Set version to 2.4.0.CR1

2016-11-21 19:29:18 +00:00
1142 changed files with 17421 additions and 33504 deletions
@@ -16,7 +16,6 @@ env:
    - TESTS=group1
    - TESTS=group2
    - TESTS=group3
-    - TESTS=group4
    - TESTS=adapter

 jdk:
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -342,12 +342,6 @@ public class AdapterDeploymentContext {
            return delegate.getNotBefore();
        }

-        @Override
-        public void updateNotBefore(int notBefore) {
-            delegate.setNotBefore(notBefore);
-            getPublicKeyLocator().reset(this);
-        }
-
        @Override
        public void setExposeToken(boolean exposeToken) {
            delegate.setExposeToken(exposeToken);
@@ -452,16 +446,6 @@ public class AdapterDeploymentContext {
        public int getMinTimeBetweenJwksRequests() {
            return delegate.getMinTimeBetweenJwksRequests();
        }
-
-        @Override
-        public int getPublicKeyCacheTtl() {
-            return delegate.getPublicKeyCacheTtl();
-        }
-
-        @Override
-        public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-            delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
-        }
    }

    protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {
@@ -46,7 +46,14 @@ public class HttpAdapterUtils {
            }
            InputStream is = entity.getContent();
            try {
-                return JsonSerialization.readValue(is, clazz);
+                ByteArrayOutputStream os = new ByteArrayOutputStream();
+                int c;
+                while ((c = is.read()) != -1) {
+                    os.write(c);
+                }
+                byte[] bytes = os.toByteArray();
+                String json = new String(bytes);
+                return JsonSerialization.readValue(json, clazz);
            } finally {
                try {
                    is.close();
@@ -57,7 +57,6 @@ public class KeycloakDeployment {

    protected String resourceName;
    protected boolean bearerOnly;
-    protected boolean autodetectBearerOnly;
    protected boolean enableBasicAuth;
    protected boolean publicClient;
    protected Map<String, Object> resourceCredentials = new HashMap<>();
@@ -82,7 +81,6 @@ public class KeycloakDeployment {
    protected volatile int notBefore;
    protected int tokenMinimumTimeToLive;
    protected int minTimeBetweenJwksRequests;
-    protected int publicKeyCacheTtl;
    private PolicyEnforcer policyEnforcer;

    public KeycloakDeployment() {
@@ -202,14 +200,6 @@ public class KeycloakDeployment {
        this.bearerOnly = bearerOnly;
    }

-    public boolean isAutodetectBearerOnly() {
-        return autodetectBearerOnly;
-    }
-
-    public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
-        this.autodetectBearerOnly = autodetectBearerOnly;
-    }
-
    public boolean isEnableBasicAuth() {
        return enableBasicAuth;
    }
@@ -338,11 +328,6 @@ public class KeycloakDeployment {
        this.notBefore = notBefore;
    }

-    public void updateNotBefore(int notBefore) {
-        this.notBefore = notBefore;
-        getPublicKeyLocator().reset(this);
-    }
-
    public boolean isAlwaysRefreshToken() {
        return alwaysRefreshToken;
    }
@@ -399,14 +384,6 @@ public class KeycloakDeployment {
        this.minTimeBetweenJwksRequests = minTimeBetweenJwksRequests;
    }

-    public int getPublicKeyCacheTtl() {
-        return publicKeyCacheTtl;
-    }
-
-    public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-        this.publicKeyCacheTtl = publicKeyCacheTtl;
-    }
-
    public void setPolicyEnforcer(PolicyEnforcer policyEnforcer) {
        this.policyEnforcer = policyEnforcer;
    }
@@ -99,14 +99,12 @@ public class KeycloakDeploymentBuilder {
        }

        deployment.setBearerOnly(adapterConfig.isBearerOnly());
-        deployment.setAutodetectBearerOnly(adapterConfig.isAutodetectBearerOnly());
        deployment.setEnableBasicAuth(adapterConfig.isEnableBasicAuth());
        deployment.setAlwaysRefreshToken(adapterConfig.isAlwaysRefreshToken());
        deployment.setRegisterNodeAtStartup(adapterConfig.isRegisterNodeAtStartup());
        deployment.setRegisterNodePeriod(adapterConfig.getRegisterNodePeriod());
        deployment.setTokenMinimumTimeToLive(adapterConfig.getTokenMinimumTimeToLive());
        deployment.setMinTimeBetweenJwksRequests(adapterConfig.getMinTimeBetweenJwksRequests());
-        deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());

        if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
            throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");
@@ -25,7 +25,6 @@ import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.Encode;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.constants.AdapterConstants;
@@ -170,7 +169,7 @@ public class OAuthRequestAuthenticator {
        KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, Encode.encodeQueryParamAsIs(url)) // Need to encode uri ourselves as queryParam() will not encode % characters.
+                .queryParam(OAuth2Constants.REDIRECT_URI, url)
                .queryParam(OAuth2Constants.STATE, state)
                .queryParam("login", "true");
        if(loginHint != null && loginHint.length() > 0){
@@ -204,7 +203,7 @@ public class OAuthRequestAuthenticator {

    protected AuthChallenge loginRedirect() {
        final String state = getStateCode();
-        final String redirect =  getRedirectUri(state);
+        final String redirect = getRedirectUri(state);
        if (redirect == null) {
            return challenge(403, OIDCAuthenticationError.Reason.NO_REDIRECT_URI, null);
        }
@@ -358,7 +357,7 @@ public class OAuthRequestAuthenticator {
            return challenge(403, OIDCAuthenticationError.Reason.INVALID_TOKEN, null);
        }
        if (tokenResponse.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(tokenResponse.getNotBeforePolicy());
+            deployment.setNotBefore(tokenResponse.getNotBeforePolicy());
        }
        if (token.getIssuedAt() < deployment.getNotBefore()) {
            log.error("Stale token");
@@ -155,7 +155,7 @@ public class PreAuthActionsHandler {
            } else {
                log.debugf("logout of all sessions for application '%s'", action.getResource());
                if (action.getNotBefore() > deployment.getNotBefore()) {
-                    deployment.updateNotBefore(action.getNotBefore());
+                    deployment.setNotBefore(action.getNotBefore());
                }
                userSessionManagement.logoutAll();
            }
@@ -177,7 +177,7 @@ public class PreAuthActionsHandler {
            }
            PushNotBeforeAction action = JsonSerialization.readValue(token.getContent(), PushNotBeforeAction.class);
            if (!validateAction(action)) return;
-            deployment.updateNotBefore(action.getNotBefore());
+            deployment.setNotBefore(action.getNotBefore());
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
@@ -144,7 +144,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
        }

        if (response.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(response.getNotBeforePolicy());
+            deployment.setNotBefore(response.getNotBeforePolicy());
        }

        this.token = token;
@@ -17,8 +17,6 @@

 package org.keycloak.adapters;

-import java.util.Collections;
-import java.util.List;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.spi.AuthChallenge;
@@ -118,12 +116,6 @@ public abstract class RequestAuthenticator {
            return AuthOutcome.NOT_ATTEMPTED;
        }

-        if (isAutodetectedBearerOnly(facade.getRequest())) {
-            challenge = bearer.getChallenge();
-            log.debug("NOT_ATTEMPTED: Treating as bearer only");
-            return AuthOutcome.NOT_ATTEMPTED;
-        }
-
        if (log.isTraceEnabled()) {
            log.trace("try oauth");
        }
@@ -166,36 +158,6 @@ public abstract class RequestAuthenticator {
        return false;
    }

-    protected boolean isAutodetectedBearerOnly(HttpFacade.Request request) {
-        if (!deployment.isAutodetectBearerOnly()) return false;
-
-        String headerValue = facade.getRequest().getHeader("X-Requested-With");
-        if (headerValue != null && headerValue.equalsIgnoreCase("XMLHttpRequest")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("Faces-Request");
-        if (headerValue != null && headerValue.startsWith("partial/")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("SOAPAction");
-        if (headerValue != null) {
-            return true;
-        }
-
-        List<String> accepts = facade.getRequest().getHeaders("Accept");
-        if (accepts == null) accepts = Collections.emptyList();
-
-        for (String accept : accepts) {
-            if (accept.contains("text/html") || accept.contains("text/*") || accept.contains("*/*")) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
    protected abstract OAuthRequestAuthenticator createOAuthAuthenticator();

    protected BearerTokenRequestAuthenticator createBearerTokenAuthenticator() {
@@ -17,13 +17,6 @@
 */
 package org.keycloak.adapters.authorization;

-import java.net.URI;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
@@ -39,6 +32,13 @@ import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.Enforce
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;

+import java.net.URI;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
@@ -48,7 +48,7 @@ public abstract class AbstractPolicyEnforcer {
    private final PolicyEnforcerConfig enforcerConfig;
    private final PolicyEnforcer policyEnforcer;

-    private Map<String, PathConfig> paths;
+    private List<PathConfig> paths;
    private AuthzClient authzClient;
    private PathMatcher pathMatcher;

@@ -57,7 +57,7 @@ public abstract class AbstractPolicyEnforcer {
        this.enforcerConfig = policyEnforcer.getEnforcerConfig();
        this.authzClient = policyEnforcer.getClient();
        this.pathMatcher = new PathMatcher();
-        this.paths = policyEnforcer.getPaths();
+        this.paths = new ArrayList<>(policyEnforcer.getPaths());
    }

    public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
@@ -75,7 +75,8 @@ public abstract class AbstractPolicyEnforcer {
            if (accessToken != null) {
                Request request = httpFacade.getRequest();
                Response response = httpFacade.getResponse();
-                String path = getPath(request);
+                String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+                String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
                PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);

                LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
@@ -121,9 +122,12 @@ public abstract class AbstractPolicyEnforcer {
    protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
        Request request = httpFacade.getRequest();
        PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
+        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();

-        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
-            return true;
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
        }

        AccessToken.Authorization authorization = accessToken.getAuthorization();
@@ -169,17 +173,6 @@ public abstract class AbstractPolicyEnforcer {
        return false;
    }

-    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
-        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
-
-        if (accessDeniedPath != null) {
-            if (request.getURI().contains(accessDeniedPath)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
    private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
        Set<String> allowedScopes = permission.getScopes();
        return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
@@ -227,23 +220,27 @@ public abstract class AbstractPolicyEnforcer {
    }

    private PathConfig resolvePathConfig(PathConfig originalConfig, Request request) {
-        String path = getPath(request);
-
        if (originalConfig.hasPattern()) {
+            String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+            String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
            ProtectedResource resource = this.authzClient.protection().resource();
            Set<String> search = resource.findByFilter("uri=" + path);

            if (!search.isEmpty()) {
                // resource does exist on the server, cache it
                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
-                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
+                PathConfig config = new PathConfig();

+                config.setId(targetResource.getId());
+                config.setName(targetResource.getName());
+                config.setType(targetResource.getType());
+                config.setPath(targetResource.getUri());
                config.setScopes(originalConfig.getScopes());
                config.setMethods(originalConfig.getMethods());
                config.setParentConfig(originalConfig);
                config.setEnforcementMode(originalConfig.getEnforcementMode());

-                this.policyEnforcer.addPath(config);
+                this.paths.add(config);

                return config;
            }
@@ -252,11 +249,6 @@ public abstract class AbstractPolicyEnforcer {
        return originalConfig;
    }

-    private String getPath(Request request) {
-        String pathInfo = URI.create(request.getURI()).getPath().substring(1);
-        return pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
-    }
-
    private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
        Set<String> requiredScopes = new HashSet<>();

@@ -17,10 +17,6 @@
 */
 package org.keycloak.adapters.authorization;

-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
@@ -38,6 +34,10 @@ import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;

+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Set;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
@@ -51,34 +51,39 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {

    @Override
    protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+        int retry = 2;
        AccessToken original = accessToken;

-        if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
-            return true;
+        while (retry > 0) {
+            if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+                return true;
+            }
+
+            accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
+
+            if (accessToken == null) {
+                return false;
+            }
+
+            AccessToken.Authorization authorization = original.getAuthorization();
+
+            if (authorization == null) {
+                authorization = new AccessToken.Authorization();
+                authorization.setPermissions(new ArrayList<Permission>());
+            }
+
+            AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
+
+            if (newAuthorization != null) {
+                authorization.getPermissions().addAll(newAuthorization.getPermissions());
+            }
+
+            original.setAuthorization(authorization);
+
+            retry--;
        }

-        accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
-
-        if (accessToken == null) {
-            return false;
-        }
-
-        AccessToken.Authorization authorization = original.getAuthorization();
-
-        if (authorization == null) {
-            authorization = new AccessToken.Authorization();
-            authorization.setPermissions(new ArrayList<Permission>());
-        }
-
-        AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
-
-        if (newAuthorization != null) {
-            authorization.getPermissions().addAll(newAuthorization.getPermissions());
-        }
-
-        original.setAuthorization(authorization);
-
-        return super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade);
+        return false;
    }

    @Override
@@ -103,7 +108,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
            KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();

            if (getEnforcerConfig().getUserManagedAccess() != null) {
-                LOGGER.debug("Obtaining authorization for authenticated user.");
+                LOGGER.debug("Obtaining authorization for  authenticated user.");
                PermissionRequest permissionRequest = new PermissionRequest();

                permissionRequest.setResourceSetId(pathConfig.getId());
@@ -131,14 +136,12 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
                    permissionRequest.setResourceSetId(pathConfig.getId());
                    permissionRequest.setResourceSetName(pathConfig.getName());
                    permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
-                    LOGGER.debugf("Sending entitlements request: resource_set_id [%s], resource_set_name [%s], scopes [%s].", permissionRequest.getResourceSetId(), permissionRequest.getResourceSetName(), permissionRequest.getScopes());
                    request.addPermission(permissionRequest);
                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getClientId(), request);
                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
                }
            }
        } catch (AuthorizationDeniedException e) {
-            LOGGER.debug("Authorization denied", e);
            return null;
        } catch (Exception e) {
            throw new RuntimeException("Unexpected error during authorization request.", e);
@@ -19,7 +19,7 @@ package org.keycloak.adapters.authorization;

 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;

-import java.util.Map;
+import java.util.List;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -28,16 +28,10 @@ class PathMatcher {

    private static final String ANY_RESOURCE_PATTERN = "/*";

-    PathConfig matches(final String requestedUri, Map<String, PathConfig> paths) {
-        PathConfig pathConfig = paths.get(requestedUri);
-
-        if (pathConfig != null) {
-            return pathConfig;
-        }
-
+    PathConfig matches(final String requestedUri, List<PathConfig> paths) {
        PathConfig actualConfig = null;

-        for (PathConfig entry : paths.values()) {
+        for (PathConfig entry : paths) {
            String protectedUri = entry.getPath();
            String selectedUri = null;

@@ -34,10 +34,8 @@ import org.keycloak.representations.idm.authorization.Permission;

 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;

 /**
@@ -50,7 +48,7 @@ public class PolicyEnforcer {
    private final KeycloakDeployment deployment;
    private final AuthzClient authzClient;
    private final PolicyEnforcerConfig enforcerConfig;
-    private final Map<String, PathConfig> paths;
+    private final List<PathConfig> paths;

    public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
        this.deployment = deployment;
@@ -60,7 +58,7 @@ public class PolicyEnforcer {

        if (LOGGER.isDebugEnabled()) {
            LOGGER.debug("Initialization complete. Path configurations:");
-            for (PathConfig pathConfig : this.paths.values()) {
+            for (PathConfig pathConfig : this.paths) {
                LOGGER.debug(pathConfig);
            }
        }
@@ -98,19 +96,15 @@ public class PolicyEnforcer {
        return authzClient;
    }

-    public Map<String, PathConfig> getPaths() {
-        return paths;
-    }
-
-    void addPath(PathConfig pathConfig) {
-        paths.put(pathConfig.getPath(), pathConfig);
+    public List<PathConfig> getPaths() {
+        return Collections.unmodifiableList(paths);
    }

    KeycloakDeployment getDeployment() {
        return deployment;
    }

-    private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+    private List<PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
        boolean loadPathsFromServer = true;

        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
@@ -129,8 +123,8 @@ public class PolicyEnforcer {
        }
    }

-    private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+    private List<PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        List<PathConfig> paths = new ArrayList<>();

        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
            Set<String> search;
@@ -178,7 +172,7 @@ public class PolicyEnforcer {

            PathConfig existingPath = null;

-            for (PathConfig current : paths.values()) {
+            for (PathConfig current : paths) {
                if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                    existingPath = current;
                    break;
@@ -186,7 +180,7 @@ public class PolicyEnforcer {
            }

            if (existingPath == null) {
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(pathConfig);
            } else {
                existingPath.getMethods().addAll(pathConfig.getMethods());
                existingPath.getScopes().addAll(pathConfig.getScopes());
@@ -196,24 +190,23 @@ public class PolicyEnforcer {
        return paths;
    }

-    private Map<String, PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
+    private List<PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
        LOGGER.info("Querying the server for all resources associated with this application.");
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+        List<PathConfig> paths = new ArrayList<>();

        for (String id : protectedResource.findAll()) {
            RegistrationResponse response = protectedResource.findById(id);
            ResourceRepresentation resourceDescription = response.getResourceDescription();

            if (resourceDescription.getUri() != null) {
-                PathConfig pathConfig = createPathConfig(resourceDescription);
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(createPathConfig(resourceDescription));
            }
        }

        return paths;
    }

-    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+    private PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
        PathConfig pathConfig = new PathConfig();

        pathConfig.setId(resourceDescription.getId());
@@ -37,9 +37,4 @@ public class HardcodedPublicKeyLocator implements PublicKeyLocator {
    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
        return publicKey;
    }
-
-    @Override
-    public void reset(KeycloakDeployment deployment) {
-
-    }
 }
@@ -25,6 +25,7 @@ import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.common.util.Time;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.util.JWKSUtils;

 import java.security.PublicKey;
@@ -47,51 +48,36 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
    @Override
    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
        int minTimeBetweenRequests = deployment.getMinTimeBetweenJwksRequests();
-        int publicKeyCacheTtl = deployment.getPublicKeyCacheTtl();
-        int currentTime = Time.currentTime();

        // Check if key is in cache.
-        PublicKey publicKey = lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
+        PublicKey publicKey = currentKeys.get(kid);
        if (publicKey != null) {
            return publicKey;
        }

+        int currentTime = Time.currentTime();
+
        // Check if we are allowed to send request
-        synchronized (this) {
-            currentTime = Time.currentTime();
-            if (currentTime > lastRequestTime + minTimeBetweenRequests) {
-                sendRequest(deployment);
-                lastRequestTime = currentTime;
-            } else {
-                log.debug("Won't send request to realm jwks url. Last request time was " + lastRequestTime);
+        if (currentTime > lastRequestTime + minTimeBetweenRequests) {
+            synchronized (this) {
+                currentTime = Time.currentTime();
+                if (currentTime > lastRequestTime + minTimeBetweenRequests) {
+                    sendRequest(deployment);
+                    lastRequestTime = currentTime;
+                } else {
+                    log.debugf("Won't send request to realm jwks url. Last request time was %d", lastRequestTime);
+                }
            }
-
-            return lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
        }
-    }

+        return currentKeys.get(kid);

-    @Override
-    public void reset(KeycloakDeployment deployment) {
-        synchronized (this) {
-            sendRequest(deployment);
-            lastRequestTime = Time.currentTime();
-        }
-    }
-
-
-    private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
-        if (lastRequestTime + publicKeyCacheTtl > currentTime) {
-            return currentKeys.get(kid);
-        } else {
-            return null;
-        }
    }


    private void sendRequest(KeycloakDeployment deployment) {
        if (log.isTraceEnabled()) {
-            log.trace("Going to send request to retrieve new set of realm public keys for client " + deployment.getResourceName());
+            log.tracef("Going to send request to retrieve new set of realm public keys for client %s", deployment.getResourceName());
        }

        HttpGet getMethod = new HttpGet(deployment.getJwksUrl());
@@ -101,7 +87,7 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
            Map<String, PublicKey> publicKeys = JWKSUtils.getKeysForUse(jwks, JWK.Use.SIG);

            if (log.isDebugEnabled()) {
-                log.debug("Realm public keys successfully retrieved for client " +  deployment.getResourceName() + ". New kids: " + publicKeys.keySet().toString());
+                log.debugf("Realm public keys successfully retrieved for client %s. New kids: %s", deployment.getResourceName(), publicKeys.keySet().toString());
            }

            // Update current keys
@@ -34,11 +34,4 @@ public interface PublicKeyLocator {
     */
    PublicKey getPublicKey(String kid, KeycloakDeployment deployment);

-    /**
-     * Reset the state of locator (eg. clear the cached keys)
-     *
-     * @param deployment
-     */
-    void reset(KeycloakDeployment deployment);
-
 }
@@ -69,7 +69,6 @@ public class KeycloakDeploymentBuilderTest {
        assertEquals("email", deployment.getPrincipalAttribute());
        assertEquals(10, deployment.getTokenMinimumTimeToLive());
        assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(120, deployment.getPublicKeyCacheTtl());
    }

    @Test
@@ -79,7 +78,6 @@ public class KeycloakDeploymentBuilderTest {

        assertTrue(deployment.getPublicKeyLocator() instanceof JWKPublicKeyLocator);
        assertEquals(10, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(86400, deployment.getPublicKeyCacheTtl());
    }

    @Test
@@ -30,6 +30,5 @@
    "token-store": "cookie",
    "principal-attribute": "email",
    "token-minimum-time-to-live": 10,
-    "min-time-between-jwks-requests": 20,
-    "public-key-cache-ttl": 120
+    "min-time-between-jwks-requests": 20
 }
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -846,15 +846,14 @@
                    kc.clearToken();
                }

-                var callbacks = loginIframe.callbackList.splice(0, loginIframe.callbackList.length);
-
-                for (var i = callbacks.length - 1; i >= 0; --i) {
-                    var promise = callbacks[i];
+                for (var i = loginIframe.callbackList.length - 1; i >= 0; --i) {
+                    var promise = loginIframe.callbackList[i];
                    if (event.data == "unchanged") {
                        promise.setSuccess();
                    } else {
                        promise.setError();
                    }
+                    loginIframe.callbackList.splice(i, 1);
                }
            };

@@ -35,14 +35,14 @@
            req.open('GET', url, true);

            req.onreadystatechange = function () {
-                if (req.readyState === 4) {
-                    if (req.status === 204) {
+                if (req.readyState == 4) {
+                    if (req.status == 204) {
                        init = {
                            clientId: clientId,
                            origin: origin
                        }
                        callback('unchanged');
-                    } else if (req.status === 404) {
+                    } else if (req.status = 404) {
                        callback('changed');
                    } else {
                        callback('error');
@@ -52,8 +52,8 @@

            req.send();
        } else {
-            if (clientId === init.clientId && origin === init.origin) {
-                if (sessionState === cookie) {
+            if (clientId == init.clientId && origin == init.origin) {
+                if (sessionState == cookie) {
                    callback('unchanged');
                } else {
                    callback('changed');
@@ -71,7 +71,7 @@
        for(var i=0; i<ca.length; i++)
        {
            var c = ca[i].trim();
-            if (c.indexOf(name)===0) return c.substring(name.length,c.length);
+            if (c.indexOf(name)==0) return c.substring(name.length,c.length);
        }
        return null;
    }
@@ -95,4 +95,4 @@
    window.addEventListener("message", receiveMessage, false);
 </script>
 </body>
-</html>
+</html>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>2.5.0.Final</version>
+    <version>2.4.0.CR1</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -30,12 +30,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext;

 /**
 * Provides a Keycloak {@link AuthenticationEntryPoint authentication entry point}. Uses a
@@ -62,15 +56,12 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
    private final RequestMatcher apiRequestMatcher;
    private String loginUri = DEFAULT_LOGIN_URI;
    private String realm = DEFAULT_REALM;
- 
-    private AdapterDeploymentContext adapterDeploymentContext;

    /**
     * Creates a new Keycloak authentication entry point.
     */
-    public KeycloakAuthenticationEntryPoint(AdapterDeploymentContext adapterDeploymentContext) {
+    public KeycloakAuthenticationEntryPoint() {
        this(DEFAULT_API_REQUEST_MATCHER);
-        this.adapterDeploymentContext = adapterDeploymentContext;
    }

    /**
@@ -88,8 +79,7 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException
    {
-        HttpFacade facade = new SimpleHttpFacade(request, response);
-        if (apiRequestMatcher.matches(request) || adapterDeploymentContext.resolveDeployment(facade).isBearerOnly()) {
+        if (apiRequestMatcher.matches(request)) {
            commenceUnauthorizedResponse(request, response);
        } else {
            commenceLoginRedirect(request, response);
@@ -71,8 +71,8 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
        return factoryBean.getObject();
    }

-    protected AuthenticationEntryPoint authenticationEntryPoint() throws Exception {
-        return new KeycloakAuthenticationEntryPoint(adapterDeploymentContext());
+    protected AuthenticationEntryPoint authenticationEntryPoint() {
+        return new KeycloakAuthenticationEntryPoint();
    }

    protected KeycloakAuthenticationProvider keycloakAuthenticationProvider() {
@@ -1,90 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springsecurity.filter;
-
-import java.io.IOException;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.AuthenticatedActionsHandler;
-import org.keycloak.adapters.NodesRegistrationManagement;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.web.filter.GenericFilterBean;
-
-/**
- * Exposes a Keycloak adapter {@link AuthenticatedActionsHandler} as a Spring Security filter.
- *
- * @author <a href="mailto:srossillo@smartling.com">Scott Rossillo</a>
- * @version $Revision: 1 $
- */
-public class KeycloakAuthenticatedActionsFilter extends GenericFilterBean implements ApplicationContextAware {
-
-    private static final Logger log = LoggerFactory.getLogger(KeycloakAuthenticatedActionsFilter.class);
-
-    private final NodesRegistrationManagement management = new NodesRegistrationManagement();
-    private ApplicationContext applicationContext;
-    private AdapterDeploymentContext deploymentContext;
-
-    
-    public KeycloakAuthenticatedActionsFilter() {
-        super();
-    }
-
-    @Override
-    protected void initFilterBean() throws ServletException {
-        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
-    }
-
-    @Override
-    public void destroy() {
-        log.debug("Unregistering deployment");
-        management.stop();
-    }
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-            throws IOException, ServletException {
-
-        HttpFacade facade = new SimpleHttpFacade((HttpServletRequest)request, (HttpServletResponse)response);
-        AuthenticatedActionsHandler handler = new AuthenticatedActionsHandler(deploymentContext.resolveDeployment(facade), (OIDCHttpFacade)facade);
-        boolean handled = handler.handledRequest();
-        if (handled) {
-            log.debug("Authenticated filter handled request: {}", ((HttpServletRequest) request).getRequestURI());
-        } else {
-            chain.doFilter(request, response);
-        }
-    }
-
-    @Override
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        this.applicationContext = applicationContext;
-    }
-}
@@ -142,7 +142,6 @@ public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticati
        if (AuthOutcome.FAILED.equals(result)) {
            throw new KeycloakAuthenticationException("Auth outcome: " + result);
        }
-       
        else if (AuthOutcome.AUTHENTICATED.equals(result)) {
            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
            Assert.notNull(authentication, "Authentication SecurityContextHolder was null");
@@ -26,15 +26,6 @@ import org.springframework.mock.web.MockHttpServletResponse;

 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.spi.HttpFacade;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.eq;
-import org.mockito.Mock;
-import static org.mockito.Mockito.when;
-import org.mockito.MockitoAnnotations;
-import org.springframework.context.ApplicationContext;

 /**
 * Keycloak authentication entry point tests.
@@ -44,24 +35,12 @@ public class KeycloakAuthenticationEntryPointTest {
    private KeycloakAuthenticationEntryPoint authenticationEntryPoint;
    private MockHttpServletRequest request;
    private MockHttpServletResponse response;
-    @Mock
-    private ApplicationContext applicationContext;
-   
-    @Mock
-    private AdapterDeploymentContext adapterDeploymentContext;
-    
-    @Mock
-    private KeycloakDeployment keycloakDeployment;

    @Before
    public void setUp() throws Exception {
-        MockitoAnnotations.initMocks(this);
-        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint(adapterDeploymentContext);
+        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint();
        request = new MockHttpServletRequest();
        response = new MockHttpServletResponse();
-        when(applicationContext.getBean(eq(AdapterDeploymentContext.class))).thenReturn(adapterDeploymentContext);
-        when(adapterDeploymentContext.resolveDeployment(any(HttpFacade.class))).thenReturn(keycloakDeployment);
-        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
    }

    @Test
@@ -154,7 +154,6 @@ public class KeycloakAuthenticationProcessingFilterTest {
        when(keycloakDeployment.getResourceName()).thenReturn("resource-name");
        when(keycloakDeployment.getStateCookieName()).thenReturn("kc-cookie");
        when(keycloakDeployment.getSslRequired()).thenReturn(SslRequired.NONE);
-        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
        filter.attemptAuthentication(request, response);

        verify(response).setStatus(302);
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -20,10 +20,10 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
-    <name>Keycloak Adapters</name>
+    <name>Keycloak Integration</name>
    <description/>
    <modelVersion>4.0.0</modelVersion>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -40,7 +40,7 @@ public class SamlUtil {
            httpFacade.getResponse().setHeader("Content-Type", "text/html");
            httpFacade.getResponse().setHeader("Pragma", "no-cache");
            httpFacade.getResponse().setHeader("Cache-Control", "no-cache, no-store");
-            httpFacade.getResponse().getOutputStream().write(html.getBytes(GeneralConstants.SAML_CHARSET));
+            httpFacade.getResponse().getOutputStream().write(html.getBytes());
            httpFacade.getResponse().end();
        } else {
            String uri = asRequest ? binding.redirectBinding(document).requestURI(actionUrl).toString() : binding.redirectBinding(document).responseURI(actionUrl).toString();
@@ -571,8 +571,12 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                key = locator.getKey(keyId);
                boolean keyLocated = key != null;

+                if (validateRedirectBindingSignatureForKey(sigAlg, rawQueryBytes, decodedSignature, key)) {
+                    return true;
+                }
+
                if (keyLocated) {
-                    return validateRedirectBindingSignatureForKey(sigAlg, rawQueryBytes, decodedSignature, key);
+                    return false;
                }
            } catch (KeyManagementException ex) {
            }
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Wildfly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Client Adapter SPI Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.4.0.CR1</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.4.0.CR1</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -17,8 +17,6 @@
 */
 package org.keycloak.authorization.policy.provider.aggregated;

-import java.util.List;
-
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.DecisionResultCollector;
@@ -28,11 +26,21 @@ import org.keycloak.authorization.policy.evaluation.Result;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderFactory;

+import java.util.List;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class AggregatePolicyProvider implements PolicyProvider {

+    private final Policy policy;
+    private final AuthorizationProvider authorization;
+
+    public AggregatePolicyProvider(Policy policy, AuthorizationProvider authorization) {
+        this.policy = policy;
+        this.authorization = authorization;
+    }
+
    @Override
    public void evaluate(Evaluation evaluation) {
        //TODO: need to detect deep recursions
@@ -51,12 +59,10 @@ public class AggregatePolicyProvider implements PolicyProvider {
            }
        };

-        Policy policy = evaluation.getPolicy();
-        AuthorizationProvider authorization = evaluation.getAuthorizationProvider();
-
-        policy.getAssociatedPolicies().forEach(associatedPolicy -> {
-            PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
-            policyProvider.evaluate(new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision, authorization));
+        this.policy.getAssociatedPolicies().forEach(associatedPolicy -> {
+            PolicyProviderFactory providerFactory = authorization.getProviderFactory(associatedPolicy.getType());
+            PolicyProvider policyProvider = providerFactory.create(associatedPolicy, authorization);
+            policyProvider.evaluate(new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision));
        });

        decision.onComplete();
@@ -19,6 +19,7 @@ package org.keycloak.authorization.policy.provider.aggregated;

 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -31,8 +32,6 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class AggregatePolicyProviderFactory implements PolicyProviderFactory {

-    private AggregatePolicyProvider provider = new AggregatePolicyProvider();
-
    @Override
    public String getName() {
        return "Aggregated";
@@ -44,8 +43,8 @@ public class AggregatePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(AuthorizationProvider authorization) {
-        return provider;
+    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
+        return new AggregatePolicyProvider(policy, authorization);
    }

    @Override
@@ -1,38 +0,0 @@
-package org.keycloak.authorization.policy.provider.client;
-
-import static org.keycloak.authorization.policy.provider.client.ClientPolicyProviderFactory.getClients;
-
-import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.policy.evaluation.Evaluation;
-import org.keycloak.authorization.policy.evaluation.EvaluationContext;
-import org.keycloak.authorization.policy.provider.PolicyProvider;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.RealmModel;
-
-public class ClientPolicyProvider implements PolicyProvider {
-
-    @Override
-    public void evaluate(Evaluation evaluation) {
-        Policy policy = evaluation.getPolicy();
-        EvaluationContext context = evaluation.getContext();
-        String[] clients = getClients(policy);
-        AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
-        RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
-
-        if (clients.length > 0) {
-            for (String client : clients) {
-                ClientModel clientModel = realm.getClientById(client);
-                if (context.getAttributes().containsValue("kc.client.id", clientModel.getClientId())) {
-                    evaluation.grant();
-                    return;
-                }
-            }
-        }
-    }
-
-    @Override
-    public void close() {
-
-    }
-}
@@ -1,120 +0,0 @@
-package org.keycloak.authorization.policy.provider.client;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.keycloak.Config;
-import org.keycloak.authorization.AuthorizationProvider;
-import org.keycloak.authorization.model.Policy;
-import org.keycloak.authorization.model.ResourceServer;
-import org.keycloak.authorization.policy.provider.PolicyProvider;
-import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
-import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
-import org.keycloak.authorization.store.PolicyStore;
-import org.keycloak.authorization.store.ResourceServerStore;
-import org.keycloak.authorization.store.StoreFactory;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel.ClientRemovedEvent;
-import org.keycloak.util.JsonSerialization;
-
-public class ClientPolicyProviderFactory implements PolicyProviderFactory {
-
-    private ClientPolicyProvider provider = new ClientPolicyProvider();
-
-    @Override
-    public String getName() {
-        return "Client";
-    }
-
-    @Override
-    public String getGroup() {
-        return "Identity Based";
-    }
-
-    @Override
-    public PolicyProvider create(AuthorizationProvider authorization) {
-        return provider;
-    }
-
-    @Override
-    public PolicyProviderAdminService getAdminResource(ResourceServer resourceServer) {
-        return null;
-    }
-
-    @Override
-    public PolicyProvider create(KeycloakSession session) {
-        return null;
-    }
-
-    @Override
-    public void init(Config.Scope config) {
-
-    }
-
-    @Override
-    public void postInit(KeycloakSessionFactory factory) {
-        factory.register(event -> {
-            if (event instanceof ClientRemovedEvent) {
-                KeycloakSession keycloakSession = ((ClientRemovedEvent) event).getKeycloakSession();
-                AuthorizationProvider provider = keycloakSession.getProvider(AuthorizationProvider.class);
-                StoreFactory storeFactory = provider.getStoreFactory();
-                PolicyStore policyStore = storeFactory.getPolicyStore();
-                ClientModel removedClient = ((ClientRemovedEvent) event).getClient();
-                ResourceServerStore resourceServerStore = storeFactory.getResourceServerStore();
-                ResourceServer resourceServer = resourceServerStore.findByClient(removedClient.getId());
-
-                if (resourceServer != null) {
-                    policyStore.findByType(getId(), resourceServer.getId()).forEach(policy -> {
-                        List<String> clients = new ArrayList<>();
-
-                        for (String clientId : getClients(policy)) {
-                            if (!clientId.equals(removedClient.getId())) {
-                                clients.add(clientId);
-                            }
-                        }
-
-                        try {
-                            if (clients.isEmpty()) {
-                                policyStore.findDependentPolicies(policy.getId(), resourceServer.getId()).forEach(dependentPolicy -> {
-                                    dependentPolicy.removeAssociatedPolicy(policy);
-                                });
-                                policyStore.delete(policy.getId());
-                            } else {
-                                policy.getConfig().put("clients", JsonSerialization.writeValueAsString(clients));
-                            }
-                        } catch (IOException e) {
-                            throw new RuntimeException("Error while synchronizing clients with policy [" + policy.getName() + "].", e);
-                        }
-                    });
-                }
-            }
-        });
-    }
-
-    @Override
-    public void close() {
-
-    }
-
-    @Override
-    public String getId() {
-        return "client";
-    }
-
-    static String[] getClients(Policy policy) {
-        String clients = policy.getConfig().get("clients");
-
-        if (clients != null) {
-            try {
-                return JsonSerialization.readValue(clients.getBytes(), String[].class);
-            } catch (IOException e) {
-                throw new RuntimeException("Could not parse clients [" + clients + "] from policy config [" + policy.getName() + "].", e);
-            }
-        }
-
-        return new String[]{};
-    }
-}
@@ -17,34 +17,32 @@
 */
 package org.keycloak.authorization.policy.provider.js;

-import java.util.function.Supplier;
-
-import javax.script.ScriptEngine;
-import javax.script.ScriptException;
-
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
 import org.keycloak.authorization.policy.provider.PolicyProvider;

+import javax.script.ScriptEngine;
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class JSPolicyProvider implements PolicyProvider {

-    private Supplier<ScriptEngine> engineProvider;
+    private final Policy policy;

-    public JSPolicyProvider(Supplier<ScriptEngine> engineProvider) {
-        this.engineProvider = engineProvider;
+    public JSPolicyProvider(Policy policy) {
+        this.policy = policy;
    }

    @Override
    public void evaluate(Evaluation evaluation) {
-        ScriptEngine engine = engineProvider.get();
+        ScriptEngineManager manager = new ScriptEngineManager();
+        ScriptEngine engine = manager.getEngineByName("nashorn");

        engine.put("$evaluation", evaluation);

-        Policy policy = evaluation.getPolicy();
-
        try {
            engine.eval(policy.getConfig().get("code"));
        } catch (ScriptException e) {
@@ -1,12 +1,8 @@
 package org.keycloak.authorization.policy.provider.js;

-import java.util.function.Supplier;
-
-import javax.script.ScriptEngine;
-import javax.script.ScriptEngineManager;
-
 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -19,13 +15,6 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class JSPolicyProviderFactory implements PolicyProviderFactory {

-    private JSPolicyProvider provider = new JSPolicyProvider(new Supplier<ScriptEngine>() {
-        @Override
-        public ScriptEngine get() {
-            return new ScriptEngineManager().getEngineByName("nashorn");
-        }
-    });
-
    @Override
    public String getName() {
        return "JavaScript";
@@ -37,8 +26,8 @@ public class JSPolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(AuthorizationProvider authorization) {
-        return provider;
+    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
+        return new JSPolicyProvider(policy);
    }

    @Override
@@ -17,6 +17,7 @@
 */
 package org.keycloak.authorization.policy.provider.resource;

+import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
 import org.keycloak.authorization.policy.provider.PolicyProvider;

@@ -25,7 +26,7 @@ import org.keycloak.authorization.policy.provider.PolicyProvider;
 */
 public class ResourcePolicyProvider implements PolicyProvider {

-    public ResourcePolicyProvider() {
+    public ResourcePolicyProvider(Policy policy) {

    }

@@ -2,6 +2,7 @@ package org.keycloak.authorization.policy.provider.resource;

 import org.keycloak.Config;
 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.model.ResourceServer;
 import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
@@ -14,8 +15,6 @@ import org.keycloak.models.KeycloakSessionFactory;
 */
 public class ResourcePolicyProviderFactory implements PolicyProviderFactory {

-    private ResourcePolicyProvider provider = new ResourcePolicyProvider();
-
    @Override
    public String getName() {
        return "Resource-Based";
@@ -27,8 +26,8 @@ public class ResourcePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(AuthorizationProvider authorization) {
-        return provider;
+    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
+        return new ResourcePolicyProvider(policy);
    }

    @Override
@@ -17,10 +17,6 @@
 */
 package org.keycloak.authorization.policy.provider.role;

-import static org.keycloak.authorization.policy.provider.role.RolePolicyProviderFactory.getRoles;
-
-import java.util.Map;
-
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.identity.Identity;
 import org.keycloak.authorization.model.Policy;
@@ -30,26 +26,39 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;

+import java.util.Map;
+
+import static org.keycloak.authorization.policy.provider.role.RolePolicyProviderFactory.getRoles;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class RolePolicyProvider implements PolicyProvider {

+    private final Policy policy;
+    private final AuthorizationProvider authorization;
+
+    public RolePolicyProvider(Policy policy, AuthorizationProvider authorization) {
+        this.policy = policy;
+        this.authorization = authorization;
+    }
+
+    public RolePolicyProvider() {
+        this(null, null);
+    }
+
    @Override
    public void evaluate(Evaluation evaluation) {
-        Policy policy = evaluation.getPolicy();
-        Map<String, Object>[] roleIds = getRoles(policy);
-        AuthorizationProvider authorizationProvider = evaluation.getAuthorizationProvider();
-        RealmModel realm = authorizationProvider.getKeycloakSession().getContext().getRealm();
+        Map<String, Object>[] roleIds = getRoles(this.policy);

        if (roleIds.length > 0) {
            Identity identity = evaluation.getContext().getIdentity();

            for (Map<String, Object> current : roleIds) {
-                RoleModel role = realm.getRoleById((String) current.get("id"));
+                RoleModel role = getCurrentRealm().getRoleById((String) current.get("id"));

                if (role != null) {
-                    boolean hasRole = hasRole(identity, role, realm);
+                    boolean hasRole = hasRole(identity, role);

                    if (!hasRole && Boolean.valueOf(isRequired(current))) {
                        evaluation.deny();
@@ -66,15 +75,19 @@ public class RolePolicyProvider implements PolicyProvider {
        return (boolean) current.getOrDefault("required", false);
    }

-    private boolean hasRole(Identity identity, RoleModel role, RealmModel realm) {
+    private boolean hasRole(Identity identity, RoleModel role) {
        String roleName = role.getName();
        if (role.isClientRole()) {
-            ClientModel clientModel = realm.getClientById(role.getContainerId());
+            ClientModel clientModel = getCurrentRealm().getClientById(role.getContainerId());
            return identity.hasClientRole(clientModel.getClientId(), roleName);
        }
        return identity.hasRealmRole(roleName);
    }

+    private RealmModel getCurrentRealm() {
+        return this.authorization.getKeycloakSession().getContext().getRealm();
+    }
+
    @Override
    public void close() {

@@ -26,13 +26,8 @@ import org.keycloak.authorization.policy.provider.PolicyProvider;
 import org.keycloak.authorization.policy.provider.PolicyProviderAdminService;
 import org.keycloak.authorization.policy.provider.PolicyProviderFactory;
 import org.keycloak.authorization.store.PolicyStore;
-import org.keycloak.authorization.store.ResourceServerStore;
-import org.keycloak.authorization.store.StoreFactory;
-import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleContainerModel.RoleRemovedEvent;
 import org.keycloak.models.RoleModel;
 import org.keycloak.util.JsonSerialization;
@@ -42,15 +37,12 @@ import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.function.Consumer;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class RolePolicyProviderFactory implements PolicyProviderFactory {

-    private RolePolicyProvider provider = new RolePolicyProvider();
-
    @Override
    public String getName() {
        return "Role";
@@ -62,8 +54,8 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory {
    }

    @Override
-    public PolicyProvider create(AuthorizationProvider authorization) {
-        return provider;
+    public PolicyProvider create(Policy policy, AuthorizationProvider authorization) {
+        return new RolePolicyProvider(policy, authorization);
    }

    @Override
@@ -87,63 +79,43 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory {
            if (event instanceof RoleRemovedEvent) {
                KeycloakSession keycloakSession = ((RoleRemovedEvent) event).getKeycloakSession();
                AuthorizationProvider provider = keycloakSession.getProvider(AuthorizationProvider.class);
-                StoreFactory storeFactory = provider.getStoreFactory();
-                PolicyStore policyStore = storeFactory.getPolicyStore();
+                PolicyStore policyStore = provider.getStoreFactory().getPolicyStore();
                RoleModel removedRole = ((RoleRemovedEvent) event).getRole();
-                RoleContainerModel container = removedRole.getContainer();
-                ResourceServerStore resourceServerStore = storeFactory.getResourceServerStore();

-                if (container instanceof RealmModel) {
-                    RealmModel realm = (RealmModel) container;
-                    realm.getClients().forEach(clientModel -> updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore));
-                } else {
-                    ClientModel clientModel = (ClientModel) container;
-                    updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore);
-                }
+                policyStore.findByType(getId()).forEach(policy -> {
+                    List<Map> roles = new ArrayList<>();
+
+                    for (Map<String,Object> role : getRoles(policy)) {
+                        if (!role.get("id").equals(removedRole.getId())) {
+                            Map updated = new HashMap();
+                            updated.put("id", role.get("id"));
+                            Object required = role.get("required");
+                            if (required != null) {
+                                updated.put("required", required);
+                            }
+                            roles.add(updated);
+                        }
+                    }
+
+                    try {
+                        if (roles.isEmpty()) {
+                            policyStore.findDependentPolicies(policy.getId()).forEach(dependentPolicy -> {
+                                dependentPolicy.removeAssociatedPolicy(policy);
+                            });
+                            policyStore.delete(policy.getId());
+                        } else {
+                            Map<String, String> config = policy.getConfig();
+                            config.put("roles", JsonSerialization.writeValueAsString(roles));
+                            policy.setConfig(config);
+                        }
+                    } catch (IOException e) {
+                        throw new RuntimeException("Error while synchronizing roles with policy [" + policy.getName() + "].", e);
+                    }
+                });
            }
        });
    }

-    private void updateResourceServer(ClientModel clientModel, RoleModel removedRole, ResourceServerStore resourceServerStore, PolicyStore policyStore) {
-        ResourceServer resourceServer = resourceServerStore.findByClient(clientModel.getId());
-
-        if (resourceServer != null) {
-            policyStore.findByType(getId(), resourceServer.getId()).forEach(policy -> {
-                List<Map> roles = new ArrayList<>();
-
-                for (Map<String,Object> role : getRoles(policy)) {
-                    if (!role.get("id").equals(removedRole.getId())) {
-                        Map updated = new HashMap();
-                        updated.put("id", role.get("id"));
-                        Object required = role.get("required");
-                        if (required != null) {
-                            updated.put("required", required);
-                        }
-                        roles.add(updated);
-                    }
-                }
-
-                try {
-                    if (roles.isEmpty()) {
-                        policyStore.findDependentPolicies(policy.getId(), resourceServer.getId()).forEach(dependentPolicy -> {
-                            dependentPolicy.removeAssociatedPolicy(policy);
-                            if (dependentPolicy.getAssociatedPolicies().isEmpty()) {
-                                policyStore.delete(dependentPolicy.getId());
-                            }
-                        });
-                        policyStore.delete(policy.getId());
-                    } else {
-                        Map<String, String> config = policy.getConfig();
-                        config.put("roles", JsonSerialization.writeValueAsString(roles));
-                        policy.setConfig(config);
-                    }
-                } catch (IOException e) {
-                    throw new RuntimeException("Error while synchronizing roles with policy [" + policy.getName() + "].", e);
-                }
-            });
-        }
-    }
-
    @Override
    public void close() {