Set version to 2.5.0.Final

Set version to 2.5.0.Final-SNAPSHOT
Set version to 2.5.0.CR1
2017-01-03 13:18:34 +00:00 · 2016-12-22 06:59:55 +00:00 · 2016-12-22 05:34:53 +00:00 · 2016-12-22 06:16:28 +01:00 · 2016-12-22 06:13:41 +01:00 · 2016-12-22 05:56:27 +01:00
1142 changed files with 33511 additions and 17428 deletions
@@ -16,6 +16,7 @@ env:
    - TESTS=group1
    - TESTS=group2
    - TESTS=group3
+    - TESTS=group4
    - TESTS=adapter

 jdk:
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -342,6 +342,12 @@ public class AdapterDeploymentContext {
            return delegate.getNotBefore();
        }

+        @Override
+        public void updateNotBefore(int notBefore) {
+            delegate.setNotBefore(notBefore);
+            getPublicKeyLocator().reset(this);
+        }
+
        @Override
        public void setExposeToken(boolean exposeToken) {
            delegate.setExposeToken(exposeToken);
@@ -446,6 +452,16 @@ public class AdapterDeploymentContext {
        public int getMinTimeBetweenJwksRequests() {
            return delegate.getMinTimeBetweenJwksRequests();
        }
+
+        @Override
+        public int getPublicKeyCacheTtl() {
+            return delegate.getPublicKeyCacheTtl();
+        }
+
+        @Override
+        public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
+            delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
+        }
    }

    protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {
@@ -46,14 +46,7 @@ public class HttpAdapterUtils {
            }
            InputStream is = entity.getContent();
            try {
-                ByteArrayOutputStream os = new ByteArrayOutputStream();
-                int c;
-                while ((c = is.read()) != -1) {
-                    os.write(c);
-                }
-                byte[] bytes = os.toByteArray();
-                String json = new String(bytes);
-                return JsonSerialization.readValue(json, clazz);
+                return JsonSerialization.readValue(is, clazz);
            } finally {
                try {
                    is.close();
@@ -57,6 +57,7 @@ public class KeycloakDeployment {

    protected String resourceName;
    protected boolean bearerOnly;
+    protected boolean autodetectBearerOnly;
    protected boolean enableBasicAuth;
    protected boolean publicClient;
    protected Map<String, Object> resourceCredentials = new HashMap<>();
@@ -81,6 +82,7 @@ public class KeycloakDeployment {
    protected volatile int notBefore;
    protected int tokenMinimumTimeToLive;
    protected int minTimeBetweenJwksRequests;
+    protected int publicKeyCacheTtl;
    private PolicyEnforcer policyEnforcer;

    public KeycloakDeployment() {
@@ -200,6 +202,14 @@ public class KeycloakDeployment {
        this.bearerOnly = bearerOnly;
    }

+    public boolean isAutodetectBearerOnly() {
+        return autodetectBearerOnly;
+    }
+
+    public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
+        this.autodetectBearerOnly = autodetectBearerOnly;
+    }
+
    public boolean isEnableBasicAuth() {
        return enableBasicAuth;
    }
@@ -328,6 +338,11 @@ public class KeycloakDeployment {
        this.notBefore = notBefore;
    }

+    public void updateNotBefore(int notBefore) {
+        this.notBefore = notBefore;
+        getPublicKeyLocator().reset(this);
+    }
+
    public boolean isAlwaysRefreshToken() {
        return alwaysRefreshToken;
    }
@@ -384,6 +399,14 @@ public class KeycloakDeployment {
        this.minTimeBetweenJwksRequests = minTimeBetweenJwksRequests;
    }

+    public int getPublicKeyCacheTtl() {
+        return publicKeyCacheTtl;
+    }
+
+    public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
+        this.publicKeyCacheTtl = publicKeyCacheTtl;
+    }
+
    public void setPolicyEnforcer(PolicyEnforcer policyEnforcer) {
        this.policyEnforcer = policyEnforcer;
    }
@@ -99,12 +99,14 @@ public class KeycloakDeploymentBuilder {
        }

        deployment.setBearerOnly(adapterConfig.isBearerOnly());
+        deployment.setAutodetectBearerOnly(adapterConfig.isAutodetectBearerOnly());
        deployment.setEnableBasicAuth(adapterConfig.isEnableBasicAuth());
        deployment.setAlwaysRefreshToken(adapterConfig.isAlwaysRefreshToken());
        deployment.setRegisterNodeAtStartup(adapterConfig.isRegisterNodeAtStartup());
        deployment.setRegisterNodePeriod(adapterConfig.getRegisterNodePeriod());
        deployment.setTokenMinimumTimeToLive(adapterConfig.getTokenMinimumTimeToLive());
        deployment.setMinTimeBetweenJwksRequests(adapterConfig.getMinTimeBetweenJwksRequests());
+        deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());

        if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
            throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");
@@ -25,6 +25,7 @@ import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
+import org.keycloak.common.util.Encode;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.constants.AdapterConstants;
@@ -169,7 +170,7 @@ public class OAuthRequestAuthenticator {
        KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, url)
+                .queryParam(OAuth2Constants.REDIRECT_URI, Encode.encodeQueryParamAsIs(url)) // Need to encode uri ourselves as queryParam() will not encode % characters.
                .queryParam(OAuth2Constants.STATE, state)
                .queryParam("login", "true");
        if(loginHint != null && loginHint.length() > 0){
@@ -203,7 +204,7 @@ public class OAuthRequestAuthenticator {

    protected AuthChallenge loginRedirect() {
        final String state = getStateCode();
-        final String redirect = getRedirectUri(state);
+        final String redirect =  getRedirectUri(state);
        if (redirect == null) {
            return challenge(403, OIDCAuthenticationError.Reason.NO_REDIRECT_URI, null);
        }
@@ -357,7 +358,7 @@ public class OAuthRequestAuthenticator {
            return challenge(403, OIDCAuthenticationError.Reason.INVALID_TOKEN, null);
        }
        if (tokenResponse.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.setNotBefore(tokenResponse.getNotBeforePolicy());
+            deployment.updateNotBefore(tokenResponse.getNotBeforePolicy());
        }
        if (token.getIssuedAt() < deployment.getNotBefore()) {
            log.error("Stale token");
@@ -155,7 +155,7 @@ public class PreAuthActionsHandler {
            } else {
                log.debugf("logout of all sessions for application '%s'", action.getResource());
                if (action.getNotBefore() > deployment.getNotBefore()) {
-                    deployment.setNotBefore(action.getNotBefore());
+                    deployment.updateNotBefore(action.getNotBefore());
                }
                userSessionManagement.logoutAll();
            }
@@ -177,7 +177,7 @@ public class PreAuthActionsHandler {
            }
            PushNotBeforeAction action = JsonSerialization.readValue(token.getContent(), PushNotBeforeAction.class);
            if (!validateAction(action)) return;
-            deployment.setNotBefore(action.getNotBefore());
+            deployment.updateNotBefore(action.getNotBefore());
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
@@ -144,7 +144,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
        }

        if (response.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.setNotBefore(response.getNotBeforePolicy());
+            deployment.updateNotBefore(response.getNotBeforePolicy());
        }

        this.token = token;
@@ -17,6 +17,8 @@

 package org.keycloak.adapters;

+import java.util.Collections;
+import java.util.List;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.spi.AuthChallenge;
@@ -116,6 +118,12 @@ public abstract class RequestAuthenticator {
            return AuthOutcome.NOT_ATTEMPTED;
        }

+        if (isAutodetectedBearerOnly(facade.getRequest())) {
+            challenge = bearer.getChallenge();
+            log.debug("NOT_ATTEMPTED: Treating as bearer only");
+            return AuthOutcome.NOT_ATTEMPTED;
+        }
+
        if (log.isTraceEnabled()) {
            log.trace("try oauth");
        }
@@ -158,6 +166,36 @@ public abstract class RequestAuthenticator {
        return false;
    }

+    protected boolean isAutodetectedBearerOnly(HttpFacade.Request request) {
+        if (!deployment.isAutodetectBearerOnly()) return false;
+
+        String headerValue = facade.getRequest().getHeader("X-Requested-With");
+        if (headerValue != null && headerValue.equalsIgnoreCase("XMLHttpRequest")) {
+            return true;
+        }
+
+        headerValue = facade.getRequest().getHeader("Faces-Request");
+        if (headerValue != null && headerValue.startsWith("partial/")) {
+            return true;
+        }
+
+        headerValue = facade.getRequest().getHeader("SOAPAction");
+        if (headerValue != null) {
+            return true;
+        }
+
+        List<String> accepts = facade.getRequest().getHeaders("Accept");
+        if (accepts == null) accepts = Collections.emptyList();
+
+        for (String accept : accepts) {
+            if (accept.contains("text/html") || accept.contains("text/*") || accept.contains("*/*")) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
    protected abstract OAuthRequestAuthenticator createOAuthAuthenticator();

    protected BearerTokenRequestAuthenticator createBearerTokenAuthenticator() {
@@ -17,6 +17,13 @@
 */
 package org.keycloak.adapters.authorization;

+import java.net.URI;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
@@ -32,13 +39,6 @@ import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.Enforce
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;

-import java.net.URI;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
@@ -48,7 +48,7 @@ public abstract class AbstractPolicyEnforcer {
    private final PolicyEnforcerConfig enforcerConfig;
    private final PolicyEnforcer policyEnforcer;

-    private List<PathConfig> paths;
+    private Map<String, PathConfig> paths;
    private AuthzClient authzClient;
    private PathMatcher pathMatcher;

@@ -57,7 +57,7 @@ public abstract class AbstractPolicyEnforcer {
        this.enforcerConfig = policyEnforcer.getEnforcerConfig();
        this.authzClient = policyEnforcer.getClient();
        this.pathMatcher = new PathMatcher();
-        this.paths = new ArrayList<>(policyEnforcer.getPaths());
+        this.paths = policyEnforcer.getPaths();
    }

    public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
@@ -75,8 +75,7 @@ public abstract class AbstractPolicyEnforcer {
            if (accessToken != null) {
                Request request = httpFacade.getRequest();
                Response response = httpFacade.getResponse();
-                String pathInfo = URI.create(request.getURI()).getPath().substring(1);
-                String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+                String path = getPath(request);
                PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);

                LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
@@ -122,12 +121,9 @@ public abstract class AbstractPolicyEnforcer {
    protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
        Request request = httpFacade.getRequest();
        PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
-        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();

-        if (accessDeniedPath != null) {
-            if (request.getURI().contains(accessDeniedPath)) {
-                return true;
-            }
+        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
+            return true;
        }

        AccessToken.Authorization authorization = accessToken.getAuthorization();
@@ -173,6 +169,17 @@ public abstract class AbstractPolicyEnforcer {
        return false;
    }

+    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
+        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
+
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
    private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
        Set<String> allowedScopes = permission.getScopes();
        return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
@@ -220,27 +227,23 @@ public abstract class AbstractPolicyEnforcer {
    }

    private PathConfig resolvePathConfig(PathConfig originalConfig, Request request) {
+        String path = getPath(request);
+
        if (originalConfig.hasPattern()) {
-            String pathInfo = URI.create(request.getURI()).getPath().substring(1);
-            String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
            ProtectedResource resource = this.authzClient.protection().resource();
            Set<String> search = resource.findByFilter("uri=" + path);

            if (!search.isEmpty()) {
                // resource does exist on the server, cache it
                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
-                PathConfig config = new PathConfig();
+                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);

-                config.setId(targetResource.getId());
-                config.setName(targetResource.getName());
-                config.setType(targetResource.getType());
-                config.setPath(targetResource.getUri());
                config.setScopes(originalConfig.getScopes());
                config.setMethods(originalConfig.getMethods());
                config.setParentConfig(originalConfig);
                config.setEnforcementMode(originalConfig.getEnforcementMode());

-                this.paths.add(config);
+                this.policyEnforcer.addPath(config);

                return config;
            }
@@ -249,6 +252,11 @@ public abstract class AbstractPolicyEnforcer {
        return originalConfig;
    }

+    private String getPath(Request request) {
+        String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+        return pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+    }
+
    private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
        Set<String> requiredScopes = new HashSet<>();

@@ -17,6 +17,10 @@
 */
 package org.keycloak.adapters.authorization;

+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Set;
+
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
@@ -34,10 +38,6 @@ import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;

-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
@@ -51,39 +51,34 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {

    @Override
    protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
-        int retry = 2;
        AccessToken original = accessToken;

-        while (retry > 0) {
-            if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
-                return true;
-            }
-
-            accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
-
-            if (accessToken == null) {
-                return false;
-            }
-
-            AccessToken.Authorization authorization = original.getAuthorization();
-
-            if (authorization == null) {
-                authorization = new AccessToken.Authorization();
-                authorization.setPermissions(new ArrayList<Permission>());
-            }
-
-            AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
-
-            if (newAuthorization != null) {
-                authorization.getPermissions().addAll(newAuthorization.getPermissions());
-            }
-
-            original.setAuthorization(authorization);
-
-            retry--;
+        if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+            return true;
        }

-        return false;
+        accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
+
+        if (accessToken == null) {
+            return false;
+        }
+
+        AccessToken.Authorization authorization = original.getAuthorization();
+
+        if (authorization == null) {
+            authorization = new AccessToken.Authorization();
+            authorization.setPermissions(new ArrayList<Permission>());
+        }
+
+        AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
+
+        if (newAuthorization != null) {
+            authorization.getPermissions().addAll(newAuthorization.getPermissions());
+        }
+
+        original.setAuthorization(authorization);
+
+        return super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade);
    }

    @Override
@@ -108,7 +103,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
            KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();

            if (getEnforcerConfig().getUserManagedAccess() != null) {
-                LOGGER.debug("Obtaining authorization for  authenticated user.");
+                LOGGER.debug("Obtaining authorization for authenticated user.");
                PermissionRequest permissionRequest = new PermissionRequest();

                permissionRequest.setResourceSetId(pathConfig.getId());
@@ -136,12 +131,14 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
                    permissionRequest.setResourceSetId(pathConfig.getId());
                    permissionRequest.setResourceSetName(pathConfig.getName());
                    permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
+                    LOGGER.debugf("Sending entitlements request: resource_set_id [%s], resource_set_name [%s], scopes [%s].", permissionRequest.getResourceSetId(), permissionRequest.getResourceSetName(), permissionRequest.getScopes());
                    request.addPermission(permissionRequest);
                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getClientId(), request);
                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
                }
            }
        } catch (AuthorizationDeniedException e) {
+            LOGGER.debug("Authorization denied", e);
            return null;
        } catch (Exception e) {
            throw new RuntimeException("Unexpected error during authorization request.", e);
@@ -19,7 +19,7 @@ package org.keycloak.adapters.authorization;

 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;

-import java.util.List;
+import java.util.Map;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -28,10 +28,16 @@ class PathMatcher {

    private static final String ANY_RESOURCE_PATTERN = "/*";

-    PathConfig matches(final String requestedUri, List<PathConfig> paths) {
+    PathConfig matches(final String requestedUri, Map<String, PathConfig> paths) {
+        PathConfig pathConfig = paths.get(requestedUri);
+
+        if (pathConfig != null) {
+            return pathConfig;
+        }
+
        PathConfig actualConfig = null;

-        for (PathConfig entry : paths) {
+        for (PathConfig entry : paths.values()) {
            String protectedUri = entry.getPath();
            String selectedUri = null;

@@ -34,8 +34,10 @@ import org.keycloak.representations.idm.authorization.Permission;

 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;

 /**
@@ -48,7 +50,7 @@ public class PolicyEnforcer {
    private final KeycloakDeployment deployment;
    private final AuthzClient authzClient;
    private final PolicyEnforcerConfig enforcerConfig;
-    private final List<PathConfig> paths;
+    private final Map<String, PathConfig> paths;

    public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
        this.deployment = deployment;
@@ -58,7 +60,7 @@ public class PolicyEnforcer {

        if (LOGGER.isDebugEnabled()) {
            LOGGER.debug("Initialization complete. Path configurations:");
-            for (PathConfig pathConfig : this.paths) {
+            for (PathConfig pathConfig : this.paths.values()) {
                LOGGER.debug(pathConfig);
            }
        }
@@ -96,15 +98,19 @@ public class PolicyEnforcer {
        return authzClient;
    }

-    public List<PathConfig> getPaths() {
-        return Collections.unmodifiableList(paths);
+    public Map<String, PathConfig> getPaths() {
+        return paths;
+    }
+
+    void addPath(PathConfig pathConfig) {
+        paths.put(pathConfig.getPath(), pathConfig);
    }

    KeycloakDeployment getDeployment() {
        return deployment;
    }

-    private List<PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+    private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
        boolean loadPathsFromServer = true;

        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
@@ -123,8 +129,8 @@ public class PolicyEnforcer {
        }
    }

-    private List<PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        List<PathConfig> paths = new ArrayList<>();
+    private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());

        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
            Set<String> search;
@@ -172,7 +178,7 @@ public class PolicyEnforcer {

            PathConfig existingPath = null;

-            for (PathConfig current : paths) {
+            for (PathConfig current : paths.values()) {
                if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                    existingPath = current;
                    break;
@@ -180,7 +186,7 @@ public class PolicyEnforcer {
            }

            if (existingPath == null) {
-                paths.add(pathConfig);
+                paths.put(pathConfig.getPath(), pathConfig);
            } else {
                existingPath.getMethods().addAll(pathConfig.getMethods());
                existingPath.getScopes().addAll(pathConfig.getScopes());
@@ -190,23 +196,24 @@ public class PolicyEnforcer {
        return paths;
    }

-    private List<PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
+    private Map<String, PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
        LOGGER.info("Querying the server for all resources associated with this application.");
-        List<PathConfig> paths = new ArrayList<>();
+        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());

        for (String id : protectedResource.findAll()) {
            RegistrationResponse response = protectedResource.findById(id);
            ResourceRepresentation resourceDescription = response.getResourceDescription();

            if (resourceDescription.getUri() != null) {
-                paths.add(createPathConfig(resourceDescription));
+                PathConfig pathConfig = createPathConfig(resourceDescription);
+                paths.put(pathConfig.getPath(), pathConfig);
            }
        }

        return paths;
    }

-    private PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
        PathConfig pathConfig = new PathConfig();

        pathConfig.setId(resourceDescription.getId());
@@ -37,4 +37,9 @@ public class HardcodedPublicKeyLocator implements PublicKeyLocator {
    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
        return publicKey;
    }
+
+    @Override
+    public void reset(KeycloakDeployment deployment) {
+
+    }
 }
@@ -25,7 +25,6 @@ import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.common.util.Time;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.util.JWKSUtils;

 import java.security.PublicKey;
@@ -48,36 +47,51 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
    @Override
    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
        int minTimeBetweenRequests = deployment.getMinTimeBetweenJwksRequests();
+        int publicKeyCacheTtl = deployment.getPublicKeyCacheTtl();
+        int currentTime = Time.currentTime();

        // Check if key is in cache.
-        PublicKey publicKey = currentKeys.get(kid);
+        PublicKey publicKey = lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
        if (publicKey != null) {
            return publicKey;
        }

-        int currentTime = Time.currentTime();
-
        // Check if we are allowed to send request
-        if (currentTime > lastRequestTime + minTimeBetweenRequests) {
-            synchronized (this) {
-                currentTime = Time.currentTime();
-                if (currentTime > lastRequestTime + minTimeBetweenRequests) {
-                    sendRequest(deployment);
-                    lastRequestTime = currentTime;
-                } else {
-                    log.debugf("Won't send request to realm jwks url. Last request time was %d", lastRequestTime);
-                }
+        synchronized (this) {
+            currentTime = Time.currentTime();
+            if (currentTime > lastRequestTime + minTimeBetweenRequests) {
+                sendRequest(deployment);
+                lastRequestTime = currentTime;
+            } else {
+                log.debug("Won't send request to realm jwks url. Last request time was " + lastRequestTime);
            }
+
+            return lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
        }
+    }

-        return currentKeys.get(kid);

+    @Override
+    public void reset(KeycloakDeployment deployment) {
+        synchronized (this) {
+            sendRequest(deployment);
+            lastRequestTime = Time.currentTime();
+        }
+    }
+
+
+    private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
+        if (lastRequestTime + publicKeyCacheTtl > currentTime) {
+            return currentKeys.get(kid);
+        } else {
+            return null;
+        }
    }


    private void sendRequest(KeycloakDeployment deployment) {
        if (log.isTraceEnabled()) {
-            log.tracef("Going to send request to retrieve new set of realm public keys for client %s", deployment.getResourceName());
+            log.trace("Going to send request to retrieve new set of realm public keys for client " + deployment.getResourceName());
        }

        HttpGet getMethod = new HttpGet(deployment.getJwksUrl());
@@ -87,7 +101,7 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
            Map<String, PublicKey> publicKeys = JWKSUtils.getKeysForUse(jwks, JWK.Use.SIG);

            if (log.isDebugEnabled()) {
-                log.debugf("Realm public keys successfully retrieved for client %s. New kids: %s", deployment.getResourceName(), publicKeys.keySet().toString());
+                log.debug("Realm public keys successfully retrieved for client " +  deployment.getResourceName() + ". New kids: " + publicKeys.keySet().toString());
            }

            // Update current keys
@@ -34,4 +34,11 @@ public interface PublicKeyLocator {
     */
    PublicKey getPublicKey(String kid, KeycloakDeployment deployment);

+    /**
+     * Reset the state of locator (eg. clear the cached keys)
+     *
+     * @param deployment
+     */
+    void reset(KeycloakDeployment deployment);
+
 }
@@ -69,6 +69,7 @@ public class KeycloakDeploymentBuilderTest {
        assertEquals("email", deployment.getPrincipalAttribute());
        assertEquals(10, deployment.getTokenMinimumTimeToLive());
        assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
+        assertEquals(120, deployment.getPublicKeyCacheTtl());
    }

    @Test
@@ -78,6 +79,7 @@ public class KeycloakDeploymentBuilderTest {

        assertTrue(deployment.getPublicKeyLocator() instanceof JWKPublicKeyLocator);
        assertEquals(10, deployment.getMinTimeBetweenJwksRequests());
+        assertEquals(86400, deployment.getPublicKeyCacheTtl());
    }

    @Test
@@ -30,5 +30,6 @@
    "token-store": "cookie",
    "principal-attribute": "email",
    "token-minimum-time-to-live": 10,
-    "min-time-between-jwks-requests": 20
+    "min-time-between-jwks-requests": 20,
+    "public-key-cache-ttl": 120
 }
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -846,14 +846,15 @@
                    kc.clearToken();
                }

-                for (var i = loginIframe.callbackList.length - 1; i >= 0; --i) {
-                    var promise = loginIframe.callbackList[i];
+                var callbacks = loginIframe.callbackList.splice(0, loginIframe.callbackList.length);
+
+                for (var i = callbacks.length - 1; i >= 0; --i) {
+                    var promise = callbacks[i];
                    if (event.data == "unchanged") {
                        promise.setSuccess();
                    } else {
                        promise.setError();
                    }
-                    loginIframe.callbackList.splice(i, 1);
                }
            };

@@ -35,14 +35,14 @@
            req.open('GET', url, true);

            req.onreadystatechange = function () {
-                if (req.readyState == 4) {
-                    if (req.status == 204) {
+                if (req.readyState === 4) {
+                    if (req.status === 204) {
                        init = {
                            clientId: clientId,
                            origin: origin
                        }
                        callback('unchanged');
-                    } else if (req.status = 404) {
+                    } else if (req.status === 404) {
                        callback('changed');
                    } else {
                        callback('error');
@@ -52,8 +52,8 @@

            req.send();
        } else {
-            if (clientId == init.clientId && origin == init.origin) {
-                if (sessionState == cookie) {
+            if (clientId === init.clientId && origin === init.origin) {
+                if (sessionState === cookie) {
                    callback('unchanged');
                } else {
                    callback('changed');
@@ -71,7 +71,7 @@
        for(var i=0; i<ca.length; i++)
        {
            var c = ca[i].trim();
-            if (c.indexOf(name)==0) return c.substring(name.length,c.length);
+            if (c.indexOf(name)===0) return c.substring(name.length,c.length);
        }
        return null;
    }
@@ -95,4 +95,4 @@
    window.addEventListener("message", receiveMessage, false);
 </script>
 </body>
-</html>
+</html>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>2.4.0.CR1-SNAPSHOT</version>
+    <version>2.5.0.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -30,6 +30,12 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
+import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;

 /**
 * Provides a Keycloak {@link AuthenticationEntryPoint authentication entry point}. Uses a
@@ -56,12 +62,15 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
    private final RequestMatcher apiRequestMatcher;
    private String loginUri = DEFAULT_LOGIN_URI;
    private String realm = DEFAULT_REALM;
+ 
+    private AdapterDeploymentContext adapterDeploymentContext;

    /**
     * Creates a new Keycloak authentication entry point.
     */
-    public KeycloakAuthenticationEntryPoint() {
+    public KeycloakAuthenticationEntryPoint(AdapterDeploymentContext adapterDeploymentContext) {
        this(DEFAULT_API_REQUEST_MATCHER);
+        this.adapterDeploymentContext = adapterDeploymentContext;
    }

    /**
@@ -79,7 +88,8 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException
    {
-        if (apiRequestMatcher.matches(request)) {
+        HttpFacade facade = new SimpleHttpFacade(request, response);
+        if (apiRequestMatcher.matches(request) || adapterDeploymentContext.resolveDeployment(facade).isBearerOnly()) {
            commenceUnauthorizedResponse(request, response);
        } else {
            commenceLoginRedirect(request, response);
@@ -71,8 +71,8 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
        return factoryBean.getObject();
    }

-    protected AuthenticationEntryPoint authenticationEntryPoint() {
-        return new KeycloakAuthenticationEntryPoint();
+    protected AuthenticationEntryPoint authenticationEntryPoint() throws Exception {
+        return new KeycloakAuthenticationEntryPoint(adapterDeploymentContext());
    }

    protected KeycloakAuthenticationProvider keycloakAuthenticationProvider() {
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.springsecurity.filter;
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.AuthenticatedActionsHandler;
+import org.keycloak.adapters.NodesRegistrationManagement;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.BeansException;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.web.filter.GenericFilterBean;
+
+/**
+ * Exposes a Keycloak adapter {@link AuthenticatedActionsHandler} as a Spring Security filter.
+ *
+ * @author <a href="mailto:srossillo@smartling.com">Scott Rossillo</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakAuthenticatedActionsFilter extends GenericFilterBean implements ApplicationContextAware {
+
+    private static final Logger log = LoggerFactory.getLogger(KeycloakAuthenticatedActionsFilter.class);
+
+    private final NodesRegistrationManagement management = new NodesRegistrationManagement();
+    private ApplicationContext applicationContext;
+    private AdapterDeploymentContext deploymentContext;
+
+    
+    public KeycloakAuthenticatedActionsFilter() {
+        super();
+    }
+
+    @Override
+    protected void initFilterBean() throws ServletException {
+        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
+    }
+
+    @Override
+    public void destroy() {
+        log.debug("Unregistering deployment");
+        management.stop();
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        HttpFacade facade = new SimpleHttpFacade((HttpServletRequest)request, (HttpServletResponse)response);
+        AuthenticatedActionsHandler handler = new AuthenticatedActionsHandler(deploymentContext.resolveDeployment(facade), (OIDCHttpFacade)facade);
+        boolean handled = handler.handledRequest();
+        if (handled) {
+            log.debug("Authenticated filter handled request: {}", ((HttpServletRequest) request).getRequestURI());
+        } else {
+            chain.doFilter(request, response);
+        }
+    }
+
+    @Override
+    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
+        this.applicationContext = applicationContext;
+    }
+}
@@ -142,6 +142,7 @@ public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticati
        if (AuthOutcome.FAILED.equals(result)) {
            throw new KeycloakAuthenticationException("Auth outcome: " + result);
        }
+       
        else if (AuthOutcome.AUTHENTICATED.equals(result)) {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            Assert.notNull(authentication, "Authentication SecurityContextHolder was null");
@@ -26,6 +26,15 @@ import org.springframework.mock.web.MockHttpServletResponse;

 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.spi.HttpFacade;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.eq;
+import org.mockito.Mock;
+import static org.mockito.Mockito.when;
+import org.mockito.MockitoAnnotations;
+import org.springframework.context.ApplicationContext;

 /**
 * Keycloak authentication entry point tests.
@@ -35,12 +44,24 @@ public class KeycloakAuthenticationEntryPointTest {
    private KeycloakAuthenticationEntryPoint authenticationEntryPoint;
    private MockHttpServletRequest request;
    private MockHttpServletResponse response;
+    @Mock
+    private ApplicationContext applicationContext;
+   
+    @Mock
+    private AdapterDeploymentContext adapterDeploymentContext;
+    
+    @Mock
+    private KeycloakDeployment keycloakDeployment;

    @Before
    public void setUp() throws Exception {
-        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint();
+        MockitoAnnotations.initMocks(this);
+        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint(adapterDeploymentContext);
        request = new MockHttpServletRequest();
        response = new MockHttpServletResponse();
+        when(applicationContext.getBean(eq(AdapterDeploymentContext.class))).thenReturn(adapterDeploymentContext);
+        when(adapterDeploymentContext.resolveDeployment(any(HttpFacade.class))).thenReturn(keycloakDeployment);
+        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
    }

    @Test
@@ -154,6 +154,7 @@ public class KeycloakAuthenticationProcessingFilterTest {
        when(keycloakDeployment.getResourceName()).thenReturn("resource-name");
        when(keycloakDeployment.getStateCookieName()).thenReturn("kc-cookie");
        when(keycloakDeployment.getSslRequired()).thenReturn(SslRequired.NONE);
+        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
        filter.attemptAuthentication(request, response);

        verify(response).setStatus(302);
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -20,10 +20,10 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
-    <name>Keycloak Integration</name>
+    <name>Keycloak Adapters</name>
    <description/>
    <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -40,7 +40,7 @@ public class SamlUtil {
            httpFacade.getResponse().setHeader("Content-Type", "text/html");
            httpFacade.getResponse().setHeader("Pragma", "no-cache");
            httpFacade.getResponse().setHeader("Cache-Control", "no-cache, no-store");
-            httpFacade.getResponse().getOutputStream().write(html.getBytes());
+            httpFacade.getResponse().getOutputStream().write(html.getBytes(GeneralConstants.SAML_CHARSET));
            httpFacade.getResponse().end();
        } else {
            String uri = asRequest ? binding.redirectBinding(document).requestURI(actionUrl).toString() : binding.redirectBinding(document).responseURI(actionUrl).toString();
@@ -571,12 +571,8 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                key = locator.getKey(keyId);
                boolean keyLocated = key != null;

-                if (validateRedirectBindingSignatureForKey(sigAlg, rawQueryBytes, decodedSignature, key)) {
-                    return true;
-                }
-
                if (keyLocated) {
-                    return false;
+                    return validateRedirectBindingSignatureForKey(sigAlg, rawQueryBytes, decodedSignature, key);
                }
            } catch (KeyManagementException ex) {
            }
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Wildfly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Client Adapter SPI Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.4.0.CR1-SNAPSHOT</version>
+		<version>2.5.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>2.4.0.CR1-SNAPSHOT</version>
+        <version>2.5.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -17,6 +17,8 @@
 */
 package org.keycloak.authorization.policy.provider.aggregated;

+import java.util.List;
+
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.DecisionResultCollector;
@@ -26,21 +28,11 @@ import org.keycloak.authorization.policy.evaluation.Result;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderFactory;

-import java.util.List;
-
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class AggregatePolicyProvider implements PolicyProvider {

-    private final Policy policy;
-    private final AuthorizationProvider authorization;
-
-    public AggregatePolicyProvider(Policy policy, AuthorizationProvider authorization) {
-        this.policy = policy;
-        this.authorization = authorization;
-    }
-
    @Override
    public void evaluate(Evaluation evaluation) {
        //TODO: need to detect deep recursions
@@ -59,10 +51,12 @@ public class AggregatePolicyProvider implements PolicyProvider {
            }
        };

-        this.policy.getAssociatedPolicies().forEach(associatedPolicy -> {
-            PolicyProviderFactory providerFactory = authorization.getProviderFactory(associatedPolicy.getType());
-            PolicyProvider policyProvider = providerFactory.create(associatedPolicy, authorization);
-            policyProvider.evaluate(new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision));
+        Policy policy = evaluation.getPolicy();
+        AuthorizationProvider authorization = evaluation.getAuthorizationProvider();
+
+        policy.getAssociatedPolicies().forEach(associatedPolicy -> {
+            PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
+            policyProvider.evaluate(new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision, authorization));
        });

        decision.onComplete();
@@ -19,7 +19,6 @@ package org.keycloak.authorization.policy.provider.aggregated;

 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -32,6 +31,8 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class AggregatePolicyProviderFactory implements PolicyProviderFactory {

+    private AggregatePolicyProvider provider = new AggregatePolicyProvider();
+
    @Override
    public String getName() {
        return "Aggregated";
@@ -43,8 +44,8 @@ public class AggregatePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
-        return new AggregatePolicyProvider(policy, authorization);
+    public PolicyProvider create(AuthorizationProvider authorization) {
+        return provider;
    }

    @Override
@@ -0,0 +1,38 @@
+package org.keycloak.authorization.policy.provider.client;
+
+import static org.keycloak.authorization.policy.provider.client.ClientPolicyProviderFactory.getClients;
+
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.policy.evaluation.Evaluation;
+import org.keycloak.authorization.policy.evaluation.EvaluationContext;
+import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RealmModel;
+
+public class ClientPolicyProvider implements PolicyProvider {
+
+    @Override
+    public void evaluate(Evaluation evaluation) {
+        Policy policy = evaluation.getPolicy();
+        EvaluationContext context = evaluation.getContext();
+        String[] clients = getClients(policy);
+        AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
+        RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
+
+        if (clients.length > 0) {
+            for (String client : clients) {
+                ClientModel clientModel = realm.getClientById(client);
+                if (context.getAttributes().containsValue("kc.client.id", clientModel.getClientId())) {
+                    evaluation.grant();
+                    return;
+                }
+            }
+        }
+    }
+
+    @Override
+    public void close() {
+
+    }
+}
@@ -0,0 +1,120 @@
+package org.keycloak.authorization.policy.provider.client;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.keycloak.Config;
+import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.ResourceServer;
+import org.keycloak.authorization.policy.provider.PolicyProvider;
+import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
+import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
+import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.ResourceServerStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel.ClientRemovedEvent;
+import org.keycloak.util.JsonSerialization;
+
+public class ClientPolicyProviderFactory implements PolicyProviderFactory {
+
+    private ClientPolicyProvider provider = new ClientPolicyProvider();
+
+    @Override
+    public String getName() {
+        return "Client";
+    }
+
+    @Override
+    public String getGroup() {
+        return "Identity Based";
+    }
+
+    @Override
+    public PolicyProvider create(AuthorizationProvider authorization) {
+        return provider;
+    }
+
+    @Override
+    public PolicyProviderAdminService getAdminResource(ResourceServer resourceServer) {
+        return null;
+    }
+
+    @Override
+    public PolicyProvider create(KeycloakSession session) {
+        return null;
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+        factory.register(event -> {
+            if (event instanceof ClientRemovedEvent) {
+                KeycloakSession keycloakSession = ((ClientRemovedEvent) event).getKeycloakSession();
+                AuthorizationProvider provider = keycloakSession.getProvider(AuthorizationProvider.class);
+                StoreFactory storeFactory = provider.getStoreFactory();
+                PolicyStore policyStore = storeFactory.getPolicyStore();
+                ClientModel removedClient = ((ClientRemovedEvent) event).getClient();
+                ResourceServerStore resourceServerStore = storeFactory.getResourceServerStore();
+                ResourceServer resourceServer = resourceServerStore.findByClient(removedClient.getId());
+
+                if (resourceServer != null) {
+                    policyStore.findByType(getId(), resourceServer.getId()).forEach(policy -> {
+                        List<String> clients = new ArrayList<>();
+
+                        for (String clientId : getClients(policy)) {
+                            if (!clientId.equals(removedClient.getId())) {
+                                clients.add(clientId);
+                            }
+                        }
+
+                        try {
+                            if (clients.isEmpty()) {
+                                policyStore.findDependentPolicies(policy.getId(), resourceServer.getId()).forEach(dependentPolicy -> {
+                                    dependentPolicy.removeAssociatedPolicy(policy);
+                                });
+                                policyStore.delete(policy.getId());
+                            } else {
+                                policy.getConfig().put("clients", JsonSerialization.writeValueAsString(clients));
+                            }
+                        } catch (IOException e) {
+                            throw new RuntimeException("Error while synchronizing clients with policy [" + policy.getName() + "].", e);
+                        }
+                    });
+                }
+            }
+        });
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return "client";
+    }
+
+    static String[] getClients(Policy policy) {
+        String clients = policy.getConfig().get("clients");
+
+        if (clients != null) {
+            try {
+                return JsonSerialization.readValue(clients.getBytes(), String[].class);
+            } catch (IOException e) {
+                throw new RuntimeException("Could not parse clients [" + clients + "] from policy config [" + policy.getName() + "].", e);
+            }
+        }
+
+        return new String[]{};
+    }
+}
@@ -17,32 +17,34 @@
 */
 package org.keycloak.authorization.policy.provider.js;

+import java.util.function.Supplier;
+
+import javax.script.ScriptEngine;
+import javax.script.ScriptException;
+
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
 import org.keycloak.authorization.policy.provider.PolicyProvider;

-import javax.script.ScriptEngine;
-import javax.script.ScriptEngineManager;
-import javax.script.ScriptException;
-
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class JSPolicyProvider implements PolicyProvider {

-    private final Policy policy;
+    private Supplier<ScriptEngine> engineProvider;

-    public JSPolicyProvider(Policy policy) {
-        this.policy = policy;
+    public JSPolicyProvider(Supplier<ScriptEngine> engineProvider) {
+        this.engineProvider = engineProvider;
    }

    @Override
    public void evaluate(Evaluation evaluation) {
-        ScriptEngineManager manager = new ScriptEngineManager();
-        ScriptEngine engine = manager.getEngineByName("nashorn");
+        ScriptEngine engine = engineProvider.get();

        engine.put("$evaluation", evaluation);

+        Policy policy = evaluation.getPolicy();
+
        try {
            engine.eval(policy.getConfig().get("code"));
        } catch (ScriptException e) {
@@ -1,8 +1,12 @@
 package org.keycloak.authorization.policy.provider.js;

+import java.util.function.Supplier;
+
+import javax.script.ScriptEngine;
+import javax.script.ScriptEngineManager;
+
 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -15,6 +19,13 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class JSPolicyProviderFactory implements PolicyProviderFactory {

+    private JSPolicyProvider provider = new JSPolicyProvider(new Supplier<ScriptEngine>() {
+        @Override
+        public ScriptEngine get() {
+            return new ScriptEngineManager().getEngineByName("nashorn");
+        }
+    });
+
    @Override
    public String getName() {
        return "JavaScript";
@@ -26,8 +37,8 @@ public class JSPolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
-        return new JSPolicyProvider(policy);
+    public PolicyProvider create(AuthorizationProvider authorization) {
+        return provider;
    }

    @Override
@@ -17,7 +17,6 @@
 */
 package org.keycloak.authorization.policy.provider.resource;

-import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
 import org.keycloak.authorization.policy.provider.PolicyProvider;

@@ -26,7 +25,7 @@ import org.keycloak.authorization.policy.provider.PolicyProvider;
 */
 public class ResourcePolicyProvider implements PolicyProvider {

-    public ResourcePolicyProvider(Policy policy) {
+    public ResourcePolicyProvider() {

    }

@@ -2,7 +2,6 @@ package org.keycloak.authorization.policy.provider.resource;

 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -15,6 +14,8 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class ResourcePolicyProviderFactory implements PolicyProviderFactory {

+    private ResourcePolicyProvider provider = new ResourcePolicyProvider();
+
    @Override
    public String getName() {
        return "Resource-Based";
@@ -26,8 +27,8 @@ public class ResourcePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
-        return new ResourcePolicyProvider(policy);
+    public PolicyProvider create(AuthorizationProvider authorization) {
+        return provider;
    }

    @Override
@@ -17,6 +17,10 @@
 */
 package org.keycloak.authorization.policy.provider.role;

+import static org.keycloak.authorization.policy.provider.role.RolePolicyProviderFactory.getRoles;
+
+import java.util.Map;
+
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.identity.Identity;
 import org.keycloak.authorization.model.Policy;
@@ -26,39 +30,26 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;

-import java.util.Map;
-
-import static org.keycloak.authorization.policy.provider.role.RolePolicyProviderFactory.getRoles;
-
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class RolePolicyProvider implements PolicyProvider {

-    private final Policy policy;
-    private final AuthorizationProvider authorization;
-
-    public RolePolicyProvider(Policy policy, AuthorizationProvider authorization) {
-        this.policy = policy;
-        this.authorization = authorization;
-    }
-
-    public RolePolicyProvider() {
-        this(null, null);
-    }
-
    @Override
    public void evaluate(Evaluation evaluation) {
-        Map<String, Object>[] roleIds = getRoles(this.policy);
+        Policy policy = evaluation.getPolicy();
+        Map<String, Object>[] roleIds = getRoles(policy);
+        AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
+        RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();

        if (roleIds.length > 0) {
            Identity identity = evaluation.getContext().getIdentity();

            for (Map<String, Object> current : roleIds) {
-                RoleModel role = getCurrentRealm().getRoleById((String) current.get("id"));
+                RoleModel role = realm.getRoleById((String) current.get("id"));

                if (role != null) {
-                    boolean hasRole = hasRole(identity, role);
+                    boolean hasRole = hasRole(identity, role, realm);

                    if (!hasRole && Boolean.valueOf(isRequired(current))) {
                        evaluation.deny();
@@ -75,19 +66,15 @@ public class RolePolicyProvider implements PolicyProvider {
        return (boolean) current.getOrDefault("required", false);
    }

-    private boolean hasRole(Identity identity, RoleModel role) {
+    private boolean hasRole(Identity identity, RoleModel role, RealmModel realm) {
        String roleName = role.getName();
        if (role.isClientRole()) {
-            ClientModel clientModel = getCurrentRealm().getClientById(role.getContainerId());
+            ClientModel clientModel = realm.getClientById(role.getContainerId());
            return identity.hasClientRole(clientModel.getClientId(), roleName);
        }
        return identity.hasRealmRole(roleName);
    }

-    private RealmModel getCurrentRealm() {
-        return this.authorization.getKeycloakSession().getContext().getRealm();
-    }
-
    @Override
    public void close() {

@@ -26,8 +26,13 @@ import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
 import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
 import org.keycloak.authorization.store.PolicyStore;
+import org.keycloak.authorization.store.ResourceServerStore;
+import org.keycloak.authorization.store.StoreFactory;
+import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;
 import org.keycloak.models.RoleModel;
 import org.keycloak.util.JsonSerialization;
@@ -37,12 +42,15 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.function.Consumer;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class RolePolicyProviderFactory implements PolicyProviderFactory {

+    private RolePolicyProvider provider = new RolePolicyProvider();
+
    @Override
    public String getName() {
        return "Role";
@@ -54,8 +62,8 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
-        return new RolePolicyProvider(policy, authorization);
+    public PolicyProvider create(AuthorizationProvider authorization) {
+        return provider;
    }

    @Override
@@ -79,43 +87,63 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory {
            if (event instanceof RoleRemovedEvent) {
                KeycloakSession keycloakSession = ((RoleRemovedEvent) event).getKeycloakSession();
                AuthorizationProvider provider = keycloakSession.getProvider(AuthorizationProvider.class);
-                PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
+                StoreFactory storeFactory = provider.getStoreFactory();
+                PolicyStore policyStore = storeFactory.getPolicyStore();
                RoleModel removedRole = ((RoleRemovedEvent) event).getRole();
+                RoleContainerModel container = removedRole.getContainer();
+                ResourceServerStore resourceServerStore = storeFactory.getResourceServerStore();

-                policyStore.findByType(getId()).forEach(policy -> {
-                    List<Map> roles = new ArrayList<>();
-
-                    for (Map<String,Object> role : getRoles(policy)) {
-                        if (!role.get("id").equals(removedRole.getId())) {
-                            Map updated = new HashMap();
-                            updated.put("id", role.get("id"));
-                            Object required = role.get("required");
-                            if (required != null) {
-                                updated.put("required", required);
-                            }
-                            roles.add(updated);
-                        }
-                    }
-
-                    try {
-                        if (roles.isEmpty()) {
-                            policyStore.findDependentPolicies(policy.getId()).forEach(dependentPolicy -> {
-                                dependentPolicy.removeAssociatedPolicy(policy);
-                            });
-                            policyStore.delete(policy.getId());
-                        } else {
-                            Map<String, String> config = policy.getConfig();
-                            config.put("roles", JsonSerialization.writeValueAsString(roles));
-                            policy.setConfig(config);
-                        }
-                    } catch (IOException e) {
-                        throw new RuntimeException("Error while synchronizing roles with policy [" + policy.getName() + "].", e);
-                    }
-                });
+                if (container instanceof RealmModel) {
+                    RealmModel realm = (RealmModel) container;
+                    realm.getClients().forEach(clientModel -> updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore));
+                } else {
+                    ClientModel clientModel = (ClientModel) container;
+                    updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore);
+                }
            }
        });
    }

+    private void updateResourceServer(ClientModel clientModel, RoleModel removedRole, ResourceServerStore resourceServerStore, PolicyStore policyStore) {
+        ResourceServer resourceServer = resourceServerStore.findByClient(clientModel.getId());
+
+        if (resourceServer != null) {
+            policyStore.findByType(getId(), resourceServer.getId()).forEach(policy -> {
+                List<Map> roles = new ArrayList<>();
+
+                for (Map<String,Object> role : getRoles(policy)) {
+                    if (!role.get("id").equals(removedRole.getId())) {
+                        Map updated = new HashMap();
+                        updated.put("id", role.get("id"));
+                        Object required = role.get("required");
+                        if (required != null) {
+                            updated.put("required", required);
+                        }
+                        roles.add(updated);
+                    }
+                }
+
+                try {
+                    if (roles.isEmpty()) {
+                        policyStore.findDependentPolicies(policy.getId(), resourceServer.getId()).forEach(dependentPolicy -> {
+                            dependentPolicy.removeAssociatedPolicy(policy);
+                            if (dependentPolicy.getAssociatedPolicies().isEmpty()) {
+                                policyStore.delete(dependentPolicy.getId());
+                            }
+                        });
+                        policyStore.delete(policy.getId());
+                    } else {
+                        Map<String, String> config = policy.getConfig();
+                        config.put("roles", JsonSerialization.writeValueAsString(roles));
+                        policy.setConfig(config);
+                    }
+                } catch (IOException e) {
+                    throw new RuntimeException("Error while synchronizing roles with policy [" + policy.getName() + "].", e);
+                }
+            });
+        }
+    }
+
    @Override
    public void close() {