Set version to 1.9.5.Final

Merge pull request #2893 from stianst/1.9.x
Ignore temperamental test
2016-05-26 17:12:20 +00:00 · 2016-05-26 19:11:22 +02:00 · 2016-05-26 19:10:23 +02:00 · 2016-05-26 17:01:04 +02:00 · 2016-05-26 15:58:01 +02:00 · 2016-05-26 15:01:52 +02:00
764 changed files with 33270 additions and 9324 deletions
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -24,6 +24,7 @@ import org.apache.http.client.HttpClient;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
 import org.apache.http.client.methods.HttpPost;
 import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
@@ -104,6 +105,7 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
        int status = response.getStatusLine().getStatusCode();
        HttpEntity entity = response.getEntity();
        if (status != 200) {
+            EntityUtils.consumeQuietly(entity);
            throw new java.io.IOException("Bad status: " + status);
        }
        if (entity == null) {
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -25,6 +25,7 @@
        var kc = this;
        var adapter;
        var refreshQueue = [];
+        var storage;

        var loginIframe = {
            enable: true,
@@ -35,6 +36,8 @@
        kc.init = function (initOptions) {
            kc.authenticated = false;

+            storage = new PersistentStorage();
+
            if (window.Cordova) {
                adapter = loadAdapter('cordova');
            } else {
@@ -192,7 +195,7 @@
                redirectUri += (redirectUri.indexOf('?') == -1 ? '?' : '&') + 'prompt=' + options.prompt;
            }

-            localStorage.oauthState = JSON.stringify({ state: state, nonce: nonce, redirectUri: encodeURIComponent(redirectUri) });
+            storage.setItem('oauthState', JSON.stringify({ state: state, nonce: nonce, redirectUri: encodeURIComponent(redirectUri) }));

            var action = 'auth';
            if (options && options.action == 'register') {
@@ -689,10 +692,11 @@
        function parseCallback(url) {
            var oauth = new CallbackParser(url, kc.responseMode).parseUri();

-            var sessionState = localStorage.oauthState && JSON.parse(localStorage.oauthState);
+            var oauthState = storage.getItem('oauthState');
+            var sessionState = oauthState && JSON.parse(oauthState);

            if (sessionState && (oauth.code || oauth.error || oauth.access_token || oauth.id_token) && oauth.state && oauth.state == sessionState.state) {
-                delete localStorage.oauthState;
+                storage.removeItem('oauthState');

                oauth.redirectUri = sessionState.redirectUri;
                oauth.storedNonce = sessionState.nonce;
@@ -973,6 +977,82 @@
        }


+        var PersistentStorage = function() {
+            if (!(this instanceof PersistentStorage)) {
+                return new PersistentStorage();
+            }
+            var ps = this;
+            var useCookieStorage = function () {
+                if (typeof localStorage === "undefined") {
+                    return true;
+                }
+                try {
+                    var key = '@@keycloak-session-storage/test';
+                    localStorage.setItem(key, 'test');
+                    localStorage.removeItem(key);
+                    return false;
+                } catch (err) {
+                    // Probably in Safari "private mode" where localStorage
+                    // quota is 0, or quota exceeded. Switching to cookie
+                    // storage.
+                    return true;
+                }
+            }
+
+            ps.setItem = function(key, value) {
+                if (useCookieStorage()) {
+                    setCookie(key, value, cookieExpiration(5));
+                } else {
+                    localStorage.setItem(key, value);
+                }
+            }
+
+            ps.getItem = function(key) {
+                if (useCookieStorage()) {
+                    return getCookie(key);
+                }
+                return localStorage.getItem(key);
+            }
+
+            ps.removeItem = function(key) {
+                if (typeof localStorage !== "undefined") {
+                    try {
+                        // Always try to delete from localStorage.
+                        localStorage.removeItem(key);
+                    } catch (err) { }
+                }
+                // Always remove the cookie.
+                setCookie(key, '', cookieExpiration(-100));
+            }
+
+            var cookieExpiration = function (minutes) {
+                var exp = new Date();
+                exp.setTime(exp.getTime() + (minutes*60*1000));
+                return exp;
+            }
+
+            var getCookie = function (key) {
+                var name = key + '=';
+                var ca = document.cookie.split(';');
+                for (var i = 0; i < ca.length; i++) {
+                    var c = ca[i];
+                    while (c.charAt(0) == ' ') {
+                        c = c.substring(1);
+                    }
+                    if (c.indexOf(name) == 0) {
+                        return c.substring(name.length, c.length);
+                    }
+                }
+                return '';
+            }
+
+            var setCookie = function (key, value, expirationDate) {
+                var cookie = key + '=' + value + '; '
+                    + 'expires=' + expirationDate.toUTCString() + '; ';
+                document.cookie = cookie;
+            }
+        }
+
        var CallbackParser = function(uriToParse, responseMode) {
            if (!(this instanceof CallbackParser)) {
                return new CallbackParser(uriToParse, responseMode);
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -36,15 +36,32 @@
            org.keycloak.adapters.osgi.*
        </keycloak.osgi.export>
        <keycloak.osgi.import>
-            org.ops4j.pax.web.*;version="[3.0,4)",
+            org.ops4j.pax.web.*;version="[3.0,5)",
            javax.servlet.*;version="[2.5,4)";resolution:=optional,
            org.eclipse.jetty.*;version="[8.1,10)";resolution:=optional,
            org.keycloak.*;version="${project.version}",
+            org.apache.cxf.transport.http;resolution:=optional;version="[3,4)",
+            org.apache.cxf.transport.servlet;resolution:=optional;version="[3,4)",
            *;resolution:=optional
        </keycloak.osgi.import>
    </properties>

    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-adapter-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-adapter-spi</artifactId>
+            <scope>provided</scope>
+        </dependency>
        <dependency>
            <groupId>org.jboss.logging</groupId>
            <artifactId>jboss-logging</artifactId>
@@ -65,12 +82,23 @@
            <artifactId>pax-web-runtime</artifactId>
            <scope>provided</scope>
        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-security</artifactId>
            <version>${jetty9.version}</version>
            <scope>provided</scope>
        </dependency>
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http</artifactId>
+            <version>${cxf.version}</version>
+            <scope>provided</scope>
+        </dependency>
    </dependencies>

    <build>
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.osgi;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.keycloak.adapters.KeycloakConfigResolver;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.OIDCHttpFacade;
+
+public class PathBasedKeycloakConfigResolver implements KeycloakConfigResolver {
+
+    private final Map<String, KeycloakDeployment> cache = new ConcurrentHashMap<String, KeycloakDeployment>();
+
+    @Override
+    public KeycloakDeployment resolve(OIDCHttpFacade.Request request) {
+        String path = request.getURI();
+        String[] urlTokens = path.split("/");
+        if (urlTokens.length <  4) {
+            throw new IllegalStateException("Not able to determine the web-context to load the correspondent keycloak.json file");
+        }
+
+        String webContext = urlTokens[3];
+
+        KeycloakDeployment deployment = cache.get(webContext);
+        if (null == deployment) {
+            // not found on the simple cache, try to load it from the file system
+            String keycloakConfig = (String) System.getProperties().get("keycloak.config");
+            if(keycloakConfig == null || "".equals(keycloakConfig.trim())){
+                String karafEtc = (String) System.getProperties().get("karaf.etc");
+                if(karafEtc == null || "".equals(karafEtc.trim())){
+                    throw new IllegalStateException("Neither \"keycloak.config\" nor \"karaf.etc\" java properties are set. Please set one of them.");
+                }
+                keycloakConfig = karafEtc;
+            }
+
+            String absolutePath = keycloakConfig + File.separator + webContext + "-keycloak.json";
+            InputStream is = null;
+            try {
+                is = new FileInputStream(absolutePath);
+            } catch (FileNotFoundException e){
+                throw new IllegalStateException("Not able to find the file " + absolutePath);
+            }
+            deployment = KeycloakDeploymentBuilder.build(is);
+            cache.put(webContext, deployment);
+        }
+
+        return deployment;
+    }
+
+}
@@ -18,15 +18,22 @@
 package org.keycloak.adapters.osgi;

 import java.util.Arrays;
+import java.util.Dictionary;
+import java.util.Enumeration;
 import java.util.Hashtable;
 import java.util.List;
+import java.util.Properties;

 import javax.servlet.Servlet;

+import org.apache.cxf.transport.http.DestinationRegistry;
+import org.apache.cxf.transport.servlet.CXFNonSpringServlet;
 import org.jboss.logging.Logger;
 import org.ops4j.pax.web.service.WebContainer;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.ServiceReference;
+import org.osgi.service.cm.Configuration;
+import org.osgi.service.cm.ConfigurationAdmin;
 import org.osgi.service.http.HttpContext;
 import org.osgi.util.tracker.ServiceTracker;
 import org.osgi.util.tracker.ServiceTrackerCustomizer;
@@ -42,13 +49,15 @@ import org.osgi.util.tracker.ServiceTrackerCustomizer;
 */
 public class ServletReregistrationService {

+    private static final String CXF_SERVLET_PREFIX = "org.apache.cxf.servlet.";
    protected static final Logger log = Logger.getLogger(ServletReregistrationService.class);

    private static final List<String> FILTERED_PROPERTIES = Arrays.asList("objectClass", "service.id");

    private BundleContext bundleContext;
-    private ServiceReference servletReference;
+    private ServiceReference managedServiceReference;
    private ServiceTracker webContainerTracker;
+    private String alias;

    public BundleContext getBundleContext() {
        return bundleContext;
@@ -58,24 +67,18 @@ public class ServletReregistrationService {
        this.bundleContext = bundleContext;
    }

-    public ServiceReference getServletReference() {
-        return servletReference;
-    }
-
-    public void setServletReference(ServiceReference servletReference) {
-        this.servletReference = servletReference;
-    }
-
-    protected ServiceTracker getWebContainerTracker() {
-        return webContainerTracker;
-    }

    public void start() {
-        if (servletReference == null) {
-            throw new IllegalStateException("No servlet reference provided");
+        if ( managedServiceReference == null) {
+            return;
+        }
+
+        Dictionary properties = obtainProperties();
+        alias = (String)getProp(properties, CXF_SERVLET_PREFIX + "context", "/cxf");
+        if(alias == null){
+            alias = "/cxf";
        }

-        final Servlet servlet = (Servlet) bundleContext.getService(servletReference);
        WebContainer externalWebContainer = findExternalWebContainer();
        if (externalWebContainer == null) {
            return;
@@ -83,18 +86,19 @@ public class ServletReregistrationService {

        // Unregister servlet from external container now
        try {
-            externalWebContainer.unregisterServlet(servlet);
+            externalWebContainer.unregister(alias);
            log.debug("Original servlet with alias " + getAlias() + " unregistered successfully from external web container.");
        } catch (IllegalStateException e) {
            log.warn("Can't unregister servlet due to: " + e.getMessage());
        }

+        final Dictionary finalProperties = properties;
        ServiceTrackerCustomizer trackerCustomizer = new ServiceTrackerCustomizer() {

            @Override
            public Object addingService(ServiceReference webContainerServiceReference) {
                WebContainer ourWebContainer = (WebContainer) bundleContext.getService(webContainerServiceReference);
-                registerServlet(ourWebContainer, servlet);
+                registerServlet(ourWebContainer, finalProperties);
                log.debugv("Servlet with alias " + getAlias() + " registered to secured web container");
                return ourWebContainer;
            }
@@ -122,28 +126,82 @@ public class ServletReregistrationService {

        // Re-register servlet back to original context
        WebContainer externalWebContainer = findExternalWebContainer();
-        Servlet servlet = (Servlet) bundleContext.getService(servletReference);
-        registerServlet(externalWebContainer, servlet);
+        registerServlet(externalWebContainer,  obtainProperties());
        log.debug("Servlet with alias " + getAlias() + " registered back to external web container");
    }

    private String getAlias() {
-        return (String) servletReference.getProperty("alias");
+        return alias;
    }

-    protected void registerServlet(WebContainer webContainer, Servlet servlet) {
+    /**
+     * Code comes from org.apache.cxf.transport.http.osgi.ServletExporter#updated(java.util.Dictionary)
+     * @param webContainer
+     * @param properties
+     */
+    protected void registerServlet(WebContainer webContainer, Dictionary properties) {
+        HttpContext httpContext = webContainer.createDefaultHttpContext();
+
+        ServiceReference destinationServiceServiceReference = bundleContext.getServiceReference("org.apache.cxf.transport.http.DestinationRegistry");
+        DestinationRegistry destinationRegistry = (DestinationRegistry) bundleContext.getService(destinationServiceServiceReference);
+
+        Servlet servlet = new CXFNonSpringServlet(destinationRegistry, false);
        try {
+            if (properties == null) {
+                properties = new Properties();
+            }
+            Properties sprops = new Properties();
+            sprops.put("init-prefix",
+                    getProp(properties, CXF_SERVLET_PREFIX + "init-prefix", ""));
+            sprops.put("servlet-name",
+                    getProp(properties, CXF_SERVLET_PREFIX + "name", "cxf-osgi-transport-servlet"));
+            sprops.put("hide-service-list-page",
+                    getProp(properties, CXF_SERVLET_PREFIX + "hide-service-list-page", "false"));
+            sprops.put("disable-address-updates",
+                    getProp(properties, CXF_SERVLET_PREFIX + "disable-address-updates", "true"));
+            sprops.put("base-address",
+                    getProp(properties, CXF_SERVLET_PREFIX + "base-address", ""));
+            sprops.put("service-list-path",
+                    getProp(properties, CXF_SERVLET_PREFIX + "service-list-path", ""));
+            sprops.put("static-resources-list",
+                    getProp(properties, CXF_SERVLET_PREFIX + "static-resources-list", ""));
+            sprops.put("redirects-list",
+                    getProp(properties, CXF_SERVLET_PREFIX + "redirects-list", ""));
+            sprops.put("redirect-servlet-name",
+                    getProp(properties, CXF_SERVLET_PREFIX + "redirect-servlet-name", ""));
+            sprops.put("redirect-servlet-path",
+                    getProp(properties, CXF_SERVLET_PREFIX + "redirect-servlet-path", ""));
+            sprops.put("service-list-all-contexts",
+                    getProp(properties, CXF_SERVLET_PREFIX + "service-list-all-contexts", ""));
+            sprops.put("service-list-page-authenticate",
+                    getProp(properties, CXF_SERVLET_PREFIX + "service-list-page-authenticate", "false"));
+            sprops.put("service-list-page-authenticate-realm",
+                    getProp(properties, CXF_SERVLET_PREFIX + "service-list-page-authenticate-realm", "karaf"));
+            sprops.put("use-x-forwarded-headers",
+                    getProp(properties, CXF_SERVLET_PREFIX + "use-x-forwarded-headers", "false"));
+
+            // Accept extra properties by default, can be disabled if it is really needed
+            if (Boolean.valueOf(getProp(properties, CXF_SERVLET_PREFIX + "support.extra.properties", "true").toString())) {
+                Enumeration keys = properties.keys();
+                while (keys.hasMoreElements()) {
+                    String nextKey = keys.nextElement().toString();
+                    if (!nextKey.startsWith(CXF_SERVLET_PREFIX)) {
+                        sprops.put(nextKey, properties.get(nextKey));
+                    }
+                }
+            }
+
            Hashtable<String, Object> servletInitParams = new Hashtable<String, Object>();
-            String[] propNames = servletReference.getPropertyKeys();
-            for (String propName : propNames) {
+            Enumeration keys = sprops.keys();
+
+            while(keys.hasMoreElements()){
+                String propName = (String) keys.nextElement();
                if (!FILTERED_PROPERTIES.contains(propName)) {
-                    servletInitParams.put(propName, servletReference.getProperty(propName));
+                    servletInitParams.put(propName, sprops.getProperty(propName));
                }
            }

            // Try to register servlet in given web container now
-            HttpContext httpContext = webContainer.createDefaultHttpContext();
-            String alias = (String) servletReference.getProperty("alias");
            webContainer.registerServlet(alias, servlet, servletInitParams, httpContext);
        } catch (Exception e) {
            log.error("Can't register servlet in web container", e);
@@ -156,7 +214,7 @@ public class ServletReregistrationService {
     * @return web container or null
     */
    protected WebContainer findExternalWebContainer() {
-        BundleContext servletBundleContext = servletReference.getBundle().getBundleContext();
+        BundleContext servletBundleContext = managedServiceReference.getBundle().getBundleContext();
        ServiceReference webContainerReference = servletBundleContext.getServiceReference(WebContainer.class.getName());
        if (webContainerReference == null) {
            log.warn("Not found webContainer reference for bundle " + servletBundleContext);
@@ -166,4 +224,32 @@ public class ServletReregistrationService {
        }
    }

+    private Dictionary obtainProperties(){
+        Dictionary properties = null;
+        ServiceReference reference = bundleContext.getServiceReference(ConfigurationAdmin.class.getName());
+        ConfigurationAdmin admin = (ConfigurationAdmin) bundleContext.getService(reference);
+        try {
+            Configuration configuration = admin.getConfiguration("org.apache.cxf.osgi");
+            properties = configuration.getProperties();
+        } catch (Exception e){
+            log.warn("Unable to obtain cxf osgi configadmin reference.", e);
+        }
+        return properties;
+    }
+
+    private Object getProp(Dictionary properties, String key, Object defaultValue) {
+        Object value = null;
+        if(properties != null){
+            value = properties.get(key);
+        }
+        return value == null ? defaultValue : value;
+    }
+
+    public ServiceReference getManagedServiceReference() {
+        return managedServiceReference;
+    }
+
+    public void setManagedServiceReference(ServiceReference managedServiceReference) {
+        this.managedServiceReference = managedServiceReference;
+    }
 }
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>1.9.2.Final</version>
+    <version>1.9.5.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -45,6 +45,7 @@ public class Constants {
        static final String KEY_STORE = "KeyStore";
        static final String SIGN_REQUEST = "signRequest";
        static final String VALIDATE_RESPONSE_SIGNATURE = "validateResponseSignature";
+        static final String VALIDATE_ASSERTION_SIGNATURE = "validateAssertionSignature";
        static final String REQUEST_BINDING = "requestBinding";
        static final String BINDING_URL = "bindingUrl";
        static final String VALIDATE_REQUEST_SIGNATURE = "validateRequestSignature";
@@ -97,6 +98,7 @@ public class Constants {
        static final String CERTIFICATE_ALIAS = "alias";
        static final String SIGN_REQUEST = "signRequest";
        static final String VALIDATE_RESPONSE_SIGNATURE = "validateResponseSignature";
+        static final String VALIDATE_ASSERTION_SIGNATURE = "validateAssertionSignature";
        static final String REQUEST_BINDING = "requestBinding";
        static final String BINDING_URL = "bindingUrl";
        static final String VALIDATE_REQUEST_SIGNATURE = "validateRequestSignature";
@@ -37,6 +37,11 @@ abstract class SingleSignOnDefinition {
                    .setXmlName(Constants.XML.VALIDATE_RESPONSE_SIGNATURE)
                    .build();

+    static final SimpleAttributeDefinition VALIDATE_ASSERTION_SIGNATURE =
+            new SimpleAttributeDefinitionBuilder(Constants.Model.VALIDATE_ASSERTION_SIGNATURE, ModelType.BOOLEAN, true)
+                    .setXmlName(Constants.XML.VALIDATE_ASSERTION_SIGNATURE)
+                    .build();
+
    static final SimpleAttributeDefinition REQUEST_BINDING =
            new SimpleAttributeDefinitionBuilder(Constants.Model.REQUEST_BINDING, ModelType.STRING, true)
                    .setXmlName(Constants.XML.REQUEST_BINDING)
@@ -52,7 +57,7 @@ abstract class SingleSignOnDefinition {
                    .setXmlName(Constants.XML.BINDING_URL)
                    .build();

-    static final SimpleAttributeDefinition[] ATTRIBUTES = {SIGN_REQUEST, VALIDATE_RESPONSE_SIGNATURE, REQUEST_BINDING, RESPONSE_BINDING, BINDING_URL};
+    static final SimpleAttributeDefinition[] ATTRIBUTES = {SIGN_REQUEST, VALIDATE_RESPONSE_SIGNATURE, VALIDATE_ASSERTION_SIGNATURE, REQUEST_BINDING, RESPONSE_BINDING, BINDING_URL};

    static final HashMap<String, SimpleAttributeDefinition> ATTRIBUTE_MAP = new HashMap<>();

@@ -67,6 +67,7 @@ keycloak-saml.IDP.signatureCanonicalizationMethod=Signature canonicalization met
 keycloak-saml.IDP.SingleSignOnService=Single sign-on configuration
 keycloak-saml.IDP.SingleSignOnService.signRequest=Sign SSO requests
 keycloak-saml.IDP.SingleSignOnService.validateResponseSignature=Validate an SSO response signature
+keycloak-saml.IDP.SingleSignOnService.validateAssertionSignature=Validate an SSO assertion signature
 keycloak-saml.IDP.SingleSignOnService.requestBinding=HTTP method to use for requests
 keycloak-saml.IDP.SingleSignOnService.responseBinding=HTTP method to use for responses
 keycloak-saml.IDP.SingleSignOnService.bindingUrl=SSO endpoint URL
@@ -132,6 +132,11 @@
                <xs:documentation>Validate the SSO response signature</xs:documentation>
            </xs:annotation>
        </xs:attribute>
+        <xs:attribute name="validateAssertionSignature" type="xs:boolean" use="optional">
+            <xs:annotation>
+                <xs:documentation>Validate the SSO assertion signature</xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
        <xs:attribute name="requestBinding" type="xs:string" use="optional">
            <xs:annotation>
                <xs:documentation>HTTP method to use for requests</xs:documentation>
@@ -42,6 +42,7 @@
            <IDP entityID="idp">
                <SingleSignOnService signRequest="true"
                                     validateResponseSignature="true"
+                                     validateAssertionSignature="true"
                                     requestBinding="POST"
                                     bindingUrl="http://localhost:8080/auth/realms/saml-demo/protocol/saml"/>
                <SingleLogoutService
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -34,6 +34,7 @@ public class DefaultSamlDeployment implements SamlDeployment {
    public static class DefaultSingleSignOnService implements IDP.SingleSignOnService {
        private boolean signRequest;
        private boolean validateResponseSignature;
+        private boolean validateAssertionSignature;
        private Binding requestBinding;
        private Binding responseBinding;
        private String requestBindingUrl;
@@ -48,6 +49,11 @@ public class DefaultSamlDeployment implements SamlDeployment {
            return validateResponseSignature;
        }

+        @Override
+        public boolean validateAssertionSignature() {
+            return validateAssertionSignature;
+        }
+
        @Override
        public Binding getRequestBinding() {
            return requestBinding;
@@ -71,6 +77,10 @@ public class DefaultSamlDeployment implements SamlDeployment {
            this.validateResponseSignature = validateResponseSignature;
        }

+        public void setValidateAssertionSignature(boolean validateAssertionSignature) {
+            this.validateAssertionSignature = validateAssertionSignature;
+        }
+
        public void setRequestBinding(Binding requestBinding) {
            this.requestBinding = requestBinding;
        }
@@ -50,6 +50,7 @@ public interface SamlDeployment {
        public interface SingleSignOnService {
            boolean signRequest();
            boolean validateResponseSignature();
+            boolean validateAssertionSignature();
            Binding getRequestBinding();
            Binding getResponseBinding();
            String getRequestBindingUrl();
@@ -33,6 +33,7 @@ public class IDP implements Serializable {
        private String requestBinding;
        private String responseBinding;
        private String bindingUrl;
+        private boolean validateAssertionSignature;

        public boolean isSignRequest() {
            return signRequest;
@@ -50,6 +51,14 @@ public class IDP implements Serializable {
            this.validateResponseSignature = validateResponseSignature;
        }

+        public boolean isValidateAssertionSignature() {
+            return validateAssertionSignature;
+        }
+
+        public void setValidateAssertionSignature(boolean validateAssertionSignature) {
+            this.validateAssertionSignature = validateAssertionSignature;
+        }
+
        public String getRequestBinding() {
            return requestBinding;
        }
@@ -68,6 +68,7 @@ public class ConfigXmlConstants {
    public static final String RESPONSE_BINDING_ATTR = "responseBinding";
    public static final String BINDING_URL_ATTR = "bindingUrl";
    public static final String VALIDATE_RESPONSE_SIGNATURE_ATTR = "validateResponseSignature";
+    public static final String VALIDATE_ASSERTION_SIGNATURE_ATTR = "validateAssertionSignature";
    public static final String VALIDATE_REQUEST_SIGNATURE_ATTR = "validateRequestSignature";
    public static final String POST_BINDING_URL_ATTR = "postBindingUrl";
    public static final String REDIRECT_BINDING_URL_ATTR = "redirectBindingUrl";
@@ -149,6 +149,7 @@ public class DeploymentBuilder {
        }
        sso.setSignRequest(sp.getIdp().getSingleSignOnService().isSignRequest());
        sso.setValidateResponseSignature(sp.getIdp().getSingleSignOnService().isValidateResponseSignature());
+        sso.setValidateAssertionSignature(sp.getIdp().getSingleSignOnService().isValidateAssertionSignature());

        slo.setSignRequest(sp.getIdp().getSingleLogoutService().isSignRequest());
        slo.setSignResponse(sp.getIdp().getSingleLogoutService().isSignResponse());
@@ -106,6 +106,7 @@ public class IDPXmlParser extends AbstractParser {
        StartElement element = StaxParserUtil.getNextStartElement(xmlEventReader);
        sso.setSignRequest(SPXmlParser.getBooleanAttributeValue(element, ConfigXmlConstants.SIGN_REQUEST_ATTR, signaturesRequired));
        sso.setValidateResponseSignature(SPXmlParser.getBooleanAttributeValue(element, ConfigXmlConstants.VALIDATE_RESPONSE_SIGNATURE_ATTR, signaturesRequired));
+        sso.setValidateAssertionSignature(SPXmlParser.getBooleanAttributeValue(element, ConfigXmlConstants.VALIDATE_ASSERTION_SIGNATURE_ATTR));
        sso.setRequestBinding(SPXmlParser.getAttributeValue(element, ConfigXmlConstants.REQUEST_BINDING_ATTR));
        sso.setResponseBinding(SPXmlParser.getAttributeValue(element, ConfigXmlConstants.RESPONSE_BINDING_ATTR));
        sso.setBindingUrl(SPXmlParser.getAttributeValue(element, ConfigXmlConstants.BINDING_URL_ATTR));
@@ -201,7 +201,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                        return AuthOutcome.FAILED;
                    }
                }
-                return handleLoginResponse((ResponseType) statusResponse, onCreateSession);
+                return handleLoginResponse((ResponseType) statusResponse, postBinding, onCreateSession);
            } finally {
                sessionStore.setCurrentAction(SamlSessionStore.CurrentAction.NONE);
            }
@@ -272,8 +272,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
        return false;
    }

-    protected AuthOutcome handleLoginResponse(ResponseType responseType, OnSessionCreated onCreateSession) {
-
+    protected AuthOutcome handleLoginResponse(ResponseType responseType, boolean postBinding, OnSessionCreated onCreateSession) {
        AssertionType assertion = null;
        try {
            assertion = AssertionUtil.getAssertion(responseType, deployment.getDecryptionKey());
@@ -298,6 +297,32 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
            };
        }

+        if (deployment.getIDP().getSingleSignOnService().validateAssertionSignature()) {
+            try {
+                validateSamlSignature(new SAMLDocumentHolder(AssertionUtil.asDocument(assertion)), postBinding, GeneralConstants.SAML_RESPONSE_KEY);
+            } catch (VerificationException e) {
+                log.error("Failed to verify saml assertion signature", e);
+
+                challenge = new AuthChallenge() {
+                    @Override
+                    public boolean challenge(HttpFacade exchange) {
+                        SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.INVALID_SIGNATURE);
+                        exchange.getRequest().setError(error);
+                        exchange.getResponse().sendError(403);
+                        return true;
+                    }
+
+                    @Override
+                    public int getResponseCode() {
+                        return 403;
+                    }
+                };
+                return AuthOutcome.FAILED;
+            } catch (ProcessingException e) {
+                e.printStackTrace();
+            }
+        }
+
        SubjectType subject = assertion.getSubject();
        SubjectType.STSubType subType = subject.getSubType();
        NameIDType subjectNameID = (NameIDType) subType.getBaseID();
@@ -79,11 +79,11 @@ public class WebBrowserSsoAuthenticationHandler extends AbstractSamlAuthenticati
        builder.issuer(issuerURL);
        BaseSAML2BindingBuilder binding = new BaseSAML2BindingBuilder().relayState(relayState);
        if (deployment.getIDP().getSingleLogoutService().signResponse()) {
+            if (deployment.getSignatureCanonicalizationMethod() != null)
+                binding.canonicalizationMethod(deployment.getSignatureCanonicalizationMethod());
            binding.signatureAlgorithm(deployment.getSignatureAlgorithm())
                    .signWith(deployment.getSigningKeyPair())
                    .signDocument();
-            if (deployment.getSignatureCanonicalizationMethod() != null)
-                binding.canonicalizationMethod(deployment.getSignatureCanonicalizationMethod());
        }


@@ -110,6 +110,9 @@ public class WebBrowserSsoAuthenticationHandler extends AbstractSamlAuthenticati
                .destination(deployment.getIDP().getSingleLogoutService().getRequestBindingUrl());
        BaseSAML2BindingBuilder binding = new BaseSAML2BindingBuilder();
        if (deployment.getIDP().getSingleLogoutService().signRequest()) {
+            if (deployment.getSignatureCanonicalizationMethod() != null)
+                binding.canonicalizationMethod(deployment.getSignatureCanonicalizationMethod());
+            binding.signatureAlgorithm(deployment.getSignatureAlgorithm());
            binding.signWith(deployment.getSigningKeyPair())
                    .signDocument();
        }
@@ -112,6 +112,7 @@
    <xs:complexType name="sign-on-type">
        <xs:attribute name="signRequest" type="xs:boolean" use="optional"/>
        <xs:attribute name="validateResponseSignature" type="xs:boolean" use="optional"/>
+        <xs:attribute name="validateAssertionSignature" type="xs:boolean" use="optional"/>
        <xs:attribute name="requestBinding" type="xs:string" use="optional"/>
        <xs:attribute name="responseBinding" type="xs:string" use="optional"/>
        <xs:attribute name="bindingUrl" type="xs:string" use="optional"/>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Wildfly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -45,6 +45,7 @@ public class Constants {
        static final String KEY_STORE = "KeyStore";
        static final String SIGN_REQUEST = "signRequest";
        static final String VALIDATE_RESPONSE_SIGNATURE = "validateResponseSignature";
+        static final String VALIDATE_ASSERTION_SIGNATURE = "validateAssertionSignature";
        static final String REQUEST_BINDING = "requestBinding";
        static final String BINDING_URL = "bindingUrl";
        static final String VALIDATE_REQUEST_SIGNATURE = "validateRequestSignature";
@@ -97,6 +98,7 @@ public class Constants {
        static final String CERTIFICATE_ALIAS = "alias";
        static final String SIGN_REQUEST = "signRequest";
        static final String VALIDATE_RESPONSE_SIGNATURE = "validateResponseSignature";
+        static final String VALIDATE_ASSERTION_SIGNATURE = "validateAssertionSignature";
        static final String REQUEST_BINDING = "requestBinding";
        static final String BINDING_URL = "bindingUrl";
        static final String VALIDATE_REQUEST_SIGNATURE = "validateRequestSignature";
@@ -37,6 +37,11 @@ abstract class SingleSignOnDefinition {
                    .setXmlName(Constants.XML.VALIDATE_RESPONSE_SIGNATURE)
                    .build();

+    static final SimpleAttributeDefinition VALIDATE_ASSERTION_SIGNATURE =
+            new SimpleAttributeDefinitionBuilder(Constants.Model.VALIDATE_ASSERTION_SIGNATURE, ModelType.BOOLEAN, true)
+                    .setXmlName(Constants.XML.VALIDATE_ASSERTION_SIGNATURE)
+                    .build();
+
    static final SimpleAttributeDefinition REQUEST_BINDING =
            new SimpleAttributeDefinitionBuilder(Constants.Model.REQUEST_BINDING, ModelType.STRING, true)
                    .setXmlName(Constants.XML.REQUEST_BINDING)
@@ -52,7 +57,7 @@ abstract class SingleSignOnDefinition {
                    .setXmlName(Constants.XML.BINDING_URL)
                    .build();

-    static final SimpleAttributeDefinition[] ATTRIBUTES = {SIGN_REQUEST, VALIDATE_RESPONSE_SIGNATURE, REQUEST_BINDING, RESPONSE_BINDING, BINDING_URL};
+    static final SimpleAttributeDefinition[] ATTRIBUTES = {SIGN_REQUEST, VALIDATE_RESPONSE_SIGNATURE, VALIDATE_ASSERTION_SIGNATURE, REQUEST_BINDING, RESPONSE_BINDING, BINDING_URL};

    static final HashMap<String, SimpleAttributeDefinition> ATTRIBUTE_MAP = new HashMap<>();

@@ -67,6 +67,7 @@ keycloak-saml.IDP.signatureCanonicalizationMethod=Signature canonicalization met
 keycloak-saml.IDP.SingleSignOnService=Single sign-on configuration
 keycloak-saml.IDP.SingleSignOnService.signRequest=Sign SSO requests
 keycloak-saml.IDP.SingleSignOnService.validateResponseSignature=Validate an SSO response signature
+keycloak-saml.IDP.SingleSignOnService.validateAssertionSignature=Validate an SSO assertion signature
 keycloak-saml.IDP.SingleSignOnService.requestBinding=HTTP method to use for requests
 keycloak-saml.IDP.SingleSignOnService.responseBinding=HTTP method to use for responses
 keycloak-saml.IDP.SingleSignOnService.bindingUrl=SSO endpoint URL
@@ -132,6 +132,11 @@
                <xs:documentation>Validate the SSO response signature</xs:documentation>
            </xs:annotation>
        </xs:attribute>
+        <xs:attribute name="validateAssertionSignature" type="xs:boolean" use="optional">
+            <xs:annotation>
+                <xs:documentation>Validate the SSO assertion signature</xs:documentation>
+            </xs:annotation>
+        </xs:attribute>
        <xs:attribute name="requestBinding" type="xs:string" use="optional">
            <xs:annotation>
                <xs:documentation>HTTP method to use for requests</xs:documentation>
@@ -42,6 +42,7 @@
            <IDP entityID="idp" signaturesRequired="true" signatureAlgorithm="test" signatureCanonicalizationMethod="test" encryption="test">
                <SingleSignOnService signRequest="true"
                                     validateResponseSignature="true"
+                                     validateAssertionSignature="true"
                                     requestBinding="POST"
                                     responseBinding="POST"
                                     bindingUrl="http://localhost:8080/auth/realms/saml-demo/protocol/saml"/>
@@ -44,6 +44,7 @@
            <IDP entityID="idp" signaturesRequired="true" signatureAlgorithm="test" signatureCanonicalizationMethod="test">
                <SingleSignOnService signRequest="true"
                                     validateResponseSignature="true"
+                                     validateAssertionSignature="true"
                                     requestBinding="POST"
                                     responseBinding="POST"
                                     bindingUrl="http://localhost:8080/auth/realms/saml-demo/protocol/saml"/>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Client Adapter SPI Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -24,7 +24,11 @@ package org.keycloak.common;
 * @version $Revision: 1 $
 */
 public interface ClientConnection {
+
    String getRemoteAddr();
    String getRemoteHost();
-    int getReportPort();
+    int getRemotePort();
+
+    String getLocalAddr();
+    int getLocalPort();
 }
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -30,7 +30,7 @@ public class PartialImportRepresentation {
    public enum Policy { SKIP, OVERWRITE, FAIL };

    protected Policy policy = Policy.FAIL;
-    protected String ifResourceExists = "";
+    protected String ifResourceExists;
    protected List<UserRepresentation> users;
    protected List<GroupRepresentation> groups;
    protected List<ClientRepresentation> clients;
@@ -67,7 +67,7 @@ public class PartialImportRepresentation {

    public void setIfResourceExists(String ifResourceExists) {
        this.ifResourceExists = ifResourceExists;
-        this.policy = Policy.valueOf(ifResourceExists);
+        this.policy = ifResourceExists != null ? Policy.valueOf(ifResourceExists) : null;
    }

    public Policy getPolicy() {
@@ -264,13 +264,22 @@ public class RealmRepresentation {
        return scopeMappings;
    }

-    public ScopeMappingRepresentation scopeMapping(String username) {
+    public ScopeMappingRepresentation clientScopeMapping(String clientName) {
        ScopeMappingRepresentation mapping = new ScopeMappingRepresentation();
-        mapping.setClient(username);
+        mapping.setClient(clientName);
        if (scopeMappings == null) scopeMappings = new ArrayList<ScopeMappingRepresentation>();
        scopeMappings.add(mapping);
        return mapping;
    }
+
+    public ScopeMappingRepresentation clientTemplateScopeMapping(String clientTemplateName) {
+        ScopeMappingRepresentation mapping = new ScopeMappingRepresentation();
+        mapping.setClientTemplate(clientTemplateName);
+        if (scopeMappings == null) scopeMappings = new ArrayList<ScopeMappingRepresentation>();
+        scopeMappings.add(mapping);
+        return mapping;
+    }
+
    @Deprecated
    public Set<String> getRequiredCredentials() {
        return requiredCredentials;
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.representations.idm;
+
+/**
+ * Some endpoints (like register new required action) doesn't support all the fields (like setEnabled etc).
+ * So this is just simplified version of full RequiredActionProviderRepresentation
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class RequiredActionProviderSimpleRepresentation {
+
+    private String id;
+    private String name;
+    private String providerId;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getProviderId() {
+        return providerId;
+    }
+
+    public void setProviderId(String providerId) {
+        this.providerId = providerId;
+    }
+}
@@ -27,6 +27,7 @@ import java.util.Set;
 public class ScopeMappingRepresentation {
    protected String self; // link
    protected String client;
+    protected String clientTemplate;
    protected Set<String> roles;

    public String getSelf() {
@@ -45,6 +46,14 @@ public class ScopeMappingRepresentation {
        this.client = client;
    }

+    public String getClientTemplate() {
+        return clientTemplate;
+    }
+
+    public void setClientTemplate(String clientTemplate) {
+        this.clientTemplate = clientTemplate;
+    }
+
    public Set<String> getRoles() {
        return roles;
    }
@@ -17,6 +17,7 @@

 package org.keycloak.representations.idm;

+import java.util.List;
 import java.util.Set;

 /**
@@ -25,7 +26,9 @@ import java.util.Set;
 public class UserFederationProviderFactoryRepresentation {

    private String id;
-    private Set<String> options;
+    private Set<String> options; // TODO:Remove as configurable providers are more flexible?
+    private String helpText; // Used for configurable providers
+    private List<ConfigPropertyRepresentation> properties; // Used for configurable providers

    public String getId() {
        return id;
@@ -43,6 +46,22 @@ public class UserFederationProviderFactoryRepresentation {
        this.options = options;
    }

+    public String getHelpText() {
+        return helpText;
+    }
+
+    public void setHelpText(String helpText) {
+        this.helpText = helpText;
+    }
+
+    public List<ConfigPropertyRepresentation> getProperties() {
+        return properties;
+    }
+
+    public void setProperties(List<ConfigPropertyRepresentation> properties) {
+        this.properties = properties;
+    }
+
    @Override
    public boolean equals(Object o) {
        if (this == o) return true;
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.representations.idm;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class UserFederationSyncResultRepresentation {
+
+    private boolean ignored;
+
+    private int added;
+    private int updated;
+    private int removed;
+    private int failed;
+
+    private String status;
+
+    public boolean isIgnored() {
+        return ignored;
+    }
+
+    public void setIgnored(boolean ignored) {
+        this.ignored = ignored;
+    }
+
+    public int getAdded() {
+        return added;
+    }
+
+    public void setAdded(int added) {
+        this.added = added;
+    }
+
+    public int getUpdated() {
+        return updated;
+    }
+
+    public void setUpdated(int updated) {
+        this.updated = updated;
+    }
+
+    public int getRemoved() {
+        return removed;
+    }
+
+    public void setRemoved(int removed) {
+        this.removed = removed;
+    }
+
+    public int getFailed() {
+        return failed;
+    }
+
+    public void setFailed(int failed) {
+        this.failed = failed;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+}
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
    </parent>

    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>1.9.2.Final</version>
+		<version>1.9.5.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -25,7 +25,7 @@
    <parent>
        <artifactId>keycloak-as7-eap6-adapter-dist-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-eap6-adapter-dist-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Adapter Distros</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>1.9.2.Final</version>
+        <version>1.9.5.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>