-            Most importantly is to enforce SSL/HTTPS communication between Keycloak and its clients and applications.
-            Short lifespans (minutes) for access tokens allows Keycloak to check the validity of a refresh token.  Making
-            sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.
-        </para>
-        <para>
-            If an access token or refresh token is compromised, the first thing you should do is go to the admin console
-            and push a not-before revocation policy to all applications.  This will enforce that any tokens issued
-            prior to that date are now invalid.  You can also disable specific applications, clients, and users if you
-            feel that any one of those entities is completely compromised.
-        </para>
-    </section>
-    <section>
-        <title>Open redirectors</title>
-        <para>
-            An attacker could use the end-user authorization endpoint and the
-            redirect URI parameter to abuse the authorization server as an open
-            redirector.  An open redirector is an endpoint using a parameter to
-            automatically redirect a user agent to the location specified by the
-            parameter value without any validation.  An attacker could utilize a user's trust in an authorization
-            server to launch a phishing attack.
-        </para>
-        <para>
-            Keycloak requires that all registered applications and clients register at least one redirection uri pattern.
-            Any time a client asks Keycloak to perform a redirect (on login or logout for example), Keycloak will
-            check the redirect uri vs. the list of valid registered uri patterns.  It is important that clients and
-            applications register as specific a URI pattern as possible to mitigate open redirector attacks.
-        </para>
-    </section>
-    <section>
-        <title>Password guess: brute force attacks</title>
-        <para>
-            A brute force attack happens when an attacker is trying to guess a user's password.  Keycloak has some
-            limited brute force detection capabilities.  If turned on, a user account will be temporarily disabled
-            if a threshold of login failures is reached.  The downside of this is that this makes Keycloak vulnerable
-            to denial of service attacks.  Eventually we will expand this functionality to take client IP address into
-            account when deciding whether to block a user.
-        </para>
-        <para>
-            Another thing you can do to prevent password guessing is to point a tool like <ulink url="http://fail2ban.org">Fail2Ban</ulink> to the Keycloak
-            server's log file.  Keycloak logs every login failure and client IP address that had the failure.
-        </para>
-        <para>
-            In the admin console, per realm, you can set up a password policy to enforce that users pick hard to guess passwords.
-        </para>
-        <para>
-            Finally, the best way to mitigate against brute force attacks is to require user to set up a one-time-password (OTP).
-        </para>
-    </section>
-    <section>
-        <title>Password database compromised</title>
-        <para>
-            Keycloak does not store passwords in raw text.  It stores a hash of them.  Because of performance reasons,
-            Keycloak only hashes passwords once.  While a human could probably never crack a hashed password, it is very
-            possible that a computer could.  The security community suggests around 20,000 (yes thousand!) hashing iterations
-            to be done to each password.  This number grows every year due to increasing computing power (It was 1000 12 years ago).
-            The problem with this is that password hashing is a huge performance hit as each login would require the entered
-            password to be hashed that many times and compared to the stored hash.  So, its up to the admin to configure the
-            password hash iterations.  This can be done in the admin console password policy configuration.  Again, the default
-            value is 1 as we thought it might be more important for Keycloak to scale out of the box.  There's a lot of
-            other measures admins can do to protect their password databases.
-        </para>
-    </section>
-    <section>
-        <title>SQL Injection attacks</title>
-        <para>
-            At this point in time, there is no knowledge of any SQL injection vulnerabilities in Keycloak
-        </para>
-    </section>
-</chapter>
@@ -404,7 +404,7 @@ keycloak-war-dist-all-&project.version;/
 ]]>
 </programlisting>
        </section>
-        <section id="ssl_modes">
+        <section>
            <title>SSL/HTTPS Requirement/Modes</title>
            <warning>
                <para>
@@ -625,74 +625,29 @@ keycloak-war-dist-all-&project.version;/
                    <literal>X-Forwarded-Proto</literal> headers on the requests made to Keycloak. Next you need to enable
                    <literal>proxy-address-forwarding</literal> on the Keycloak http connector. Assuming that your reverse
                    proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to.
+                    This is done by editing <literal>standalone/configuration/standalone.xml</literal>.
                </para>
-
-                <section>
-                    <title>WildFly</title>
-
-                    <para>
-                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
-                    </para>
-
-                    <para>
-                        First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to
-                        the <literal>http-listener</literal> element:
+                First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to the <literal>http-listener</literal>
+                element:
+                <para>
 <programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:undertow:1.1">
    ...
-    <http-listener name="default" socket-binding="http"
-        proxy-address-forwarding="true" redirect-socket="proxy-https"/>
+    <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
    ...
 </subsystem>
 ]]></programlisting>
-                    </para>
-                    <para>
-                        Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
+                Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
 <programlisting><![CDATA[
-<socket-binding-group name="standard-sockets" default-interface="public"
-    port-offset="${jboss.socket.binding.port-offset:0}">
+<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
    ...
    <socket-binding name="proxy-https" port="443"/>
    ...
 </socket-binding-group>
 ]]></programlisting>
-                    </para>
-                    <para>
-                        Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
-                    </para>
-                </section>
-
-                <section>
-                    <title>AS7/EAP</title>
-
-                    <para>
-                        Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
-                    </para>
-
-                    <para>
-                        You need to add <literal>redirect-port</literal> to http <literal>connector</literal> element and
-                        add the <literal>RemoteIpValve</literal> valve:
-<programlisting><![CDATA[
-<subsystem xmlns="urn:jboss:domain:web:1.5"
-    default-virtual-server="default-host" native="false">
-    <connector name="http" protocol="HTTP/1.1" scheme="http"
-        socket-binding="http"
-        redirect-port="443"/>
-    <virtual-server name="default-host" enable-welcome-root="true">
-        <alias name="localhost"/>
-        <alias name="example.com"/>
-    </virtual-server>
-    <valve name="remoteipvalve" module="org.jboss.as.web"
-        class-name="org.apache.catalina.valves.RemoteIpValve">
-        <param param-name="protocolHeader" param-value="x-forwarded-proto"/>
-    </valve>
-</subsystem>
-]]></programlisting>
-                    </para>
-
-
-
-                </section>
-
+                </para>
+                <para>
+                    Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
+                </para>
            </section>

            <section>
@@ -6,38 +6,12 @@
        and feel of end-user facing pages so they can be integrated with your brand and applications.
    </para>

-    <section>
-        <title>Theme types</title>
-        <para>
-            There are several types of themes in Keycloak:
-            <itemizedlist>
-                <listitem>Account - Account management</listitem>
-                <listitem>Admin - Admin console</listitem>
-                <listitem>Common - Shared resources for themes</listitem>
-                <listitem>Email - Emails</listitem>
-                <listitem>Login - Login forms</listitem>
-                <listitem>Welcome - Welcome pages</listitem>
-            </itemizedlist>
-        </para>
-    </section>
-
    <section>
        <title>Configure theme</title>
        <para>
-            All theme types, except welcome, is configured through <literal>Keycloak Admin Console</literal>. To change
-            the theme used for a realm open the open the <literal>Keycloak Admin Console</literal>, select your realm
+            To configure the theme used by a realm open the <literal>Keycloak Admin Console</literal>, select your realm
            from the drop-down box in the top left corner. Under <literal>Settings</literal> click on <literal>Theme</literal>.
        </para>
-        <para>
-            To change the welcome theme you need to edit <literal>standalone/configuration/keycloak-server.json</literal>
-            and add <literal>welcomeTheme</literal> to the theme element, for example:
-<programlisting>
-"theme": {
-    ...
-    "welcomeTheme": "custom-theme"
-}
-</programlisting>
-        </para>
    </section>

    <section>
@@ -51,15 +25,26 @@

    <section>
        <title>Creating a theme</title>
+        <para>
+            There are several types of themes in Keycloak:
+            <itemizedlist>
+                <listitem>Account - Account management</listitem>
+                <listitem>Admin - Admin console</listitem>
+                <listitem>Common - Shared resources for themes</listitem>
+                <listitem>Email - Emails</listitem>
+                <listitem>Login - Login forms</listitem>
+            </itemizedlist>
+        </para>
+
        <para>
            A theme consists of:
            <itemizedlist>
-                <listitem><ulink url="http://freemarker.org">FreeMarker</ulink> templates</listitem>
-                <listitem>Stylesheets</listitem>
-                <listitem>Scripts</listitem>
-                <listitem>Images</listitem>
-                <listitem>Message bundles</listitem>
-                <listitem>Theme properties</listitem>
+                <listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
+                <listitem><para>Stylesheets</para></listitem>
+                <listitem><para>Scripts</para></listitem>
+                <listitem><para>Images</para></listitem>
+                <listitem><para>Message bundles</para></listitem>
+                <listitem><para>Theme properties</para></listitem>
            </itemizedlist>
        </para>
        <para>
@@ -147,9 +132,10 @@
        <section>
            <title>Theme SPI</title>
            <para>
-                The Theme SPI allows creating different mechanisms to load themes for the default FreeMarker based
+                The Theme SPI allows creating different mechanisms to providing themes for the default FreeMarker based
                implementations of login forms and account management. To create a theme provider you will need to implement
-                <literal>org.keycloak.freemarker.ThemeProviderFactory</literal> and <literal>org.keycloak.freemarker.ThemeProvider</literal>.
+                <literal>org.keycloak.freemarker.ThemeProvider</literal> and <literal>org.keycloak.freemarker.Theme</literal> in
+                <literal>forms/common-freemarker</literal>.
            </para>
            <para>
                Keycloak comes with two theme providers, one that loads themes from the classpath (used by default themes)
@@ -163,15 +149,12 @@
            <para>
                The Account SPI allows implementing the account management pages using whatever web framework or templating
                engine you want. To create an Account provider implement <literal>org.keycloak.account.AccountProviderFactory</literal>
-                and <literal>org.keycloak.account.AccountProvider</literal>.
+                and <literal>org.keycloak.account.AccountProvider</literal> in <literal>forms/account-api</literal>.
            </para>
            <para>
-                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
-<programlisting>
-"account": {
-    "provider": "custom-provider"
-}
-</programlisting>
+                Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-&project.version;.jar</literal>
+                or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
            </para>
        </section>
        <section>
@@ -182,12 +165,9 @@
                and <literal>org.keycloak.login.LoginFormsProvider</literal> in <literal>forms/login-api</literal>.
            </para>
            <para>
-                Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
-<programlisting>
-"login": {
-    "provider": "custom-provider"
-}
-</programlisting>
+                Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
+                To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-&project.version;.jar</literal>
+                or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
            </para>
        </section>
    </section>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-events-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -35,6 +35,12 @@
            }
        ]
    },
+    "roleMappings": [
+        {
+            "username": "user",
+            "roles": ["user"]
+        }
+    ],
    "scopeMappings": [
        {
            "client": "cordova",
@@ -46,10 +52,17 @@
            "name": "cordova",
            "enabled": true,
            "publicClient": true,
-            "redirectUris": ["http://localhost"],
-            "webOrigins": ["localhost"]
+            "redirectUris": []
        }
    ],
+    "applicationRoleMappings": {
+        "account": [
+            {
+                "username": "user",
+                "roles": ["view-profile", "manage-account"]
+            }
+        ]
+    },
    "applicationScopeMappings": {
        "account": [
            {
@@ -10,5 +10,5 @@

    <gap:plugin name="org.apache.cordova.inappbrowser" />

-    <access origin="*"/>
+    <access origin="http://*"/>
 </widget>
@@ -28,7 +28,7 @@
        }

        document.addEventListener("deviceready", function() {
-            keycloak.init({ onLoad: 'check-sso' }).success(updateState);
+            keycloak.init({ onLoad: 'check-sso' });
        }, false);
    </script>
 </head>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -112,7 +112,7 @@ Next thing you have to do is import the test realm for the demo.  Clicking on th
 create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
 create a new admin password before you can go to the create realm page.

-[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+[http://localhost:8080/auth/admin/index.html#/create/realm](http://localhost:8080/auth/admin/index.html#/create/realm)

 Import the testrealm.json file that is in the preconfigured-demo/ example directory.

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath> 
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Examples</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Listener System.out Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Event Store In-Mem Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-providers-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Properties Authentication Provider Example</name>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>examples-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Provider Examples</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-export-import-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -1,6 +1,5 @@
 package org.keycloak.freemarker;

-import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;

@@ -22,17 +21,17 @@ import java.util.concurrent.ConcurrentHashMap;
 */
 public class ExtendingThemeManager implements ThemeProvider {

-    private static final Logger log = Logger.getLogger(ExtendingThemeManager.class);
-
    private final KeycloakSession session;
    private final ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache;
    private List<ThemeProvider> providers;
    private String defaultTheme;
+    private int staticMaxAge;

    public ExtendingThemeManager(KeycloakSession session, ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache) {
        this.session = session;
        this.themeCache = themeCache;
        this.defaultTheme = Config.scope("theme").get("default", "keycloak");
+        this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge", -1);
    }

    private List<ThemeProvider> getProviders() {
@@ -58,6 +57,10 @@ public class ExtendingThemeManager implements ThemeProvider {
        return providers;
    }

+    public int getStaticMaxAge() {
+        return staticMaxAge;
+    }
+
    @Override
    public int getProviderPriority() {
        return 0;
@@ -74,13 +77,7 @@ public class ExtendingThemeManager implements ThemeProvider {
            Theme theme = themeCache.get(key);
            if (theme == null) {
                theme = loadTheme(name, type);
-                if (theme == null) {
-                    theme = loadTheme("keycloak", type);
-                    if (theme == null) {
-                        theme = loadTheme("base", type);
-                    }
-                    log.errorv("Failed to find {0} theme {1}, using built-in themes", type, name);
-                } else if (themeCache.putIfAbsent(key, theme) != null) {
+                if (themeCache.putIfAbsent(key, theme) != null) {
                    theme = themeCache.get(key);
                }
            }
@@ -92,7 +89,7 @@ public class ExtendingThemeManager implements ThemeProvider {

    private Theme loadTheme(String name, Theme.Type type) throws IOException {
        Theme theme = findTheme(name, type);
-        if (theme != null && theme.getParentName() != null) {
+        if (theme.getParentName() != null) {
            List<Theme> themes = new LinkedList<Theme>();
            themes.add(theme);

@@ -147,11 +144,11 @@ public class ExtendingThemeManager implements ThemeProvider {
                try {
                    return p.getTheme(name, type);
                } catch (IOException e) {
-                    log.errorv(e, p.getClass() + " failed to load theme, type={0}, name={1}", type, name);
+                    throw new RuntimeException("Failed to create " + type.toString().toLowerCase() + " theme", e);
                }
            }
        }
-        return null;
+        throw new RuntimeException(type.toString().toLowerCase() + " theme '" + name + "' not found");
    }

    public static class ExtendingTheme implements Theme {
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${(account.username!'')?html}"/>
+                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${account.username!''}"/>
            </div>
        </div>

@@ -30,7 +30,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="email" name="email" autofocus value="${(account.email!'')?html}"/>
+                <input type="text" class="form-control" id="email" name="email" autofocus value="${account.email!''}"/>
            </div>
        </div>

@@ -41,7 +41,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="lastName" name="lastName" value="${(account.lastName!'')?html}"/>
+                <input type="text" class="form-control" id="lastName" name="lastName" value="${account.lastName!''}"/>
            </div>
        </div>

@@ -51,7 +51,7 @@
            </div>

            <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="firstName" name="firstName" value="${(account.firstName!'')?html}"/>
+                <input type="text" class="form-control" id="firstName" name="firstName" value="${account.firstName!''}"/>
            </div>
        </div>

@@ -38,6 +38,4 @@ socialRedirectError=Failed to redirect to social provider
 socialProviderRemoved=Social provider removed successfully

 accountDisabled=Account is disabled, contact admin\
-accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
-
-logOutAllSessions=Log out all sessions
+accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
@@ -42,6 +42,6 @@

    </table>

-    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">${rb.logOutAllSessions}</a>
+    <a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">Logout all sessions</a>

-</@layout.mainLayout>
+</@layout.mainLayout>
@@ -11,7 +11,7 @@
                    <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" name="email" value="${(user.email!'')?html}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="email" name="email" value="${user.email!''}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -20,7 +20,7 @@
                    <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" name="firstName" value="${(user.firstName!'')?html}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="firstName" name="firstName" value="${user.firstName!''}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -29,7 +29,7 @@
                    <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" name="lastName" value="${(user.lastName!'')?html}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="lastName" name="lastName" value="${user.lastName!''}" class="${properties.kcInputClass!}" />
                </div>
            </div>

@@ -21,7 +21,7 @@
                    </div>

                    <div class="${properties.kcInputWrapperClass!}">
-                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')?html}" type="text" autofocus />
+                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${login.username!''}" type="text" autofocus />
                    </div>
                </div>

@@ -11,7 +11,7 @@
                    <label for="username" class="${properties.kcLabelClass!}">${rb.username}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${(register.formData.username!'')?html}" />
+                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${register.formData.username!''}" />
                </div>
            </div>

@@ -20,7 +20,7 @@
                    <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${(register.formData.firstName!'')?html}" />
+                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${register.formData.firstName!''}" />
                </div>
            </div>

@@ -29,7 +29,7 @@
                    <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${(register.formData.lastName!'')?html}" />
+                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${register.formData.lastName!''}" />
                </div>
            </div>

@@ -38,7 +38,7 @@
                    <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                </div>
                <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${(register.formData.email!'')?html}" />
+                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${register.formData.email!''}" />
                </div>
            </div>

@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-forms-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-forms-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -5,7 +5,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -2,10 +2,8 @@ package org.keycloak.admin.client.resource;

 import org.keycloak.representations.idm.RealmRepresentation;

-import javax.ws.rs.Consumes;
 import javax.ws.rs.DELETE;
 import javax.ws.rs.GET;
-import javax.ws.rs.PUT;
 import javax.ws.rs.Path;
 import javax.ws.rs.Produces;
 import javax.ws.rs.core.MediaType;
@@ -19,10 +17,6 @@ public interface RealmResource {
    @Produces(MediaType.APPLICATION_JSON)
    public RealmRepresentation toRepresentation();

-    @PUT
-    @Consumes(MediaType.APPLICATION_JSON)
-    public void update(RealmRepresentation realmRepresentation);
-
    @Path("applications")
    public ApplicationsResource applications();

@@ -20,7 +20,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -64,8 +64,7 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
            if (session != null) {
                session.removeNote(KeycloakSecurityContext.class.getName());
                if (ksc instanceof RefreshableKeycloakSecurityContext) {
-                    CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
-                    ((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.resolveDeployment(facade));
+                    ((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.getDeployment());
                }
            }
        }
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -3,7 +3,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Integration</name>
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.0.4.Final</version>
+		<version>1.0.1.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -69,8 +69,7 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
            if (session != null) {
                session.removeNote(KeycloakSecurityContext.class.getName());
                try {
-                    CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
-                    ServerRequest.invokeLogout(deploymentContext.resolveDeployment(facade), ksc.getToken().getSessionState());
+                    ServerRequest.invokeLogout(deploymentContext.getDeployment(), ksc.getToken().getSessionState());
                } catch (Exception e) {
                	log.severe("failed to invoke remote logout. " + e.getMessage());
                }
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -79,8 +79,7 @@ public class ServletKeycloakAuthMech extends UndertowKeycloakAuthMech {
                session.removeAttribute(KeycloakSecurityContext.class.getName());
                session.removeAttribute(KeycloakUndertowAccount.class.getName());
                if (account.getKeycloakSecurityContext() != null) {
-                    UndertowHttpFacade facade = new UndertowHttpFacade(notification.getExchange());
-                    account.getKeycloakSecurityContext().logout(deploymentContext.resolveDeployment(facade));
+                    account.getKeycloakSecurityContext().logout(deploymentContext.getDeployment());
                }
            }
        };
@@ -66,8 +66,7 @@ public abstract class UndertowKeycloakAuthMech implements AuthenticationMechanis
                if (account == null) return;
                session.removeAttribute(KeycloakUndertowAccount.class.getName());
                if (account.getKeycloakSecurityContext() != null) {
-                    UndertowHttpFacade facade = new UndertowHttpFacade(notification.getExchange());
-                    account.getKeycloakSecurityContext().logout(deploymentContext.resolveDeployment(facade));
+                    account.getKeycloakSecurityContext().logout(deploymentContext.getDeployment());
                }
            }
        };
@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -4,7 +4,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.0.4.Final</version>
+        <version>1.0.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>