Set version to 2.5.3.Final

KEYCLOAK-4329 Fix NPE when not providing KeyInfo element in IdP initiated SSO SAML

.gitignore

@@ -14,6 +14,7 @@
 nbactions.xml
 nb-configuration.xml
 catalog.xml
+nbproject
 
 # Compiled source #
 ###################

.travis.yml

@@ -12,12 +12,12 @@ env:
     - MAVEN_SKIP_RC=true
     - MAVEN_OPTS="-Xms512m -Xmx2048m"
   matrix:
-    - TESTS=old
     - TESTS=group1
     - TESTS=group2
     - TESTS=group3
     - TESTS=group4
     - TESTS=adapter
+    - TESTS=old
 
 jdk:
   - oraclejdk8

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -196,10 +196,8 @@ public class OAuthRequestAuthenticator {
         return sslRedirectPort;
     }
 
-    protected static final AtomicLong counter = new AtomicLong();
-
     protected String getStateCode() {
-        return counter.getAndIncrement() + "/" + AdapterUtils.generateId();
+        return AdapterUtils.generateId();
     }
 
     protected AuthChallenge loginRedirect() {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -253,8 +253,7 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private String getPath(Request request) {
-        String pathInfo = URI.create(request.getURI()).getPath().substring(1);
-        return pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+        return request.getRelativePath();
     }
 
     private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -66,6 +66,11 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
             return requestContext.getUriInfo().getRequestUri().toString();
         }
 
+        @Override
+        public String getRelativePath() {
+            return requestContext.getUriInfo().getPath();
+        }
+
         @Override
         public boolean isSecure() {
             return securityContext.isSecure();

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Jetty Integration</name>

adapters/oidc/js/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/js/src/main/resources/keycloak.js

@@ -153,7 +153,7 @@
                     processCallback(callback, initPromise);
                     return;
                 } else if (initOptions) {
-                    if (initOptions.token || initOptions.refreshToken) {
+                    if (initOptions.refreshToken) {
                         setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
 
                         if (loginIframe.enable) {
@@ -379,7 +379,7 @@
         kc.updateToken = function(minValidity) {
             var promise = createPromise();
 
-            if (!kc.tokenParsed || !kc.refreshToken) {
+            if (!kc.refreshToken) {
                 promise.setError();
                 return promise.promise;
             }
@@ -388,14 +388,10 @@
 
             var exec = function() {
                 var refreshToken = false;
-                if (kc.timeSkew == -1) {
-                    console.info('Skew ' + kc.timeSkew);
-                    refreshToken = true;
-                    console.info('[KEYCLOAK] Refreshing token: time skew not set');
-                } else if (minValidity == -1) {
+                if (minValidity == -1) {
                     refreshToken = true;
                     console.info('[KEYCLOAK] Refreshing token: forced refresh');
-                } else if (kc.isTokenExpired(minValidity)) {
+                } else if (!kc.tokenParsed || kc.isTokenExpired(minValidity)) {
                     refreshToken = true;
                     console.info('[KEYCLOAK] Refreshing token: token expired');
                 }
@@ -638,49 +634,6 @@
                 kc.tokenTimeoutHandle = null;
             }
 
-            if (token) {
-                kc.token = token;
-                kc.tokenParsed = decodeToken(token);
-                var sessionId = kc.realm + '/' + kc.tokenParsed.sub;
-                if (kc.tokenParsed.session_state) {
-                    sessionId = sessionId + '/' + kc.tokenParsed.session_state;
-                }
-                kc.sessionId = sessionId;
-                kc.authenticated = true;
-                kc.subject = kc.tokenParsed.sub;
-                kc.realmAccess = kc.tokenParsed.realm_access;
-                kc.resourceAccess = kc.tokenParsed.resource_access;
-
-                if (timeLocal) {
-                    kc.timeSkew = Math.floor(timeLocal / 1000) - kc.tokenParsed.iat;
-                    console.info('[KEYCLOAK] Estimated time difference between browser and server is ' + kc.timeSkew + ' seconds');
-                } else {
-                    kc.timeSkew = -1;
-                }
-
-                if (kc.onTokenExpired) {
-                    if (kc.timeSkew == -1) {
-                        kc.onTokenExpired();
-                    } else {
-                        var expiresIn = (kc.tokenParsed['exp'] - (new Date().getTime() / 1000) + kc.timeSkew) * 1000;
-                        if (expiresIn <= 0) {
-                            kc.onTokenExpired();
-                        } else {
-                            kc.tokenTimeoutHandle = setTimeout(kc.onTokenExpired, expiresIn);
-                        }
-                    }
-                }
-
-            } else {
-                delete kc.token;
-                delete kc.tokenParsed;
-                delete kc.subject;
-                delete kc.realmAccess;
-                delete kc.resourceAccess;
-
-                kc.authenticated = false;
-            }
-
             if (refreshToken) {
                 kc.refreshToken = refreshToken;
                 kc.refreshTokenParsed = decodeToken(refreshToken);
@@ -696,6 +649,48 @@
                 delete kc.idToken;
                 delete kc.idTokenParsed;
             }
+
+            if (token) {
+                kc.token = token;
+                kc.tokenParsed = decodeToken(token);
+
+                var sessionId = kc.realm + '/' + kc.tokenParsed.sub;
+                if (kc.tokenParsed.session_state) {
+                    sessionId = sessionId + '/' + kc.tokenParsed.session_state;
+                }
+                kc.sessionId = sessionId;
+                kc.authenticated = true;
+                kc.subject = kc.tokenParsed.sub;
+                kc.realmAccess = kc.tokenParsed.realm_access;
+                kc.resourceAccess = kc.tokenParsed.resource_access;
+
+                if (timeLocal) {
+                    kc.timeSkew = Math.floor(timeLocal / 1000) - kc.tokenParsed.iat;
+                    console.info('[KEYCLOAK] Estimated time difference between browser and server is ' + kc.timeSkew + ' seconds');
+
+                    if (kc.onTokenExpired) {
+                        var expiresIn = (kc.tokenParsed['exp'] - (new Date().getTime() / 1000) + kc.timeSkew) * 1000;
+                        console.info('[KEYCLOAK] Token expires in ' + Math.round(expiresIn / 1000) + ' s');
+                        if (expiresIn <= 0) {
+                            kc.onTokenExpired();
+                        } else {
+                            kc.tokenTimeoutHandle = setTimeout(kc.onTokenExpired, expiresIn);
+                        }
+                    }
+                } else {
+                    kc.updateToken(-1);
+                }
+            } else if (refreshToken) {
+                kc.updateToken(-1);
+            } else {
+                delete kc.token;
+                delete kc.tokenParsed;
+                delete kc.subject;
+                delete kc.realmAccess;
+                delete kc.resourceAccess;
+
+                kc.authenticated = false;
+            }
         }
 
         function decodeToken(str) {

adapters/oidc/js/src/main/resources/login-status-iframe-deprecated.html

@@ -0,0 +1,49 @@
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<script>
+    function getCookie(cname)
+    {
+        var name = cname + "=";
+        var ca = document.cookie.split(';');
+        for(var i=0; i<ca.length; i++)
+        {
+            var c = ca[i].trim();
+            if (c.indexOf(name)==0) return c.substring(name.length,c.length);
+        }
+        return null;
+    }
+    function receiveMessage(event)
+    {
+        if (event.origin !== "ORIGIN") {
+            console.log(event.origin + " does not match built origin");
+            return;
+
+        }
+        var data = JSON.parse(event.data);
+        data.loggedIn = false;
+        var cookie = getCookie('KEYCLOAK_SESSION');
+        if (cookie) {
+            data.loggedIn = true;
+            data.session = cookie;
+        }
+
+        event.source.postMessage(JSON.stringify(data),
+            event.origin);
+    }
+    window.addEventListener("message", receiveMessage, false);
+</script>

adapters/oidc/osgi-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>

adapters/oidc/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/src/main/java/org/keycloak/servlet/ServletOAuthClient.java

@@ -218,6 +218,11 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
                     return servletRequest.getRequestURL().toString();
                 }
 
+                @Override
+                public String getRelativePath() {
+                    return servletRequest.getServletPath();
+                }
+
                 @Override
                 public boolean isSecure() {
                     return servletRequest.isSecure();

adapters/oidc/spring-boot/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>2.5.0.Final</version>
+    <version>2.5.3.Final</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/facade/WrappedHttpServletRequest.java

@@ -70,6 +70,11 @@ class WrappedHttpServletRequest implements Request {
         return buf.toString();
     }
 
+    @Override
+    public String getRelativePath() {
+        return request.getServletPath();
+    }
+
     @Override
     public boolean isSecure() {
         return request.isSecure();

adapters/oidc/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Tomcat Integration</name>

adapters/oidc/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java

@@ -173,10 +173,15 @@ public class KeycloakServletExtension implements ServletExtension {
             }
         });
 
-        log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
-        ServletSessionConfig cookieConfig = new ServletSessionConfig();
-        cookieConfig.setPath(deploymentInfo.getContextPath());
-        deploymentInfo.setServletSessionConfig(cookieConfig);
+        ServletSessionConfig cookieConfig = deploymentInfo.getServletSessionConfig();
+        if (cookieConfig == null) {
+            cookieConfig = new ServletSessionConfig();
+        }
+        if (cookieConfig.getPath() == null) {
+            log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
+            cookieConfig.setPath(deploymentInfo.getContextPath());
+            deploymentInfo.setServletSessionConfig(cookieConfig);
+        }
         ChangeSessionId.turnOffChangeSessionIdOnLogin(deploymentInfo);
         deploymentInfo.addListener(new ListenerInfo(UndertowNodesRegistrationManagementWrapper.class, new InstanceFactory<UndertowNodesRegistrationManagementWrapper>() {
 

adapters/oidc/wildfly/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak WildFly Integration</name>

adapters/oidc/wildfly/wf8-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/oidc/wildfly/wildfly-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly/wildfly-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Adapters</name>

adapters/saml/as7-eap6/adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML EAP Integration</name>

adapters/saml/as7-eap6/subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/saml/core-public/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/profile/AbstractSamlAuthenticationHandler.java

@@ -60,6 +60,7 @@ import org.keycloak.saml.processing.core.saml.v2.common.SAMLDocumentHolder;
 import org.keycloak.saml.processing.core.saml.v2.util.AssertionUtil;
 import org.keycloak.saml.processing.web.util.PostBindingUtil;
 import org.w3c.dom.Document;
+import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 
 import java.io.IOException;
@@ -70,14 +71,11 @@ import java.security.KeyManagementException;
 import java.security.PublicKey;
 import java.security.Signature;
 import java.security.SignatureException;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
+import java.util.*;
 import org.keycloak.dom.saml.v2.SAML2Object;
 import org.keycloak.dom.saml.v2.protocol.ExtensionsType;
 import org.keycloak.rotation.KeyLocator;
 import org.keycloak.saml.processing.core.util.KeycloakKeySamlExtensionGenerator;
-import org.w3c.dom.Element;
 
 /**
  *
@@ -196,7 +194,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                         challenge = new AuthChallenge() {
                             @Override
                             public boolean challenge(HttpFacade exchange) {
-                                SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.INVALID_SIGNATURE);
+                                SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.INVALID_SIGNATURE, statusResponse);
                                 exchange.getRequest().setError(error);
                                 exchange.getResponse().sendError(403);
                                 return true;
@@ -312,8 +310,25 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
         return false;
     }
 
-    protected AuthOutcome handleLoginResponse(ResponseType responseType, boolean postBinding, OnSessionCreated onCreateSession) {
+    protected AuthOutcome handleLoginResponse(final ResponseType responseType, boolean postBinding, OnSessionCreated onCreateSession) {
         AssertionType assertion = null;
+        if (! isSuccessfulSamlResponse(responseType) || responseType.getAssertions() == null || responseType.getAssertions().isEmpty()) {
+            challenge = new AuthChallenge() {
+                @Override
+                public boolean challenge(HttpFacade exchange) {
+                    SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.ERROR_STATUS, responseType);
+                    exchange.getRequest().setError(error);
+                    exchange.getResponse().sendError(403);
+                    return true;
+                }
+
+                @Override
+                public int getResponseCode() {
+                    return 403;
+                }
+            };
+            return AuthOutcome.FAILED;
+        }
         try {
             assertion = AssertionUtil.getAssertion(responseType, deployment.getDecryptionKey());
             if (AssertionUtil.hasExpired(assertion)) {
@@ -335,6 +350,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                     return 403;
                 }
             };
+            return AuthOutcome.FAILED;
         }
 
         if (deployment.getIDP().getSingleSignOnService().validateAssertionSignature()) {
@@ -346,7 +362,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
                 challenge = new AuthChallenge() {
                     @Override
                     public boolean challenge(HttpFacade exchange) {
-                        SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.INVALID_SIGNATURE);
+                        SamlAuthenticationError error = new SamlAuthenticationError(SamlAuthenticationError.Reason.INVALID_SIGNATURE, responseType);
                         exchange.getRequest().setError(error);
                         exchange.getResponse().sendError(403);
                         return true;
@@ -449,6 +465,14 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
         return AuthOutcome.AUTHENTICATED;
     }
 
+    private boolean isSuccessfulSamlResponse(ResponseType responseType) {
+        return responseType != null
+          && responseType.getStatus() != null
+          && responseType.getStatus().getStatusCode() != null
+          && responseType.getStatus().getStatusCode().getValue() != null
+          && Objects.equals(responseType.getStatus().getStatusCode().getValue().toString(), JBossSAMLURIConstants.STATUS_SUCCESS.get());
+    }
+
     private String getAttributeValue(Object attrValue) {
         String value = null;
         if (attrValue instanceof String) {

adapters/saml/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Jetty Integration</name>

adapters/saml/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Client Adapter Modules</name>

adapters/saml/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Tomcat Integration</name>

adapters/saml/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/tomcat7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/undertow/src/main/java/org/keycloak/adapters/saml/undertow/SamlServletExtension.java

@@ -182,10 +182,15 @@ public class SamlServletExtension implements ServletExtension {
             }
         });
 
-        log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
-        ServletSessionConfig cookieConfig = new ServletSessionConfig();
-        cookieConfig.setPath(deploymentInfo.getContextPath());
-        deploymentInfo.setServletSessionConfig(cookieConfig);
+        ServletSessionConfig cookieConfig = deploymentInfo.getServletSessionConfig();
+        if (cookieConfig == null) {
+            cookieConfig = new ServletSessionConfig();
+        }
+        if (cookieConfig.getPath() == null) {
+            log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
+            cookieConfig.setPath(deploymentInfo.getContextPath());
+            deploymentInfo.setServletSessionConfig(cookieConfig);
+        }
         addEndpointConstraint(deploymentInfo);
 
         ChangeSessionId.turnOffChangeSessionIdOnLogin(deploymentInfo);

adapters/saml/wildfly/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Wildfly Integration</name>

adapters/saml/wildfly/wildfly-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/wildfly/wildfly-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/spi/adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/spi/adapter-spi/src/main/java/org/keycloak/adapters/spi/HttpFacade.java

@@ -43,6 +43,13 @@ public interface HttpFacade {
          */
         String getURI();
 
+        /**
+         * Get the request relative path.
+         *
+         * @return the request relative path
+         */
+        String getRelativePath();
+
         /**
          * HTTPS?
          *

adapters/spi/jboss-adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/spi/jetty-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/spi/jetty-adapter-spi/src/main/java/org/keycloak/adapters/jetty/spi/JettyHttpFacade.java

@@ -78,6 +78,11 @@ public class JettyHttpFacade implements HttpFacade {
             return buf.toString();
         }
 
+        @Override
+        public String getRelativePath() {
+            return request.getServletPath();
+        }
+
         @Override
         public String getFirstParam(String param) {
             return request.getParameter(param);

adapters/spi/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Client Adapter SPI Modules</name>

adapters/spi/servlet-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/spi/servlet-adapter-spi/src/main/java/org/keycloak/adapters/servlet/ServletHttpFacade.java

@@ -65,6 +65,11 @@ public class ServletHttpFacade implements HttpFacade {
             return buf.toString();
         }
 
+        @Override
+        public String getRelativePath() {
+            return request.getServletPath();
+        }
+
         @Override
         public boolean isSecure() {
             return request.isSecure();

adapters/spi/tomcat-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/spi/tomcat-adapter-spi/src/main/java/org/keycloak/adapters/tomcat/CatalinaHttpFacade.java

@@ -78,6 +78,11 @@ public class CatalinaHttpFacade implements HttpFacade {
             return buf.toString();
         }
 
+        @Override
+        public String getRelativePath() {
+            return request.getServletPath();
+        }
+
         @Override
         public boolean isSecure() {
             return request.isSecure();

adapters/spi/undertow-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/spi/undertow-adapter-spi/src/main/java/org/keycloak/adapters/undertow/UndertowHttpFacade.java

@@ -83,6 +83,11 @@ public class UndertowHttpFacade implements HttpFacade {
             return uriBuilder.build().toString();
         }
 
+        @Override
+        public String getRelativePath() {
+            return exchange.getRelativePath();
+        }
+
         @Override
         public boolean isSecure() {
             String protocol = exchange.getRequestScheme();

authz/client/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

authz/client/src/main/java/org/keycloak/authorization/client/representation/ResourceRepresentation.java

@@ -115,6 +115,9 @@ public class ResourceRepresentation {
     }
 
     public Set<ScopeRepresentation> getScopes() {
+        if (this.scopes == null) {
+            this.scopes = Collections.emptySet();
+        }
         return Collections.unmodifiableSet(this.scopes);
     }
 

authz/client/src/main/java/org/keycloak/authorization/client/resource/ProtectedResource.java

@@ -48,6 +48,16 @@ public class ProtectedResource {
         }
     }
 
+    public void update(ResourceRepresentation resource) {
+        try {
+            this.http.<RegistrationResponse>put("/authz/protection/resource_set/" + resource.getId())
+                    .authorizationBearer(this.pat)
+                    .json(JsonSerialization.writeValueAsBytes(resource)).execute();
+        } catch (Exception e) {
+            throw new RuntimeException("Could not create resource.", e);
+        }
+    }
+
     public RegistrationResponse findById(String id) {
         try {
             return this.http.<RegistrationResponse>get("/authz/protection/resource_set/" + id)

authz/client/src/main/java/org/keycloak/authorization/client/util/Http.java

@@ -51,6 +51,10 @@ public class Http {
         return method(RequestBuilder.post().setUri(this.serverConfiguration.getIssuer() + path));
     }
 
+    public <R> HttpMethod<R> put(String path) {
+        return method(RequestBuilder.put().setUri(this.serverConfiguration.getIssuer() + path));
+    }
+
     public <R> HttpMethod<R> delete(String path) {
         return method(RequestBuilder.delete().setUri(this.serverConfiguration.getIssuer() + path));
     }

authz/policy/common/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

authz/policy/drools/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -17,6 +17,19 @@
     <name>KeyCloak AuthZ: Drools Policy Provider</name>
     <description>KeyCloak AuthZ: Drools Policy Provider</description>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Authorization Drools Policy Provider -->
+            <dependency>
+                <groupId>org.drools</groupId>
+                <artifactId>drools-bom</artifactId>
+                <type>pom</type>
+                <version>${version.org.drools}</version>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.keycloak</groupId>

authz/policy/drools/src/main/java/org/keycloak/authorization/policy/provider/drools/DroolsPolicyProviderFactory.java

@@ -35,7 +35,7 @@ public class DroolsPolicyProviderFactory implements PolicyProviderFactory {
 
     @Override
     public String getName() {
-        return "Rule";
+        return "Rules";
     }
 
     @Override
@@ -75,7 +75,7 @@ public class DroolsPolicyProviderFactory implements PolicyProviderFactory {
 
     @Override
     public String getId() {
-        return "drools";
+        return "rules";
     }
 
     void update(Policy policy) {

authz/policy/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-authz-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

authz/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

common/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

core/src/main/java/org/keycloak/jose/jws/crypto/HMACProvider.java

@@ -25,6 +25,7 @@ import org.keycloak.jose.jws.JWSInput;
 import javax.crypto.Mac;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 
 /**
@@ -81,8 +82,7 @@ public class HMACProvider implements SignatureProvider {
     public static boolean verify(JWSInput input, SecretKey key) {
         try {
             byte[] signature = sign(input.getEncodedSignatureInput().getBytes("UTF-8"), input.getHeader().getAlgorithm(), key);
-            String x = Base64Url.encode(signature);
-            return x.equals(input.getEncodedSignature());
+            return MessageDigest.isEqual(signature, Base64Url.decode(input.getEncodedSignature()));
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
@@ -92,8 +92,7 @@ public class HMACProvider implements SignatureProvider {
     public static boolean verify(JWSInput input, byte[] sharedSecret) {
         try {
             byte[] signature = sign(input.getEncodedSignatureInput().getBytes("UTF-8"), input.getHeader().getAlgorithm(), sharedSecret);
-            String x = Base64Url.encode(signature);
-            return x.equals(input.getEncodedSignature());
+            return MessageDigest.isEqual(signature, Base64Url.decode(input.getEncodedSignature()));
         } catch (Exception e) {
             throw new RuntimeException(e);
         }

dependencies/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

dependencies/server-all/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -40,6 +40,15 @@
                 <scope>import</scope>
                 <version>${version.jboss-integration-platform}</version>
             </dependency>
+
+            <!-- Authorization Drools Policy Provider -->
+            <dependency>
+                <groupId>org.drools</groupId>
+                <artifactId>drools-bom</artifactId>
+                <type>pom</type>
+                <version>${version.org.drools}</version>
+                <scope>import</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

dependencies/server-min/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>2.5.0.Final</version>
+		<version>2.5.3.Final</version>
 		<relativePath>../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

distribution/adapters/as7-eap6-adapter/as7-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

distribution/adapters/as7-eap6-adapter/as7-modules/pom.xml

@@ -25,7 +25,7 @@
     <parent>
         <artifactId>keycloak-as7-eap6-adapter-dist-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

distribution/adapters/as7-eap6-adapter/eap6-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-eap6-adapter-dist-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

distribution/adapters/as7-eap6-adapter/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Adapter Distros</name>

distribution/adapters/fuse-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

distribution/adapters/jetty81-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

distribution/adapters/jetty91-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

distribution/adapters/jetty92-adapter-zip/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.0.Final</version>
+        <version>2.5.3.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>