KEYCLOAK-8837 Adapt TS to be able to test migration from 7.2.5.GA (instead from 7.2.0.GA)

Avoid NullPointerException when browser sends "Origin" header and
allowedOrigin is null. This happens on chrome with admin console

.gitignore

@@ -8,6 +8,11 @@
 .project
 .settings
 .classpath
+# reverting this as e.g. /distribution/feature-packs/server-feature-pack/src/main/resources/content/bin/ 
+# should not be ignored
+#bin/ 
+.factorypath
+
 
 # NetBeans #
 ############
@@ -49,3 +54,13 @@ target
 # Maven shade
 #############
 *dependency-reduced-pom.xml
+
+# nodejs #
+##########
+# KEYCLOAK-5391: We will re-exclude node_modules when node_modules handling is worked out.
+# For now, we keep our js libraries checked into GitHub, so we don't ignore.
+#node_modules
+
+# testsuite #
+#############
+*offline-token.txt

.travis.yml

@@ -1,34 +1,43 @@
 language: java
 
 cache:
-  directories:
-    - $HOME/.m2
-
-before_cache:
-  - rm -rf $HOME/.m2/repository/org/keycloak
+  cache: false
 
 env:
   global:
     - MAVEN_SKIP_RC=true
-    - MAVEN_OPTS="-Xms512m -Xmx2048m"
+    - MAVEN_OPTS="-Xms512m -Xmx1536m"
   matrix:
-    - TESTS=group1
-    - TESTS=group2
-    - TESTS=group3
-    - TESTS=group4
-    - TESTS=adapter
+    - TESTS=unit
+    - TESTS=server-group1
+    - TESTS=server-group2
+    - TESTS=server-group3
+    - TESTS=server-group4
+    - TESTS=adapter-tests
     - TESTS=old
+    - TESTS=crossdc-server
+    - TESTS=crossdc-adapter
+    - TESTS=ssl
 
 jdk:
   - oraclejdk8
 
-before_script:
-  - export MAVEN_SKIP_RC=true
+install: true
 
-install: 
-  - travis_wait 60 mvn install -Pdistribution -DskipTests=true -B -V -q
+before_install:
+  - "export PHANTOMJS_VERSION=2.1.1"
+  - "phantomjs --version"
+  - "export PATH=$PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64/bin:$PATH"
+  - "phantomjs --version"
+  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then rm -rf $PWD/travis_phantomjs; mkdir -p $PWD/travis_phantomjs; fi"
+  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then wget https://github.com/Medium/phantomjs/releases/download/v$PHANTOMJS_VERSION/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -O $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2; fi"
+  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then tar -xvf $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -C $PWD/travis_phantomjs; fi"
+  - "phantomjs --version"
 
-script:
+script: 
   - ./travis-run-tests.sh $TESTS
 
+after_success:
+  - .travis/docker-hub-master-trigger.sh
+
 sudo: false

.travis/docker-hub-master-trigger.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if [ "$DOCKER_HUB_TOKEN" != "" ] && [ "$TRAVIS_PULL_REQUEST" == "false" ] && [ "$TRAVIS_REPO_SLUG" == "keycloak/keycloak" ] && [ "$TRAVIS_BRANCH" == "master" ]; then
+    curl -H "Content-Type: application/json" --data '{"docker_tag": "master"}' -X POST https://registry.hub.docker.com/u/jboss/keycloak/trigger/$DOCKER_HUB_TOKEN/
+    echo "Triggered Docker hub build"
+elif [ "$DOCKER_HUB_TOKEN" != "" ] && [ "$TRAVIS_PULL_REQUEST" == "false" ] && [ "$TRAVIS_REPO_SLUG" == "keycloak/keycloak" ] && [ "$TRAVIS_BRANCH" == "openshift-integration2" ]; then
+    curl -H "Content-Type: application/json" --data '{"docker_tag": "nightly-openshift-integration2"}' -X POST https://registry.hub.docker.com/u/jboss/keycloak/trigger/$DOCKER_HUB_TOKEN/
+    echo "Triggered Docker hub build"
+fi

ADOPTERS.md

@@ -0,0 +1,54 @@
+ADOPTERS
+========
+
+PUBLIC REFERENCES
+-----------------
+
+List of organization names below is based on information collected using Keycloak Community Survey. It contains company names from participants who agreed to serve as public reference. If organizations would like get added or removed please make a PR. 
+
+* Accenture
+* Actinver
+* Akvo Foundation
+* Appier
+* BISPRO
+* Bluestem Brands, Inc
+* Bundesversicherungsamt
+* Capgemini
+* Chassi
+* CloudNative Inc.
+* Copenhagen Optimization
+* Curecomp GmbH
+* Cybertech
+* Devsu
+* Devoxx / Voxxed
+* DUENE e.V - project 
+* DukeCon
+* European Synchrotron Radiation Facility
+* Fluance AG
+* Hewlett-Packard Enterprise
+* Hitachi
+* INEAT
+* Inventage
+* ISAAC
+* ITROI Solutions
+* Kindly Ops, LLC
+* msg systems ag
+* Netdava International
+* Ohio Supercomputer Center
+* Okta
+* PharmaPartners B.V.
+* Plivo
+* Price Insight
+* Prodesan
+* Quest Software
+* Research Industrial Software Engineering (RISE)
+* Sportsbet.com.au
+* Stack Labs
+* Storebrand
+* Synekus
+* Synetek Solutions
+* Taklane
+* TrackingSport
+* TRT9 - Brasil
+* UnitedHealthcare
+* ...More individuals

README.md

@@ -32,23 +32,32 @@ To build the distribution run:
     
 Once completed you will find distribution archives in `distribution`.
 
+To build only the server run:
+
+    mvn -Pdistribution -pl distribution/server-dist -am -Dmaven.test.skip clean install
+
 
 Starting Keycloak
 -----------------
 
 To start Keycloak during development first build as specified above, then run:
 
-    mvn -f testsuite/integration/pom.xml exec:java -Pkeycloak-server 
+    mvn -f testsuite/utils/pom.xml exec:java -Pkeycloak-server 
 
+When running testsuite, by default an account with username `admin` and password `admin` will be created within the master realm at start.
 
-To start Keycloak from the appliance distribution first build the distribution it as specified above, then run:
+To start Keycloak from the server distribution first build the distribution it as specified above, then run:
 
-    tar xfz distribution/appliance-dist/target/keycloak-appliance-dist-all-<VERSION>.tar.gz
-    cd keycloak-appliance-dist-all-<VERSION>/keycloak
+    tar xfz distribution/server-dist/target/keycloak-<VERSION>.tar.gz
+    cd keycloak-<VERSION>
     bin/standalone.sh
     
 To stop the server press `Ctrl + C`.
 
+Reporting security vulnerabilities
+----------------------------------
+
+If you've found a security vulnerability, please look at the [instructions on how to properly report it](http://www.keycloak.org/security.html)
 
 Help and Documentation
 ----------------------

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -31,12 +31,24 @@
     <description/>
 
     <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
         <keycloak.osgi.export>
             org.keycloak.adapters.*
         </keycloak.osgi.export>
         <keycloak.osgi.import>
             org.keycloak.*;version="${project.version}",
-            org.apache.http.*;version=${apache.httpcomponents.version},
+            org.apache.http.auth.*;version=${apache.httpcomponents.version},
+            org.apache.http.client.*;version=${apache.httpcomponents.version},
+            org.apache.http.conn.*;version=${apache.httpcomponents.version},
+            org.apache.http.cookie.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.auth.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.client.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.conn.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.cookie.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.execchain.*;version=${apache.httpcomponents.version},
+            org.apache.http.*;version=${apache.httpcomponents.httpcore.version},
             org.apache.karaf.jaas.boot.principal;resolution:=optional,
             org.apache.karaf.jaas.modules;resolution:=optional,
             *;resolution:=optional
@@ -52,7 +64,6 @@
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -98,15 +109,6 @@
     </dependencies>
     <build>
         <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -206,6 +206,16 @@ public class AdapterDeploymentContext {
         public void setBearerOnly(boolean bearerOnly) {
             delegate.setBearerOnly(bearerOnly);
         }
+        
+        @Override
+        public boolean isAutodetectBearerOnly() {
+            return delegate.isAutodetectBearerOnly();
+        }
+        
+        @Override
+        public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
+            delegate.setAutodetectBearerOnly(autodetectBearerOnly);
+        }
 
         @Override
         public boolean isEnableBasicAuth() {
@@ -277,6 +287,16 @@ public class AdapterDeploymentContext {
             delegate.setSslRequired(sslRequired);
         }
 
+        @Override
+        public int getConfidentialPort() {
+            return delegate.getConfidentialPort();
+        }
+
+        @Override
+        public void setConfidentialPort(int confidentialPort) {
+            delegate.setConfidentialPort(confidentialPort);
+        }
+
         @Override
         public TokenStore getTokenStore() {
             return delegate.getTokenStore();
@@ -287,6 +307,16 @@ public class AdapterDeploymentContext {
             delegate.setTokenStore(tokenStore);
         }
 
+        @Override
+        public String getAdapterStateCookiePath() {
+            return delegate.getAdapterStateCookiePath();
+        }
+
+        @Override
+        public void setAdapterStateCookiePath(String adapterStateCookiePath) {
+            delegate.setAdapterStateCookiePath(adapterStateCookiePath);
+        }
+
         @Override
         public String getStateCookieName() {
             return delegate.getStateCookieName();
@@ -462,6 +492,16 @@ public class AdapterDeploymentContext {
         public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
             delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
         }
+
+        @Override
+        public boolean isVerifyTokenAudience() {
+            return delegate.isVerifyTokenAudience();
+        }
+
+        @Override
+        public void setVerifyTokenAudience(boolean verifyTokenAudience) {
+            delegate.setVerifyTokenAudience(verifyTokenAudience);
+        }
     }
 
     protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -101,6 +101,18 @@ public class AuthenticatedActionsHandler {
         if (!deployment.isCors()) return false;
         KeycloakSecurityContext securityContext = facade.getSecurityContext();
         String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
+        String exposeHeaders = deployment.getCorsExposedHeaders();
+
+        if (deployment.getPolicyEnforcer() != null) {
+            if (exposeHeaders != null) {
+                exposeHeaders += ",";
+            } else {
+                exposeHeaders = "";
+            }
+
+            exposeHeaders += "WWW-Authenticate";
+        }
+
         String requestOrigin = UriUtils.getOrigin(facade.getRequest().getURI());
         log.debugv("Origin: {0} uri: {1}", origin, facade.getRequest().getURI());
         if (securityContext != null && origin != null && !origin.equals(requestOrigin)) {
@@ -124,6 +136,9 @@ public class AuthenticatedActionsHandler {
             facade.getResponse().setStatus(200);
             facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
             facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
+            if (exposeHeaders != null) {
+                facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, exposeHeaders);
+            }
         } else {
             log.debugv("cors validation not needed as we're not a secure session or origin header was null: {0}", facade.getRequest().getURI());
         }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BasicAuthRequestAuthenticator.java

@@ -71,9 +71,10 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         AccessTokenResponse atr=null;        
         try {
             String userpw=new String(Base64.decode(tokenString));
-            String[] parts=userpw.split(":");
-            
-            atr = getToken(parts[0], parts[1]);
+            int seperatorIndex = userpw.indexOf(":");
+            String user = userpw.substring(0, seperatorIndex);
+            String pw = userpw.substring(seperatorIndex + 1);
+            atr = getToken(user, pw);
             tokenString = atr.getToken();
         } catch (Exception e) {
             log.debug("Failed to obtain token", e);
@@ -82,9 +83,9 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         }
 
         return authenticateToken(exchange, atr.getToken());
-    }
-    
-    private AccessTokenResponse getToken(String username, String password) throws Exception {
+    } 
+ 
+    protected AccessTokenResponse getToken(String username, String password) throws Exception {
     	AccessTokenResponse tokenResponse=null;
     	HttpClient client = deployment.getClient();
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BearerTokenRequestAuthenticator.java

@@ -18,11 +18,13 @@
 package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 
 import javax.security.cert.X509Certificate;
@@ -70,8 +72,12 @@ public class BearerTokenRequestAuthenticator {
         for (String authHeader : authHeaders) {
             String[] split = authHeader.trim().split("\\s+");
             if (split == null || split.length != 2) continue;
-            if (!split[0].equalsIgnoreCase("Bearer")) continue;
-            tokenString = split[1];
+            if (split[0].equalsIgnoreCase("Bearer")) {
+                tokenString = split[1];
+
+                log.debugf("Found [%d] values in authorization header, selecting the first value for Bearer.", (Integer) authHeaders.size());
+                break;
+            };
         }
 
         if (tokenString == null) {
@@ -83,8 +89,18 @@ public class BearerTokenRequestAuthenticator {
     }
     
     protected AuthOutcome authenticateToken(HttpFacade exchange, String tokenString) {
+        log.debug("Verifying access_token");
+        if (log.isTraceEnabled()) {
+            try {
+                JWSInput jwsInput = new JWSInput(tokenString);
+                String wireString = jwsInput.getWireString();
+                log.tracef("\taccess_token: %s", wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
+            } catch (JWSInputException e) {
+                log.errorf(e, "Failed to parse access_token: %s", tokenString);
+            }
+        }
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            token = AdapterTokenVerifier.verifyToken(tokenString, deployment);
         } catch (VerificationException e) {
             log.error("Failed to verify token", e);
             challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.INVALID_TOKEN, "invalid_token", e.getMessage());
@@ -124,6 +140,7 @@ public class BearerTokenRequestAuthenticator {
             }
             surrogate = chain[0].getSubjectDN().getName();
         }
+        log.debug("successful authorized");
         return AuthOutcome.AUTHENTICATED;
     }
 
@@ -161,10 +178,19 @@ public class BearerTokenRequestAuthenticator {
 
             @Override
             public boolean challenge(HttpFacade facade) {
+                if (deployment.getPolicyEnforcer() != null) {
+                    deployment.getPolicyEnforcer().enforce(OIDCHttpFacade.class.cast(facade));
+                    return true;
+                }
                 OIDCAuthenticationError error = new OIDCAuthenticationError(reason, description);
                 facade.getRequest().setError(error);
                 facade.getResponse().addHeader("WWW-Authenticate", challenge);
-                facade.getResponse().sendError(401);
+                if(deployment.isDelegateBearerErrorResponseSending()){
+                    facade.getResponse().setStatus(401);
+                }
+                else {
+                    facade.getResponse().sendError(401);
+                }
                 return true;
             }
         };

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/CookieTokenStore.java

@@ -19,7 +19,8 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.TokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.KeycloakUriBuilder;
@@ -46,7 +47,7 @@ public class CookieTokenStore {
                 .append(idToken).append(DELIM)
                 .append(refreshToken).toString();
 
-        String cookiePath = getContextPath(facade);
+        String cookiePath = getCookiePath(deployment, facade);
         facade.getResponse().setCookie(AdapterConstants.KEYCLOAK_ADAPTER_STATE_COOKIE, cookie, cookiePath, null, -1, deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr()), true);
     }
 
@@ -71,7 +72,11 @@ public class CookieTokenStore {
 
         try {
             // Skip check if token is active now. It's supposed to be done later by the caller
-            AccessToken accessToken = AdapterRSATokenVerifier.verifyToken(accessTokenString, deployment, false, true);
+            TokenVerifier<AccessToken> tokenVerifier = AdapterTokenVerifier.createVerifier(accessTokenString, deployment, true, AccessToken.class)
+                    .checkActive(false)
+                    .verify();
+            AccessToken accessToken = tokenVerifier.getToken();
+
             IDToken idToken;
             if (idTokenString != null && idTokenString.length() > 0) {
                 try {
@@ -93,14 +98,30 @@ public class CookieTokenStore {
         }
     }
 
-    public static void removeCookie(HttpFacade facade) {
-        String cookiePath = getContextPath(facade);
+    public static void removeCookie(KeycloakDeployment deployment, HttpFacade facade) {
+        String cookiePath = getCookiePath(deployment, facade);
         facade.getResponse().resetCookie(AdapterConstants.KEYCLOAK_ADAPTER_STATE_COOKIE, cookiePath);
     }
 
-    private static String getContextPath(HttpFacade facade) {
+    static String getCookiePath(KeycloakDeployment deployment, HttpFacade facade) {
+        String path = deployment.getAdapterStateCookiePath() == null ? "" : deployment.getAdapterStateCookiePath().trim();
+        if (path.startsWith("/")) {
+            return path;
+        }
+        String contextPath = getContextPath(facade);
+        StringBuilder cookiePath = new StringBuilder(contextPath);
+        if (!contextPath.endsWith("/") && !path.isEmpty()) {
+            cookiePath.append("/");
+        }
+        return cookiePath.append(path).toString();
+    }
+
+    static String getContextPath(HttpFacade facade) {
         String uri = facade.getRequest().getURI();
         String path = KeycloakUriBuilder.fromUri(uri).getPath();
+        if (path == null || path.isEmpty()) {
+            return "/";
+        }
         int index = path.indexOf("/", 1);
         return index == -1 ? path : path.substring(0, index);
     }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/CorsHeaders.java

@@ -30,4 +30,5 @@ public interface CorsHeaders {
     String ORIGIN = "Origin";
     String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";
     String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";
+    String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpClientBuilder.java

@@ -57,6 +57,8 @@ import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
+import org.apache.http.client.params.ClientPNames;
+import org.apache.http.client.params.CookiePolicy;
 
 /**
  * Abstraction for creating HttpClients. Allows SSL configuration.
@@ -170,8 +172,8 @@ public class HttpClientBuilder {
         return this;
     }
 
-    public HttpClientBuilder disableCookieCache() {
-        this.disableCookieCache = true;
+    public HttpClientBuilder disableCookieCache(boolean disable) {
+        this.disableCookieCache = disable;
         return this;
     }
 
@@ -289,6 +291,7 @@ public class HttpClientBuilder {
                 cm = new SingleClientConnManager(registry);
             }
             BasicHttpParams params = new BasicHttpParams();
+            params.setParameter(ClientPNames.COOKIE_POLICY, CookiePolicy.BROWSER_COMPATIBILITY);
 
             if (proxyHost != null) {
                 params.setParameter(ConnRoutePNames.DEFAULT_PROXY, proxyHost);
@@ -334,7 +337,7 @@ public class HttpClientBuilder {
     }
 
     public HttpClient build(AdapterHttpClientConfig adapterConfig) {
-        disableCookieCache(); // disable cookie cache as we don't want sticky sessions for load balancing
+        disableCookieCache(true); // disable cookie cache as we don't want sticky sessions for load balancing
 
         String truststorePath = adapterConfig.getTruststore();
         if (truststorePath != null) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java

@@ -35,6 +35,8 @@ import java.util.Map;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
+ * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class KeycloakDeployment {
@@ -66,13 +68,16 @@ public class KeycloakDeployment {
 
     protected String scope;
     protected SslRequired sslRequired = SslRequired.ALL;
+    protected int confidentialPort = -1;
     protected TokenStore tokenStore = TokenStore.SESSION;
+    protected String adapterStateCookiePath = "";
     protected String stateCookieName = "OAuth_Token_Request_State";
     protected boolean useResourceRoleMappings;
     protected boolean cors;
     protected int corsMaxAge = -1;
     protected String corsAllowedHeaders;
     protected String corsAllowedMethods;
+    protected String corsExposedHeaders;
     protected boolean exposeToken;
     protected boolean alwaysRefreshToken;
     protected boolean registerNodeAtStartup;
@@ -85,6 +90,15 @@ public class KeycloakDeployment {
     protected int publicKeyCacheTtl;
     private PolicyEnforcer policyEnforcer;
 
+    // https://tools.ietf.org/html/rfc7636
+    protected boolean pkce = false;
+    protected boolean ignoreOAuthQueryParameter;
+
+    protected Map<String, String> redirectRewriteRules;
+
+    protected boolean delegateBearerErrorResponseSending = false;
+    protected boolean verifyTokenAudience = false;
+
     public KeycloakDeployment() {
     }
 
@@ -142,6 +156,8 @@ public class KeycloakDeployment {
             log.debug("resolveUrls");
         }
 
+        authServerBaseUrl = authUrlBuilder.build().toString();
+
         String login = authUrlBuilder.clone().path(ServiceUrlConstants.AUTH_PATH).build(getRealm()).toString();
         authUrl = KeycloakUriBuilder.fromUri(login);
         realmInfoUrl = authUrlBuilder.clone().path(ServiceUrlConstants.REALM_INFO_PATH).build(getRealm()).toString();
@@ -266,6 +282,14 @@ public class KeycloakDeployment {
         this.sslRequired = sslRequired;
     }
 
+    public int getConfidentialPort() {
+        return confidentialPort;
+    }
+
+    public void setConfidentialPort(int confidentialPort) {
+        this.confidentialPort = confidentialPort;
+    }
+
     public TokenStore getTokenStore() {
         return tokenStore;
     }
@@ -274,6 +298,14 @@ public class KeycloakDeployment {
         this.tokenStore = tokenStore;
     }
 
+    public String getAdapterStateCookiePath() {
+        return adapterStateCookiePath;
+    }
+
+    public void setAdapterStateCookiePath(String adapterStateCookiePath) {
+        this.adapterStateCookiePath = adapterStateCookiePath;
+    }
+
     public String getStateCookieName() {
         return stateCookieName;
     }
@@ -322,6 +354,14 @@ public class KeycloakDeployment {
         this.corsAllowedMethods = corsAllowedMethods;
     }
 
+    public String getCorsExposedHeaders() {
+        return corsExposedHeaders;
+    }
+
+    public void setCorsExposedHeaders(String corsExposedHeaders) {
+        this.corsExposedHeaders = corsExposedHeaders;
+    }
+
     public boolean isExposeToken() {
         return exposeToken;
     }
@@ -414,4 +454,45 @@ public class KeycloakDeployment {
     public PolicyEnforcer getPolicyEnforcer() {
         return policyEnforcer;
     }
+
+    // https://tools.ietf.org/html/rfc7636
+    public boolean isPkce() {
+        return pkce;
+    }
+
+    public void setPkce(boolean pkce) {
+        this.pkce = pkce;
+    }
+
+    public void setIgnoreOAuthQueryParameter(boolean ignoreOAuthQueryParameter) {
+        this.ignoreOAuthQueryParameter = ignoreOAuthQueryParameter;
+    }
+
+    public boolean isOAuthQueryParameterEnabled() {
+        return !this.ignoreOAuthQueryParameter;
+    }
+
+    public Map<String, String> getRedirectRewriteRules() {
+        return redirectRewriteRules;
+    }
+
+    public void setRewriteRedirectRules(Map<String, String> redirectRewriteRules) {
+        this.redirectRewriteRules = redirectRewriteRules;
+    }
+
+    public boolean isDelegateBearerErrorResponseSending() {
+        return delegateBearerErrorResponseSending;
+    }
+
+    public void setDelegateBearerErrorResponseSending(boolean delegateBearerErrorResponseSending) {
+        this.delegateBearerErrorResponseSending = delegateBearerErrorResponseSending;
+    }
+
+    public boolean isVerifyTokenAudience() {
+        return verifyTokenAudience;
+    }
+
+    public void setVerifyTokenAudience(boolean verifyTokenAudience) {
+        this.verifyTokenAudience = verifyTokenAudience;
+    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java

@@ -37,6 +37,8 @@ import java.security.PublicKey;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
+ * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class KeycloakDeploymentBuilder {
@@ -76,11 +78,19 @@ public class KeycloakDeploymentBuilder {
         } else {
             deployment.setSslRequired(SslRequired.EXTERNAL);
         }
+
+        if (adapterConfig.getConfidentialPort() != -1) {
+            deployment.setConfidentialPort(adapterConfig.getConfidentialPort());
+        }
+
         if (adapterConfig.getTokenStore() != null) {
             deployment.setTokenStore(TokenStore.valueOf(adapterConfig.getTokenStore().toUpperCase()));
         } else {
             deployment.setTokenStore(TokenStore.SESSION);
         }
+        if (adapterConfig.getTokenCookiePath() != null) {
+            deployment.setAdapterStateCookiePath(adapterConfig.getTokenCookiePath());
+        }
         if (adapterConfig.getPrincipalAttribute() != null) deployment.setPrincipalAttribute(adapterConfig.getPrincipalAttribute());
 
         deployment.setResourceCredentials(adapterConfig.getCredentials());
@@ -96,6 +106,12 @@ public class KeycloakDeploymentBuilder {
             deployment.setCorsMaxAge(adapterConfig.getCorsMaxAge());
             deployment.setCorsAllowedHeaders(adapterConfig.getCorsAllowedHeaders());
             deployment.setCorsAllowedMethods(adapterConfig.getCorsAllowedMethods());
+            deployment.setCorsExposedHeaders(adapterConfig.getCorsExposedHeaders());
+        }
+
+        // https://tools.ietf.org/html/rfc7636
+        if (adapterConfig.isPkce()) {
+            deployment.setPkce(true);
         }
 
         deployment.setBearerOnly(adapterConfig.isBearerOnly());
@@ -107,6 +123,9 @@ public class KeycloakDeploymentBuilder {
         deployment.setTokenMinimumTimeToLive(adapterConfig.getTokenMinimumTimeToLive());
         deployment.setMinTimeBetweenJwksRequests(adapterConfig.getMinTimeBetweenJwksRequests());
         deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());
+        deployment.setIgnoreOAuthQueryParameter(adapterConfig.isIgnoreOAuthQueryParameter());
+        deployment.setRewriteRedirectRules(adapterConfig.getRedirectRewriteRules());
+        deployment.setVerifyTokenAudience(adapterConfig.isVerifyTokenAudience());
 
         if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
             throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -19,13 +19,12 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.adapters.spi.AdapterSessionStore;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.Encode;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.constants.AdapterConstants;
@@ -38,7 +37,9 @@ import org.keycloak.representations.IDToken;
 import org.keycloak.util.TokenUtil;
 
 import java.io.IOException;
-import java.util.concurrent.atomic.AtomicLong;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Map;
 
 
 /**
@@ -64,7 +65,7 @@ public class OAuthRequestAuthenticator {
         this.reqAuthenticator = requestAuthenticator;
         this.facade = facade;
         this.deployment = deployment;
-        this.sslRedirectPort = sslRedirectPort;
+        this.sslRedirectPort = deployment.getConfidentialPort() != -1 ? deployment.getConfidentialPort() : sslRedirectPort;
         this.tokenStore = tokenStore;
     }
 
@@ -141,6 +142,7 @@ public class OAuthRequestAuthenticator {
     protected String getRedirectUri(String state) {
         String url = getRequestUrl();
         log.debugf("callback uri: %s", url);
+      
         if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
             int port = sslRedirectPort();
             if (port < 0) {
@@ -167,10 +169,13 @@ public class OAuthRequestAuthenticator {
         String maxAge = getQueryParamValue(OAuth2Constants.MAX_AGE);
         url = UriUtils.stripQueryParam(url, OAuth2Constants.MAX_AGE);
 
+        String uiLocales = getQueryParamValue(OAuth2Constants.UI_LOCALES_PARAM);
+        url = UriUtils.stripQueryParam(url, OAuth2Constants.UI_LOCALES_PARAM);
+
         KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, Encode.encodeQueryParamAsIs(url)) // Need to encode uri ourselves as queryParam() will not encode % characters.
+                .queryParam(OAuth2Constants.REDIRECT_URI, rewrittenRedirectUri(url))
                 .queryParam(OAuth2Constants.STATE, state)
                 .queryParam("login", "true");
         if(loginHint != null && loginHint.length() > 0){
@@ -185,6 +190,9 @@ public class OAuthRequestAuthenticator {
         if (maxAge != null && maxAge.length() > 0) {
             redirectUriBuilder.queryParam(OAuth2Constants.MAX_AGE, maxAge);
         }
+        if (uiLocales != null && uiLocales.length() > 0) {
+            redirectUriBuilder.queryParam(OAuth2Constants.UI_LOCALES_PARAM, uiLocales);
+        }
 
         scope = TokenUtil.attachOIDCScope(scope);
         redirectUriBuilder.queryParam(OAuth2Constants.SCOPE, scope);
@@ -320,14 +328,15 @@ public class OAuthRequestAuthenticator {
 
         AccessTokenResponse tokenResponse = null;
         strippedOauthParametersRequestUri = stripOauthParametersFromRedirect();
+    
         try {
             // For COOKIE store we don't have httpSessionId and single sign-out won't be available
             String httpSessionId = deployment.getTokenStore() == TokenStore.SESSION ? reqAuthenticator.changeHttpSessionId(true) : null;
-            tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, strippedOauthParametersRequestUri, httpSessionId);
+            tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, rewrittenRedirectUri(strippedOauthParametersRequestUri), httpSessionId);
         } catch (ServerRequest.HttpFailure failure) {
             log.error("failed to turn code into token");
             log.error("status from server: " + failure.getStatus());
-            if (failure.getStatus() == 400 && failure.getError() != null) {
+            if (failure.getError() != null) {
                 log.error("   " + failure.getError());
             }
             return challenge(403, OIDCAuthenticationError.Reason.CODE_TO_TOKEN_FAILURE, null);
@@ -340,16 +349,18 @@ public class OAuthRequestAuthenticator {
         tokenString = tokenResponse.getToken();
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
+
+        log.debug("Verifying tokens");
+        if (log.isTraceEnabled()) {
+            logToken("\taccess_token", tokenString);
+            logToken("\tid_token", idTokenString);
+            logToken("\trefresh_token", refreshToken);
+        }
+
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
-            if (idTokenString != null) {
-                try {
-                    JWSInput input = new JWSInput(idTokenString);
-                    idToken = input.readJsonContent(IDToken.class);
-                } catch (JWSInputException e) {
-                    throw new VerificationException();
-                }
-            }
+            AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, idTokenString, deployment);
+            token = tokens.getAccessToken();
+            idToken = tokens.getIdToken();
             log.debug("Token Verification succeeded!");
         } catch (VerificationException e) {
             log.error("failed verification of token: " + e.getMessage());
@@ -372,9 +383,36 @@ public class OAuthRequestAuthenticator {
     protected String stripOauthParametersFromRedirect() {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(facade.getRequest().getURI())
                 .replaceQueryParam(OAuth2Constants.CODE, null)
-                .replaceQueryParam(OAuth2Constants.STATE, null);
+                .replaceQueryParam(OAuth2Constants.STATE, null)
+                .replaceQueryParam(OAuth2Constants.SESSION_STATE, null);
         return builder.build().toString();
     }
+    
+    private String rewrittenRedirectUri(String originalUri) {
+        Map<String, String> rewriteRules = deployment.getRedirectRewriteRules();
+            if(rewriteRules != null && !rewriteRules.isEmpty()) {
+            try {
+                URL url = new URL(originalUri);
+                Map.Entry<String, String> rule =  rewriteRules.entrySet().iterator().next();
+                StringBuilder redirectUriBuilder = new StringBuilder(url.getProtocol());
+                redirectUriBuilder.append("://"+ url.getAuthority());
+                redirectUriBuilder.append(url.getPath().replaceFirst(rule.getKey(), rule.getValue()));
+                return redirectUriBuilder.toString();
+            } catch (MalformedURLException ex) {
+                log.error("Not a valid request url");
+                throw new RuntimeException(ex);
+            }
+            }
+        return originalUri;
+    }
 
-
+    private void logToken(String name, String token) {
+        try {
+            JWSInput jwsInput = new JWSInput(token);
+            String wireString = jwsInput.getWireString();
+            log.tracef("\t%s: %s", name, wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
+        } catch (JWSInputException e) {
+            log.errorf(e, "Failed to parse %s: %s", name, token);
+        }
+    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/PreAuthActionsHandler.java

@@ -20,30 +20,27 @@ package org.keycloak.adapters;
 import java.security.PublicKey;
 
 import org.jboss.logging.Logger;
+import org.keycloak.TokenVerifier;
 import org.keycloak.adapters.authentication.ClientCredentialsProvider;
 import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.spi.UserSessionManagement;
+import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.StreamUtil;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
 import org.keycloak.jose.jwk.JWKBuilder;
-import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.representations.JsonWebToken;
 import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
-import org.keycloak.jose.jws.crypto.RSAProvider;
-import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.representations.adapters.action.AdminAction;
 import org.keycloak.representations.adapters.action.LogoutAction;
 import org.keycloak.representations.adapters.action.PushNotBeforeAction;
 import org.keycloak.representations.adapters.action.TestAvailabilityAction;
 import org.keycloak.util.JsonSerialization;
 
-import java.security.PublicKey;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
@@ -213,17 +210,19 @@ public class PreAuthActionsHandler {
         }
 
         try {
-            JWSInput input = new JWSInput(token);
-            PublicKey publicKey = AdapterRSATokenVerifier.getPublicKey(input.getHeader().getKeyId(), deployment);
-            if (RSAProvider.verify(input, publicKey)) {
-                return input;
+            // Check just signature. Other things checked in validateAction
+            TokenVerifier tokenVerifier = AdapterTokenVerifier.createVerifier(token, deployment, false, JsonWebToken.class);
+            tokenVerifier.verify();
+            return new JWSInput(token);
+        } catch (VerificationException ignore) {
+            log.warn("admin request failed, unable to verify token: "  + ignore.getMessage());
+            if (log.isDebugEnabled()) {
+                log.debug(ignore.getMessage(), ignore);
             }
-        } catch (JWSInputException ignore) {
-        }
 
-        log.warn("admin request failed, unable to verify token");
-        facade.getResponse().sendError(403, "no token");
-        return null;
+            facade.getResponse().sendError(403, "token failed verification");
+            return null;
+        }
     }
 
 
@@ -250,6 +249,15 @@ public class PreAuthActionsHandler {
     protected void handleVersion()  {
         try {
             facade.getResponse().setStatus(200);
+            KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
+            if (deployment.isCors()) {
+                String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
+                if (origin == null) {
+                    log.debug("no origin header set in request");
+                } else {
+                    facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+                }
+            }
             facade.getResponse().setHeader("Content-Type", "application/json");
             JsonSerialization.writeValueToStream(facade.getResponse().getOutputStream(), VersionRepresentation.SINGLETON);
         } catch (Exception e) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/QueryParamterTokenRequestAuthenticator.java

@@ -22,6 +22,8 @@ import org.keycloak.adapters.spi.HttpFacade;
 
 /**
  * @author <a href="mailto:froehlich.ch@gmail.com">Christian Froehlich</a>
+ * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
+ * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class QueryParamterTokenRequestAuthenticator extends BearerTokenRequestAuthenticator {
@@ -33,6 +35,9 @@ public class QueryParamterTokenRequestAuthenticator extends BearerTokenRequestAu
     }
 
     public AuthOutcome authenticate(HttpFacade exchange) {
+        if(!deployment.isOAuthQueryParameterEnabled()) {
+            return AuthOutcome.NOT_ATTEMPTED;
+        }
         tokenString = null;
         tokenString = getAccessTokenFromQueryParamter(exchange);
         if (tokenString == null || tokenString.trim().isEmpty()) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RefreshableKeycloakSecurityContext.java

@@ -20,7 +20,7 @@ package org.keycloak.adapters;
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.Time;
 import org.keycloak.representations.AccessToken;
@@ -130,7 +130,8 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
         String tokenString = response.getToken();
         AccessToken token = null;
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, response.getIdToken(), deployment);
+            token = tokens.getAccessToken();
             log.debug("Token Verification succeeded!");
         } catch (VerificationException e) {
             log.error("failed verification of token");
@@ -155,7 +156,9 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
             this.refreshToken = response.getRefreshToken();
         }
         this.tokenString = tokenString;
-        tokenStore.refreshCallback(this);
+        if (tokenStore != null) {
+            tokenStore.refreshCallback(this);
+        }
         return true;
     }
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RequestAuthenticator.java

@@ -24,6 +24,7 @@ import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.common.enums.SslRequired;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -160,7 +161,8 @@ public abstract class RequestAuthenticator {
 
     protected boolean verifySSL() {
         if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
-            log.warn("SSL is required to authenticate");
+            log.warnf("SSL is required to authenticate. Remote address %s is secure: %s, SSL required for: %s .",
+                    facade.getRequest().getRemoteAddr(), facade.getRequest().isSecure(), deployment.getSslRequired().name());
             return true;
         }
         return false;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/ServerRequest.java

@@ -33,6 +33,8 @@ import org.keycloak.constants.AdapterConstants;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
 
+import org.jboss.logging.Logger;
+
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -46,6 +48,8 @@ import java.util.List;
  */
 public class ServerRequest {
 
+	private static Logger logger = Logger.getLogger(ServerRequest.class);
+
     public static class HttpFailure extends Exception {
         private int status;
         private String error;
@@ -136,6 +140,62 @@ public class ServerRequest {
         }
     }
 
+    // https://tools.ietf.org/html/rfc7636#section-4
+    public static AccessTokenResponse invokeAccessCodeToToken(KeycloakDeployment deployment, String code, String redirectUri, String sessionId, String codeVerifier) throws IOException, HttpFailure {
+        List<NameValuePair> formparams = new ArrayList<>();
+        redirectUri = stripOauthParametersFromRedirect(redirectUri);
+        formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, "authorization_code"));
+        formparams.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
+        formparams.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, redirectUri));
+        if (sessionId != null) {
+            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, sessionId));
+            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, HostUtils.getHostName()));
+        }
+        // https://tools.ietf.org/html/rfc7636#section-4
+        if (codeVerifier != null) {
+            logger.debugf("add to POST parameters of Token Request, codeVerifier = %s", codeVerifier);
+            formparams.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
+        } else {
+            logger.debug("add to POST parameters of Token Request without codeVerifier");
+        }
+
+        HttpPost post = new HttpPost(deployment.getTokenUrl());
+        ClientCredentialsProviderUtils.setClientCredentials(deployment, post, formparams);
+
+        UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
+        post.setEntity(form);
+        HttpResponse response = deployment.getClient().execute(post);
+        int status = response.getStatusLine().getStatusCode();
+        HttpEntity entity = response.getEntity();
+        if (status != 200) {
+            error(status, entity);
+        }
+        if (entity == null) {
+            throw new HttpFailure(status, null);
+        }
+        InputStream is = entity.getContent();
+        try {
+            ByteArrayOutputStream os = new ByteArrayOutputStream();
+            int c;
+            while ((c = is.read()) != -1) {
+                os.write(c);
+            }
+            byte[] bytes = os.toByteArray();
+            String json = new String(bytes);
+            try {
+                return JsonSerialization.readValue(json, AccessTokenResponse.class);
+            } catch (IOException e) {
+                throw new IOException(json, e);
+            }
+        } finally {
+            try {
+                is.close();
+            } catch (IOException ignored) {
+
+            }
+        }
+    }
+
     public static AccessTokenResponse invokeRefresh(KeycloakDeployment deployment, String refreshToken) throws IOException, HttpFailure {
         List<NameValuePair> formparams = new ArrayList<NameValuePair>();
         formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/ClientIdAndSecretCredentialsProvider.java

@@ -32,7 +32,7 @@ import java.util.Map;
  */
 public class ClientIdAndSecretCredentialsProvider implements ClientCredentialsProvider {
 
-    private static Logger logger = Logger.getLogger(ClientCredentialsProviderUtils.class);
+    private static Logger logger = Logger.getLogger(ClientIdAndSecretCredentialsProvider.class);
 
     public static final String PROVIDER_ID = CredentialRepresentation.SECRET;
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/JWTClientSecretCredentialsProvider.java

@@ -0,0 +1,97 @@
+package org.keycloak.adapters.authentication;
+
+import java.io.UnsupportedEncodingException;
+import java.util.Map;
+
+import javax.crypto.SecretKey;
+import javax.crypto.spec.SecretKeySpec;
+
+import org.jboss.logging.Logger;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.adapters.AdapterUtils;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.common.util.Time;
+import org.keycloak.jose.jws.JWSBuilder;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.representations.JsonWebToken;
+
+/**
+ * Client authentication based on JWT signed by client secret instead of private key .
+ * See <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">specs</a> for more details.
+ *
+ * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
+ */
+public class JWTClientSecretCredentialsProvider implements ClientCredentialsProvider {
+    
+	private static final Logger logger = Logger.getLogger(JWTClientSecretCredentialsProvider.class);
+	
+    public static final String PROVIDER_ID = "secret-jwt";
+    
+    private SecretKey clientSecret;
+    
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+    
+    @Override
+    public void init(KeycloakDeployment deployment, Object config) {
+        if (config == null || !(config instanceof Map)) {
+            throw new RuntimeException("Configuration of jwt credentials by client secret is missing or incorrect for client '" + deployment.getResourceName() + "'. Check your adapter configuration");
+        }
+        
+        Map<String, Object> cfg = (Map<String, Object>) config;
+        String clientSecretString = (String) cfg.get("secret");
+        if (clientSecretString == null) {
+            throw new RuntimeException("Missing parameter secret-jwt in configuration of jwt for client " + deployment.getResourceName());
+        }
+        setClientSecret(clientSecretString); 
+    }
+    
+    @Override
+    public void setClientCredentials(KeycloakDeployment deployment, Map<String, String> requestHeaders, Map<String, String> formParams) {
+        String signedToken = createSignedRequestToken(deployment.getResourceName(), deployment.getRealmInfoUrl());
+        formParams.put(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT);
+        formParams.put(OAuth2Constants.CLIENT_ASSERTION, signedToken);
+    }
+   
+    public void setClientSecret(String clientSecretString) {
+        // Get client secret and validate signature
+        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
+        // The HMAC (Hash-based Message Authentication Code) is calculated using the octets of the UTF-8 representation of the client_secret as the shared key. 
+        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>
+        // because it must be implemented in every java platform.
+    	try {
+            clientSecret = new SecretKeySpec(clientSecretString.getBytes("UTF-8"), "HmacSHA256");
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException("Failed to create secret key spec due to unsupported encoding.");
+        }
+    }
+    
+    public String createSignedRequestToken(String clientId, String realmInfoUrl) {
+        JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
+        // JOSE header {"alg":"HS256","typ" : "JWT"} no need "kid" due to using only one registered client secret.
+        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>.
+        // because it must be implemented in every java platform.
+        return new JWSBuilder().jsonContent(jwt).hmac256(clientSecret);
+    }
+
+    private JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
+        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
+        // JWT claims is the same as one by private_key_jwt
+        
+        JsonWebToken reqToken = new JsonWebToken();
+        reqToken.id(AdapterUtils.generateId());
+        reqToken.issuer(clientId);
+        reqToken.subject(clientId);
+        reqToken.audience(realmInfoUrl);
+
+        int now = Time.currentTime();
+        reqToken.issuedAt(now);
+        // the same as in KEYCLOAK-2986, JWTClientCredentialsProvider's timeout field
+        reqToken.expiration(now + 10);
+        reqToken.notBefore(now);
+        return reqToken;
+    }
+
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -17,26 +17,30 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.net.URI;
+import java.util.ArrayList;
+import java.util.Collection;
 import java.util.Collections;
-import java.util.HashSet;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 import java.util.Set;
 
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.spi.HttpFacade.Request;
-import org.keycloak.adapters.spi.HttpFacade.Response;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.representation.ResourceRepresentation;
-import org.keycloak.authorization.client.resource.ProtectedResource;
+import org.keycloak.authorization.client.ClientAuthorizationContext;
 import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.AccessToken.Authorization;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.MethodConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.ScopeEnforcementMode;
 import org.keycloak.representations.idm.authorization.Permission;
 
 /**
@@ -45,98 +49,119 @@ import org.keycloak.representations.idm.authorization.Permission;
 public abstract class AbstractPolicyEnforcer {
 
     private static Logger LOGGER = Logger.getLogger(AbstractPolicyEnforcer.class);
-    private final PolicyEnforcerConfig enforcerConfig;
+    private static final String HTTP_METHOD_DELETE = "DELETE";
+
     private final PolicyEnforcer policyEnforcer;
 
-    private Map<String, PathConfig> paths;
-    private AuthzClient authzClient;
-    private PathMatcher pathMatcher;
-
-    public AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
+    protected AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
         this.policyEnforcer = policyEnforcer;
-        this.enforcerConfig = policyEnforcer.getEnforcerConfig();
-        this.authzClient = policyEnforcer.getClient();
-        this.pathMatcher = new PathMatcher();
-        this.paths = policyEnforcer.getPaths();
     }
 
     public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
-        EnforcementMode enforcementMode = this.enforcerConfig.getEnforcementMode();
+        EnforcementMode enforcementMode = getEnforcerConfig().getEnforcementMode();
 
         if (EnforcementMode.DISABLED.equals(enforcementMode)) {
             return createEmptyAuthorizationContext(true);
         }
 
+        Request request = httpFacade.getRequest();
+        PathConfig pathConfig = getPathConfig(request);
         KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
 
-        if (securityContext != null) {
-            AccessToken accessToken = securityContext.getToken();
+        if (securityContext == null) {
+            if (!isDefaultAccessDeniedUri(request)) {
+                if (pathConfig != null) {
+                    if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
+                        return createEmptyAuthorizationContext(true);
+                    } else {
+                        challenge(pathConfig, getRequiredScopes(pathConfig, request), httpFacade);
+                    }
+                } else {
+                    handleAccessDenied(httpFacade);
+                }
+            }
+            return createEmptyAuthorizationContext(false);
+        }
 
-            if (accessToken != null) {
-                Request request = httpFacade.getRequest();
-                Response response = httpFacade.getResponse();
-                String path = getPath(request);
-                PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
+        AccessToken accessToken = securityContext.getToken();
 
+        if (accessToken != null) {
+            if (LOGGER.isDebugEnabled()) {
                 LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
+            }
 
-                if (pathConfig == null) {
-                    if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
-                        return createAuthorizationContext(accessToken);
-                    }
-
-                    LOGGER.debugf("Could not find a configuration for path [%s]", path);
-                    response.sendError(403, "Could not find a configuration for path [" + path + "].");
-
-                    return createEmptyAuthorizationContext(false);
+            if (pathConfig == null) {
+                if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
+                    return createAuthorizationContext(accessToken, null);
                 }
 
-                if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                    return createEmptyAuthorizationContext(true);
+                if (LOGGER.isDebugEnabled()) {
+                    LOGGER.debugf("Could not find a configuration for path [%s]", getPath(request));
                 }
 
-                PathConfig actualPathConfig = resolvePathConfig(pathConfig, request);
-                Set<String> requiredScopes = getRequiredScopes(actualPathConfig, request);
-
-                if (isAuthorized(actualPathConfig, requiredScopes, accessToken, httpFacade)) {
-                    try {
-                        return createAuthorizationContext(accessToken);
-                    } catch (Exception e) {
-                        throw new RuntimeException("Error processing path [" + actualPathConfig.getPath() + "].", e);
-                    }
+                if (isDefaultAccessDeniedUri(request)) {
+                    return createAuthorizationContext(accessToken, null);
                 }
 
-                if (!challenge(actualPathConfig, requiredScopes, httpFacade)) {
-                    LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
-                    response.sendError(403, "Authorization failed.");
+                handleAccessDenied(httpFacade);
+
+                return createEmptyAuthorizationContext(false);
+            }
+
+            if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
+                return createAuthorizationContext(accessToken, pathConfig);
+            }
+
+            MethodConfig methodConfig = getRequiredScopes(pathConfig, request);
+            Map<String, List<String>> claims = resolveClaims(pathConfig, httpFacade);
+
+            if (isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims)) {
+                try {
+                    return createAuthorizationContext(accessToken, pathConfig);
+                } catch (Exception e) {
+                    throw new RuntimeException("Error processing path [" + pathConfig.getPath() + "].", e);
                 }
             }
+
+            if (methodConfig != null && ScopeEnforcementMode.DISABLED.equals(methodConfig.getScopesEnforcementMode())) {
+                return createEmptyAuthorizationContext(true);
+            }
+
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
+            }
+
+            if (!challenge(pathConfig, methodConfig, httpFacade)) {
+                if (LOGGER.isDebugEnabled()) {
+                    LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
+                }
+                handleAccessDenied(httpFacade);
+            }
         }
 
         return createEmptyAuthorizationContext(false);
     }
 
-    protected abstract boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade);
+    protected abstract boolean challenge(PathConfig pathConfig, MethodConfig methodConfig, OIDCHttpFacade facade);
 
-    protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
         Request request = httpFacade.getRequest();
-        PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
 
-        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
+        if (isDefaultAccessDeniedUri(request)) {
             return true;
         }
 
-        AccessToken.Authorization authorization = accessToken.getAuthorization();
+        Authorization authorization = accessToken.getAuthorization();
 
         if (authorization == null) {
             return false;
         }
 
-        List<Permission> permissions = authorization.getPermissions();
         boolean hasPermission = false;
+        Collection<Permission> grantedPermissions = authorization.getPermissions();
 
-        for (Permission permission : permissions) {
-            if (permission.getResourceSetId() != null) {
+        for (Permission permission : grantedPermissions) {
+            if (permission.getResourceId() != null) {
                 if (isResourcePermission(actualPathConfig, permission)) {
                     hasPermission = true;
 
@@ -144,16 +169,19 @@ public abstract class AbstractPolicyEnforcer {
                         continue;
                     }
 
-                    if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
-                        LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, permissions);
-                        if (request.getMethod().equalsIgnoreCase("DELETE") && actualPathConfig.isInstance()) {
-                            this.paths.remove(actualPathConfig);
+                    if (hasResourceScopePermission(methodConfig, permission)) {
+                        if (LOGGER.isDebugEnabled()) {
+                            LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, grantedPermissions);
                         }
-                        return true;
+                        if (HTTP_METHOD_DELETE.equalsIgnoreCase(request.getMethod()) && actualPathConfig.isInstance()) {
+                            policyEnforcer.getPathMatcher().removeFromCache(getPath(request));
+                        }
+
+                        return hasValidClaims(permission, claims);
                     }
                 }
             } else {
-                if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
+                if (hasResourceScopePermission(methodConfig, permission)) {
                     hasPermission = true;
                     return true;
                 }
@@ -164,41 +192,81 @@ public abstract class AbstractPolicyEnforcer {
             return true;
         }
 
-        LOGGER.debugf("Authorization FAILED for path [%s]. No enough permissions [%s].", actualPathConfig, permissions);
+        if (LOGGER.isDebugEnabled()) {
+            LOGGER.debugf("Authorization FAILED for path [%s]. Not enough permissions [%s].", actualPathConfig, grantedPermissions);
+        }
 
         return false;
     }
 
-    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
-        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
+    private boolean hasValidClaims(Permission permission, Map<String, List<String>> claims) {
+        Map<String, Set<String>> grantedClaims = permission.getClaims();
 
-        if (accessDeniedPath != null) {
-            if (request.getURI().contains(accessDeniedPath)) {
-                return true;
+        if (grantedClaims != null) {
+            if (claims.isEmpty()) {
+                return false;
+            }
+
+            for (Entry<String, Set<String>> entry : grantedClaims.entrySet()) {
+                List<String> requestClaims = claims.get(entry.getKey());
+
+                if (requestClaims == null || requestClaims.isEmpty() || !entry.getValue().containsAll(requestClaims)) {
+                    return false;
+                }
             }
         }
-        return false;
+
+        return true;
     }
 
-    private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
-        Set<String> allowedScopes = permission.getScopes();
-        return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
+    protected void handleAccessDenied(OIDCHttpFacade httpFacade) {
+        httpFacade.getResponse().sendError(403);
     }
 
     protected AuthzClient getAuthzClient() {
-        return this.authzClient;
+        return policyEnforcer.getClient();
     }
 
     protected PolicyEnforcerConfig getEnforcerConfig() {
-        return enforcerConfig;
+        return policyEnforcer.getEnforcerConfig();
     }
 
     protected PolicyEnforcer getPolicyEnforcer() {
         return policyEnforcer;
     }
 
+    private boolean isDefaultAccessDeniedUri(Request request) {
+        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
+        return accessDeniedPath != null && request.getURI().contains(accessDeniedPath);
+    }
+
+    private boolean hasResourceScopePermission(MethodConfig methodConfig, Permission permission) {
+        List<String> requiredScopes = methodConfig.getScopes();
+        Set<String> allowedScopes = permission.getScopes();
+
+        if (allowedScopes.isEmpty()) {
+            return true;
+        }
+
+        PolicyEnforcerConfig.ScopeEnforcementMode enforcementMode = methodConfig.getScopesEnforcementMode();
+
+        if (PolicyEnforcerConfig.ScopeEnforcementMode.ALL.equals(enforcementMode)) {
+            return allowedScopes.containsAll(requiredScopes);
+        }
+
+        if (PolicyEnforcerConfig.ScopeEnforcementMode.ANY.equals(enforcementMode)) {
+            for (String requiredScope : requiredScopes) {
+                if (allowedScopes.contains(requiredScope)) {
+                    return true;
+                }
+            }
+        }
+
+        return requiredScopes.isEmpty();
+    }
+
     private AuthorizationContext createEmptyAuthorizationContext(final boolean granted) {
-        return new AuthorizationContext() {
+        return new ClientAuthorizationContext(getAuthzClient()) {
             @Override
             public boolean hasPermission(String resourceName, String scopeName) {
                 return granted;
@@ -226,54 +294,38 @@ public abstract class AbstractPolicyEnforcer {
         };
     }
 
-    private PathConfig resolvePathConfig(PathConfig originalConfig, Request request) {
-        String path = getPath(request);
-
-        if (originalConfig.hasPattern()) {
-            ProtectedResource resource = this.authzClient.protection().resource();
-            Set<String> search = resource.findByFilter("uri=" + path);
-
-            if (!search.isEmpty()) {
-                // resource does exist on the server, cache it
-                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
-                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
-
-                config.setScopes(originalConfig.getScopes());
-                config.setMethods(originalConfig.getMethods());
-                config.setParentConfig(originalConfig);
-                config.setEnforcementMode(originalConfig.getEnforcementMode());
-
-                this.policyEnforcer.addPath(config);
-
-                return config;
-            }
-        }
-
-        return originalConfig;
-    }
-
     private String getPath(Request request) {
         return request.getRelativePath();
     }
 
-    private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
-        Set<String> requiredScopes = new HashSet<>();
-
-        requiredScopes.addAll(pathConfig.getScopes());
-
+    private MethodConfig getRequiredScopes(PathConfig pathConfig, Request request) {
         String method = request.getMethod();
 
-        for (PolicyEnforcerConfig.MethodConfig methodConfig : pathConfig.getMethods()) {
+        for (MethodConfig methodConfig : pathConfig.getMethods()) {
             if (methodConfig.getMethod().equals(method)) {
-                requiredScopes.addAll(methodConfig.getScopes());
+                return methodConfig;
             }
         }
 
-        return requiredScopes;
+        MethodConfig methodConfig = new MethodConfig();
+
+        methodConfig.setMethod(request.getMethod());
+        List scopes = new ArrayList<>();
+
+        if (Boolean.TRUE.equals(getEnforcerConfig().getHttpMethodAsScope())) {
+            scopes.add(request.getMethod());
+        } else {
+            scopes.addAll(pathConfig.getScopes());
+        }
+
+        methodConfig.setScopes(scopes);
+        methodConfig.setScopesEnforcementMode(PolicyEnforcerConfig.ScopeEnforcementMode.ANY);
+
+        return methodConfig;
     }
 
-    private AuthorizationContext createAuthorizationContext(AccessToken accessToken) {
-        return new AuthorizationContext(accessToken, this.paths);
+    private AuthorizationContext createAuthorizationContext(AccessToken accessToken, PathConfig pathConfig) {
+        return new ClientAuthorizationContext(accessToken, pathConfig, getAuthzClient());
     }
 
     private boolean isResourcePermission(PathConfig actualPathConfig, Permission permission) {
@@ -289,6 +341,32 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private boolean matchResourcePermission(PathConfig actualPathConfig, Permission permission) {
-        return permission.getResourceSetId().equals(actualPathConfig.getId());
+        return permission.getResourceId().equals(actualPathConfig.getId());
+    }
+
+    private PathConfig getPathConfig(Request request) {
+        return isDefaultAccessDeniedUri(request) ? null : policyEnforcer.getPathMatcher().matches(getPath(request));
+    }
+
+    protected Map<String, List<String>> resolveClaims(PathConfig pathConfig, OIDCHttpFacade httpFacade) {
+        Map<String, List<String>> claims = getClaims(getEnforcerConfig().getClaimInformationPointConfig(), httpFacade);
+
+        claims.putAll(getClaims(pathConfig.getClaimInformationPointConfig(), httpFacade));
+
+        return claims;
+    }
+
+    private Map<String, List<String>> getClaims(Map<String, Map<String, Object>>claimInformationPointConfig, HttpFacade httpFacade) {
+        if (claimInformationPointConfig != null) {
+            for (Entry<String, Map<String, Object>> claimDef : claimInformationPointConfig.entrySet()) {
+                ClaimInformationPointProviderFactory factory = getPolicyEnforcer().getClaimInformationPointProviderFactories().get(claimDef.getKey());
+
+                if (factory != null) {
+                    return factory.create(claimDef.getValue()).resolve(httpFacade);
+                }
+            }
+        }
+
+        return new HashMap<>();
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/BearerTokenPolicyEnforcer.java

@@ -1,79 +0,0 @@
-/*
- *  Copyright 2016 Red Hat, Inc. and/or its affiliates
- *  and other contributors as indicated by the @author tags.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-package org.keycloak.adapters.authorization;
-
-import org.jboss.logging.Logger;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.representation.PermissionRequest;
-import org.keycloak.authorization.client.resource.PermissionResource;
-import org.keycloak.authorization.client.resource.ProtectionResource;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-
-import java.util.Set;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
-
-    private static Logger LOGGER = Logger.getLogger(BearerTokenPolicyEnforcer.class);
-
-    public BearerTokenPolicyEnforcer(PolicyEnforcer enforcer) {
-        super(enforcer);
-    }
-
-    @Override
-    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
-        if (getEnforcerConfig().getUserManagedAccess() != null) {
-            challengeUmaAuthentication(pathConfig, requiredScopes, facade);
-        } else {
-            challengeEntitlementAuthentication(facade);
-        }
-        return true;
-    }
-
-    private void challengeEntitlementAuthentication(OIDCHttpFacade facade) {
-        HttpFacade.Response response = facade.getResponse();
-        AuthzClient authzClient = getAuthzClient();
-        String clientId = authzClient.getConfiguration().getClientId();
-        String  authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/entitlement";
-        response.setStatus(401);
-        response.setHeader("WWW-Authenticate", "KC_ETT realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\"");
-    }
-
-    private void challengeUmaAuthentication(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
-        HttpFacade.Response response = facade.getResponse();
-        AuthzClient authzClient = getAuthzClient();
-        String ticket = getPermissionTicket(pathConfig, requiredScopes, authzClient);
-        String clientId = authzClient.getConfiguration().getClientId();
-        String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/authorize";
-        response.setStatus(401);
-        response.setHeader("WWW-Authenticate", "UMA realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\",ticket=\"" + ticket + "\"");
-    }
-
-    private String getPermissionTicket(PathConfig pathConfig, Set<String> requiredScopes, AuthzClient authzClient) {
-        ProtectionResource protection = authzClient.protection();
-        PermissionResource permission = protection.permission();
-        PermissionRequest permissionRequest = new PermissionRequest();
-        permissionRequest.setResourceSetId(pathConfig.getId());
-        permissionRequest.setScopes(requiredScopes);
-        return permission.forResource(permissionRequest).getTicket();
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/ClaimInformationPointProvider.java

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization;
+
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.adapters.spi.HttpFacade;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public interface ClaimInformationPointProvider {
+
+    Map<String, List<String>> resolve(HttpFacade httpFacade);
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/ClaimInformationPointProviderFactory.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization;
+
+import java.util.Map;
+
+import org.keycloak.adapters.spi.HttpFacade;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public interface ClaimInformationPointProviderFactory<C extends ClaimInformationPointProvider> {
+
+    String getName();
+
+    void init(PolicyEnforcer policyEnforcer);
+
+    C create(Map<String, Object> config);
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -18,25 +18,30 @@
 package org.keycloak.adapters.authorization;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashSet;
-import java.util.Set;
+import java.util.List;
+import java.util.Map;
 
 import org.jboss.logging.Logger;
+import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthorizationDeniedException;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.representation.AuthorizationRequest;
-import org.keycloak.authorization.client.representation.AuthorizationResponse;
-import org.keycloak.authorization.client.representation.EntitlementRequest;
-import org.keycloak.authorization.client.representation.EntitlementResponse;
-import org.keycloak.authorization.client.representation.PermissionRequest;
-import org.keycloak.authorization.client.representation.PermissionResponse;
+import org.keycloak.authorization.client.resource.PermissionResource;
+import org.keycloak.authorization.client.resource.ProtectionResource;
+import org.keycloak.common.util.Base64;
 import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
+import org.keycloak.representations.idm.authorization.AuthorizationRequest;
+import org.keycloak.representations.idm.authorization.AuthorizationResponse;
 import org.keycloak.representations.idm.authorization.Permission;
+import org.keycloak.representations.idm.authorization.PermissionRequest;
+import org.keycloak.util.JsonSerialization;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -50,14 +55,14 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
         AccessToken original = accessToken;
 
-        if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+        if (super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims)) {
             return true;
         }
 
-        accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
+        accessToken = requestAuthorizationToken(pathConfig, methodConfig, httpFacade, claims);
 
         if (accessToken == null) {
             return false;
@@ -73,16 +78,50 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
 
         if (newAuthorization != null) {
-            authorization.getPermissions().addAll(newAuthorization.getPermissions());
+            Collection<Permission> grantedPermissions = authorization.getPermissions();
+            Collection<Permission> newPermissions = newAuthorization.getPermissions();
+
+            for (Permission newPermission : newPermissions) {
+                if (!grantedPermissions.contains(newPermission)) {
+                    grantedPermissions.add(newPermission);
+                }
+            }
         }
 
         original.setAuthorization(authorization);
 
-        return super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade);
+        return super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims);
     }
 
     @Override
-    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
+        if (isBearerAuthorization(httpFacade)) {
+            HttpFacade.Response response = httpFacade.getResponse();
+            AuthzClient authzClient = getAuthzClient();
+            String ticket = getPermissionTicket(pathConfig, methodConfig, authzClient, httpFacade);
+
+            if (ticket != null) {
+                response.setStatus(401);
+                response.setHeader("WWW-Authenticate", new StringBuilder("UMA realm=\"").append(authzClient.getConfiguration().getRealm()).append("\"").append(",as_uri=\"")
+                        .append(authzClient.getServerConfiguration().getIssuer()).append("\"").append(",ticket=\"").append(ticket).append("\"").toString());
+            } else {
+                response.setStatus(403);
+            }
+
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Sending challenge");
+            }
+
+            return true;
+        }
+
+        handleAccessDenied(httpFacade);
+
+        return true;
+    }
+
+    @Override
+    protected void handleAccessDenied(OIDCHttpFacade facade) {
         String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
         HttpFacade.Response response = facade.getResponse();
 
@@ -92,56 +131,88 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         } else {
             response.sendError(403);
         }
-
-        return true;
     }
 
-    private AccessToken requestAuthorizationToken(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade httpFacade) {
-        try {
-            String accessToken = httpFacade.getSecurityContext().getTokenString();
-            AuthzClient authzClient = getAuthzClient();
-            KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
-
-            if (getEnforcerConfig().getUserManagedAccess() != null) {
-                LOGGER.debug("Obtaining authorization for authenticated user.");
-                PermissionRequest permissionRequest = new PermissionRequest();
-
-                permissionRequest.setResourceSetId(pathConfig.getId());
-                permissionRequest.setScopes(requiredScopes);
-
-                PermissionResponse permissionResponse = authzClient.protection().permission().forResource(permissionRequest);
-                AuthorizationRequest authzRequest = new AuthorizationRequest(permissionResponse.getTicket());
-                AuthorizationResponse authzResponse = authzClient.authorization(accessToken).authorize(authzRequest);
-
-                if (authzResponse != null) {
-                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
-                }
-
-                return null;
-            } else {
-                LOGGER.debug("Obtaining entitlements for authenticated user.");
-                AccessToken token = httpFacade.getSecurityContext().getToken();
-
-                if (token.getAuthorization() == null) {
-                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).getAll(authzClient.getConfiguration().getClientId());
-                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
-                } else {
-                    EntitlementRequest request = new EntitlementRequest();
-                    PermissionRequest permissionRequest = new PermissionRequest();
-                    permissionRequest.setResourceSetId(pathConfig.getId());
-                    permissionRequest.setResourceSetName(pathConfig.getName());
-                    permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
-                    LOGGER.debugf("Sending entitlements request: resource_set_id [%s], resource_set_name [%s], scopes [%s].", permissionRequest.getResourceSetId(), permissionRequest.getResourceSetName(), permissionRequest.getScopes());
-                    request.addPermission(permissionRequest);
-                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getClientId(), request);
-                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
-                }
-            }
-        } catch (AuthorizationDeniedException e) {
-            LOGGER.debug("Authorization denied", e);
+    private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
+        if (getEnforcerConfig().getUserManagedAccess() != null) {
             return null;
+        }
+
+        try {
+            KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
+            String accessTokenString = securityContext.getTokenString();
+            KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
+            AccessToken accessToken = securityContext.getToken();
+            AuthorizationRequest authzRequest = new AuthorizationRequest();
+
+            if (isBearerAuthorization(httpFacade) || accessToken.getAuthorization() != null) {
+                authzRequest.addPermission(pathConfig.getId(), methodConfig.getScopes());
+            }
+
+            if (!claims.isEmpty()) {
+                authzRequest.setClaimTokenFormat("urn:ietf:params:oauth:token-type:jwt");
+                authzRequest.setClaimToken(Base64.encodeBytes(JsonSerialization.writeValueAsBytes(claims)));
+            }
+
+            if (accessToken.getAuthorization() != null) {
+                authzRequest.setRpt(accessTokenString);
+            }
+
+            LOGGER.debug("Obtaining authorization for authenticated user.");
+            AuthorizationResponse authzResponse;
+
+            if (isBearerAuthorization(httpFacade)) {
+                authzRequest.setSubjectToken(accessTokenString);
+                authzResponse = getAuthzClient().authorization().authorize(authzRequest);
+            } else {
+                authzResponse = getAuthzClient().authorization(accessTokenString).authorize(authzRequest);
+            }
+
+            if (authzResponse != null) {
+                return AdapterTokenVerifier.verifyToken(authzResponse.getToken(), deployment);
+            }
+        } catch (AuthorizationDeniedException ignore) {
+            LOGGER.debug("Authorization denied", ignore);
         } catch (Exception e) {
             throw new RuntimeException("Unexpected error during authorization request.", e);
         }
+
+        return null;
+    }
+
+    private String getPermissionTicket(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AuthzClient authzClient, OIDCHttpFacade httpFacade) {
+        if (getEnforcerConfig().getUserManagedAccess() != null) {
+            ProtectionResource protection = authzClient.protection();
+            PermissionResource permission = protection.permission();
+            PermissionRequest permissionRequest = new PermissionRequest();
+
+            permissionRequest.setResourceId(pathConfig.getId());
+            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
+
+            Map<String, List<String>> claims = resolveClaims(pathConfig, httpFacade);
+
+            if (!claims.isEmpty()) {
+                permissionRequest.setClaims(claims);
+            }
+
+            return permission.create(permissionRequest).getTicket();
+        }
+
+        return null;
+    }
+
+    private boolean isBearerAuthorization(OIDCHttpFacade httpFacade) {
+        List<String> authHeaders = httpFacade.getRequest().getHeaders("Authorization");
+
+        if (authHeaders != null) {
+            for (String authHeader : authHeaders) {
+                String[] split = authHeader.trim().split("\\s+");
+                if (split == null || split.length != 2) continue;
+                if (!split[0].equalsIgnoreCase("Bearer")) continue;
+                return true;
+            }
+        }
+
+        return getPolicyEnforcer().getDeployment().isBearerOnly();
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathCache.java

@@ -0,0 +1,174 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.locks.LockSupport;
+
+import org.keycloak.common.util.Time;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
+
+/**
+ * A simple LRU cache implementation supporting expiration and maximum number of entries.
+ *
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class PathCache {
+
+    /**
+     * The load factor.
+     */
+    private static final float DEFAULT_LOAD_FACTOR = 0.75f;
+
+    private final Map<String, CacheEntry> cache;
+
+    private final AtomicBoolean writing = new AtomicBoolean(false);
+
+    private final long maxAge;
+    private final boolean enabled;
+
+    /**
+     * Creates a new instance.
+     *
+     * @param maxEntries the maximum number of entries to keep in the cache
+     * @param maxAge the time in milliseconds that an entry can stay in the cache. If {@code -1}, entries never expire
+     */
+    public PathCache(final int maxEntries, long maxAge) {
+        cache = new LinkedHashMap<String, CacheEntry>(16, DEFAULT_LOAD_FACTOR, true) {
+            @Override
+            protected boolean removeEldestEntry(Map.Entry eldest) {
+                return cache.size()  > maxEntries;
+            }
+        };
+        this.maxAge = maxAge;
+        this.enabled = maxAge > 0;
+    }
+
+    public void put(String uri, PathConfig newValue) {
+        if (!enabled) {
+            return;
+        }
+
+        try {
+            if (parkForWriteAndCheckInterrupt()) {
+                return;
+            }
+
+            CacheEntry cacheEntry = cache.get(uri);
+
+            if (cacheEntry == null) {
+                cache.put(uri, new CacheEntry(uri, newValue, maxAge));
+            }
+        } finally {
+            writing.lazySet(false);
+        }
+    }
+
+    public boolean containsKey(String uri) {
+        return cache.containsKey(uri);
+    }
+
+    public PathConfig get(String uri) {
+        if (parkForReadAndCheckInterrupt()) {
+            return null;
+        }
+
+        CacheEntry cached = cache.get(uri);
+
+        if (cached != null) {
+            return removeIfExpired(cached);
+        }
+
+        return null;
+    }
+
+    public void remove(String key) {
+        try {
+            if (parkForWriteAndCheckInterrupt()) {
+                return;
+            }
+
+            cache.remove(key);
+        } finally {
+            writing.lazySet(false);
+        }
+    }
+
+    private PathConfig removeIfExpired(CacheEntry cached) {
+        if (cached == null) {
+            return null;
+        }
+
+        if (cached.isExpired()) {
+            remove(cached.key());
+            return null;
+        }
+
+        return cached.value();
+    }
+
+    private boolean parkForWriteAndCheckInterrupt() {
+        while (!writing.compareAndSet(false, true)) {
+            LockSupport.parkNanos(1L);
+            if (Thread.interrupted()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private boolean parkForReadAndCheckInterrupt() {
+        while (writing.get()) {
+            LockSupport.parkNanos(1L);
+            if (Thread.interrupted()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static final class CacheEntry {
+
+        final String key;
+        final PathConfig value;
+        final long expiration;
+
+        CacheEntry(String key, PathConfig value, long maxAge) {
+            this.key = key;
+            this.value = value;
+            if(maxAge == -1) {
+                expiration = -1;
+            } else {
+                expiration = Time.currentTimeMillis() + maxAge;
+            }
+        }
+
+        String key() {
+            return key;
+        }
+
+        PathConfig value() {
+            return value;
+        }
+
+        boolean isExpired() {
+            return expiration != -1 ? Time.currentTimeMillis() > expiration : false;
+        }
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathMatcher.java

@@ -1,109 +0,0 @@
-/*
- *  Copyright 2016 Red Hat, Inc. and/or its affiliates
- *  and other contributors as indicated by the @author tags.
- *
- *  Licensed under the Apache License, Version 2.0 (the "License");
- *  you may not use this file except in compliance with the License.
- *  You may obtain a copy of the License at
- *
- *  http://www.apache.org/licenses/LICENSE-2.0
- *
- *  Unless required by applicable law or agreed to in writing, software
- *  distributed under the License is distributed on an "AS IS" BASIS,
- *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- *  See the License for the specific language governing permissions and
- *  limitations under the License.
- *
- */
-package org.keycloak.adapters.authorization;
-
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-
-import java.util.Map;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-class PathMatcher {
-
-    private static final String ANY_RESOURCE_PATTERN = "/*";
-
-    PathConfig matches(final String requestedUri, Map<String, PathConfig> paths) {
-        PathConfig pathConfig = paths.get(requestedUri);
-
-        if (pathConfig != null) {
-            return pathConfig;
-        }
-
-        PathConfig actualConfig = null;
-
-        for (PathConfig entry : paths.values()) {
-            String protectedUri = entry.getPath();
-            String selectedUri = null;
-
-            if (protectedUri.equals(ANY_RESOURCE_PATTERN) && actualConfig == null) {
-                selectedUri = protectedUri;
-            }
-
-            int suffixIndex = protectedUri.indexOf(ANY_RESOURCE_PATTERN + ".");
-
-            if (suffixIndex != -1) {
-                String protectedSuffix = protectedUri.substring(suffixIndex + ANY_RESOURCE_PATTERN.length());
-
-                if (requestedUri.endsWith(protectedSuffix)) {
-                    selectedUri = protectedUri;
-                }
-            }
-
-            if (protectedUri.equals(requestedUri)) {
-                selectedUri = protectedUri;
-            }
-
-            if (protectedUri.endsWith(ANY_RESOURCE_PATTERN)) {
-                String formattedPattern = removeWildCardsFromUri(protectedUri);
-
-                if (!formattedPattern.equals("/") && requestedUri.startsWith(formattedPattern)) {
-                    selectedUri = protectedUri;
-                }
-
-                if (!formattedPattern.equals("/") && formattedPattern.endsWith("/") && formattedPattern.substring(0, formattedPattern.length() - 1).equals(requestedUri)) {
-                    selectedUri = protectedUri;
-                }
-            }
-
-            int startRegex = protectedUri.indexOf('{');
-
-            if (startRegex != -1) {
-                String prefix = protectedUri.substring(0, startRegex);
-
-                if (requestedUri.startsWith(prefix)) {
-                    selectedUri = protectedUri;
-                }
-            }
-
-            if (selectedUri != null) {
-                selectedUri = protectedUri;
-            }
-
-            if (selectedUri != null) {
-                if (actualConfig == null) {
-                    actualConfig = entry;
-                } else {
-                    if (actualConfig.equals(ANY_RESOURCE_PATTERN)) {
-                        actualConfig = entry;
-                    }
-
-                    if (protectedUri.startsWith(removeWildCardsFromUri(actualConfig.getPath()))) {
-                        actualConfig = entry;
-                    }
-                }
-            }
-        }
-
-        return actualConfig;
-    }
-
-    private String removeWildCardsFromUri(String protectedUri) {
-        return protectedUri.replaceAll("/[*]", "/");
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PolicyEnforcer.java

@@ -17,28 +17,33 @@
  */
 package org.keycloak.adapters.authorization;
 
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.ServiceLoader;
+
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.authorization.client.Configuration;
-import org.keycloak.authorization.client.representation.RegistrationResponse;
-import org.keycloak.authorization.client.representation.ResourceRepresentation;
-import org.keycloak.authorization.client.representation.ScopeRepresentation;
 import org.keycloak.authorization.client.resource.ProtectedResource;
+import org.keycloak.common.util.PathMatcher;
 import org.keycloak.representations.adapters.config.AdapterConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathCacheConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
+import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -50,13 +55,27 @@ public class PolicyEnforcer {
     private final KeycloakDeployment deployment;
     private final AuthzClient authzClient;
     private final PolicyEnforcerConfig enforcerConfig;
+    private final PathConfigMatcher pathMatcher;
     private final Map<String, PathConfig> paths;
+    private final Map<String, ClaimInformationPointProviderFactory> claimInformationPointProviderFactories = new HashMap<>();
 
     public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
         this.deployment = deployment;
         this.enforcerConfig = adapterConfig.getPolicyEnforcerConfig();
-        this.authzClient = AuthzClient.create(new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient()));
-        this.paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
+        Configuration configuration = new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient());
+        this.authzClient = AuthzClient.create(configuration, new ClientAuthenticator() {
+            @Override
+            public void configureClientCredentials(Map<String, List<String>> requestParams, Map<String, String> requestHeaders) {
+                Map<String, String> formparams = new HashMap<>();
+                ClientCredentialsProviderUtils.setClientCredentials(PolicyEnforcer.this.deployment, requestHeaders, formparams);
+                for (Entry<String, String> param : formparams.entrySet()) {
+                    requestParams.put(param.getKey(), Arrays.asList(param.getValue()));
+                }
+            }
+        });
+
+        paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
+        pathMatcher = new PathConfigMatcher(paths, enforcerConfig, authzClient);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Initialization complete. Path configurations:");
@@ -64,20 +83,17 @@ public class PolicyEnforcer {
                 LOGGER.debug(pathConfig);
             }
         }
+
+        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, ClaimInformationPointProviderFactory.class.getClassLoader()));
+        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, Thread.currentThread().getContextClassLoader()));
     }
 
     public AuthorizationContext enforce(OIDCHttpFacade facade) {
         if (LOGGER.isDebugEnabled()) {
-            LOGGER.debugv("Policy enforcement is enable. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
+            LOGGER.debugv("Policy enforcement is enabled. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
         }
 
-        AuthorizationContext context;
-
-        if (deployment.isBearerOnly()) {
-            context = new BearerTokenPolicyEnforcer(this).authorize(facade);
-        } else {
-            context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
-        }
+        AuthorizationContext context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debugv("Policy enforcement result for path [{0}] is : {1}", facade.getRequest().getURI(), context.isGranted() ? "GRANTED" : "DENIED");
@@ -90,11 +106,11 @@ public class PolicyEnforcer {
         return context;
     }
 
-    PolicyEnforcerConfig getEnforcerConfig() {
+    public PolicyEnforcerConfig getEnforcerConfig() {
         return enforcerConfig;
     }
 
-    AuthzClient getClient() {
+    public AuthzClient getClient() {
         return authzClient;
     }
 
@@ -102,14 +118,30 @@ public class PolicyEnforcer {
         return paths;
     }
 
-    void addPath(PathConfig pathConfig) {
-        paths.put(pathConfig.getPath(), pathConfig);
+    public PathConfigMatcher getPathMatcher() {
+        return pathMatcher;
     }
 
-    KeycloakDeployment getDeployment() {
+    public KeycloakDeployment getDeployment() {
         return deployment;
     }
 
+    public Map<String, ClaimInformationPointProviderFactory> getClaimInformationPointProviderFactories() {
+        return claimInformationPointProviderFactories;
+    }
+
+    private void loadClaimInformationPointProviders(ServiceLoader<ClaimInformationPointProviderFactory> loader) {
+        Iterator<ClaimInformationPointProviderFactory> iterator = loader.iterator();
+
+        while (iterator.hasNext()) {
+            ClaimInformationPointProviderFactory factory = iterator.next();
+
+            factory.init(this);
+
+            claimInformationPointProviderFactories.put(factory.getName(), factory);
+        }
+    }
+
     private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
         boolean loadPathsFromServer = true;
 
@@ -122,7 +154,11 @@ public class PolicyEnforcer {
 
         if (loadPathsFromServer) {
             LOGGER.info("No path provided in configuration.");
-            return configureAllPathsForResourceServer(protectedResource);
+            Map<String, PathConfig> paths = configureAllPathsForResourceServer(protectedResource);
+
+            paths.putAll(configureDefinedPaths(protectedResource, enforcerConfig));
+
+            return paths;
         } else {
             LOGGER.info("Paths provided in configuration.");
             return configureDefinedPaths(protectedResource, enforcerConfig);
@@ -130,56 +166,41 @@ public class PolicyEnforcer {
     }
 
     private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+        Map<String, PathConfig> paths = Collections.synchronizedMap(new LinkedHashMap<String, PathConfig>());
 
         for (PathConfig pathConfig : enforcerConfig.getPaths()) {
-            Set<String> search;
+            ResourceRepresentation resource;
             String resourceName = pathConfig.getName();
             String path = pathConfig.getPath();
 
             if (resourceName != null) {
                 LOGGER.debugf("Trying to find resource with name [%s] for path [%s].", resourceName, path);
-                search = protectedResource.findByFilter("name=" + resourceName);
+                resource = protectedResource.findByName(resourceName);
             } else {
                 LOGGER.debugf("Trying to find resource with uri [%s] for path [%s].", path, path);
-                search = protectedResource.findByFilter("uri=" + path);
+                List<ResourceRepresentation> resources = protectedResource.findByUri(path);
+
+                if (resources.isEmpty()) {
+                    resources = protectedResource.findByMatchingUri(path);
+                }
+
+                if (resources.size() == 1) {
+                    resource = resources.get(0);
+                } else if (resources.size() > 1) {
+                    throw new RuntimeException("Multiple resources found with the same uri");
+                } else {
+                    resource = null;
+                }
             }
 
-            if (search.isEmpty()) {
-                if (enforcerConfig.isCreateResources()) {
-                    LOGGER.debugf("Creating resource on server for path [%s].", pathConfig);
-                    ResourceRepresentation resource = new ResourceRepresentation();
-
-                    resource.setName(resourceName);
-                    resource.setType(pathConfig.getType());
-                    resource.setUri(path);
-
-                    HashSet<ScopeRepresentation> scopes = new HashSet<>();
-
-                    for (String scopeName : pathConfig.getScopes()) {
-                        ScopeRepresentation scope = new ScopeRepresentation();
-
-                        scope.setName(scopeName);
-
-                        scopes.add(scope);
-                    }
-
-                    resource.setScopes(scopes);
-
-                    RegistrationResponse registrationResponse = protectedResource.create(resource);
-
-                    pathConfig.setId(registrationResponse.getId());
-                } else {
-                    throw new RuntimeException("Could not find matching resource on server with uri [" + path + "] or name [" + resourceName + "]. Make sure you have created a resource on the server that matches with the path configuration.");
-                }
-            } else {
-                pathConfig.setId(search.iterator().next());
+            if (resource != null) {
+                pathConfig.setId(resource.getId());
             }
 
             PathConfig existingPath = null;
 
             for (PathConfig current : paths.values()) {
-                if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
+                if (current.getPath().equals(pathConfig.getPath())) {
                     existingPath = current;
                     break;
                 }
@@ -200,35 +221,126 @@ public class PolicyEnforcer {
         LOGGER.info("Querying the server for all resources associated with this application.");
         Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
 
-        for (String id : protectedResource.findAll()) {
-            RegistrationResponse response = protectedResource.findById(id);
-            ResourceRepresentation resourceDescription = response.getResourceDescription();
+        if (!enforcerConfig.getLazyLoadPaths()) {
+            for (String id : protectedResource.findAll()) {
+                ResourceRepresentation resourceDescription = protectedResource.findById(id);
 
-            if (resourceDescription.getUri() != null) {
-                PathConfig pathConfig = createPathConfig(resourceDescription);
-                paths.put(pathConfig.getPath(), pathConfig);
+                if (resourceDescription.getUris() != null && !resourceDescription.getUris().isEmpty()) {
+                    for(PathConfig pathConfig : PathConfig.createPathConfigs(resourceDescription)) {
+                        paths.put(pathConfig.getPath(), pathConfig);
+                    }
+                }
             }
         }
 
         return paths;
     }
 
-    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
-        PathConfig pathConfig = new PathConfig();
+    public class PathConfigMatcher extends PathMatcher<PathConfig> {
 
-        pathConfig.setId(resourceDescription.getId());
-        pathConfig.setName(resourceDescription.getName());
-        pathConfig.setPath(resourceDescription.getUri());
+        private final Map<String, PathConfig> paths;
+        private final PathCache pathCache;
+        private final AuthzClient authzClient;
+        private final PolicyEnforcerConfig enforcerConfig;
 
-        List<String> scopeNames = new ArrayList<>();
+        public PathConfigMatcher(Map<String, PathConfig> paths, PolicyEnforcerConfig enforcerConfig, AuthzClient authzClient) {
+            this.paths = paths;
+            this.enforcerConfig = enforcerConfig;
+            PathCacheConfig cacheConfig = enforcerConfig.getPathCacheConfig();
 
-        for (ScopeRepresentation scope : resourceDescription.getScopes()) {
-            scopeNames.add(scope.getName());
+            if (cacheConfig == null) {
+                cacheConfig = new PathCacheConfig();
+            }
+
+            pathCache = new PathCache(cacheConfig.getMaxEntries(), cacheConfig.getLifespan());
+            this.authzClient = authzClient;
         }
 
-        pathConfig.setScopes(scopeNames);
-        pathConfig.setType(resourceDescription.getType());
+        @Override
+        public PathConfig matches(String targetUri) {
+            PathConfig pathConfig = pathCache.get(targetUri);
 
-        return pathConfig;
-    }
+            if (pathCache.containsKey(targetUri) || pathConfig != null) {
+                return pathConfig;
+            }
+
+            pathConfig = super.matches(targetUri);
+
+            if (enforcerConfig.getLazyLoadPaths() || enforcerConfig.getPathCacheConfig() != null) {
+                if ((pathConfig == null || (pathConfig.getPath().contains("*")))) {
+                    try {
+                        List<ResourceRepresentation> matchingResources = authzClient.protection().resource().findByMatchingUri(targetUri);
+
+                        if (!matchingResources.isEmpty()) {
+                            Map<String, Map<String, Object>> cipConfig = null;
+
+                            if (pathConfig != null) {
+                                cipConfig = pathConfig.getClaimInformationPointConfig();
+                            }
+
+                            pathConfig = PathConfig.createPathConfigs(matchingResources.get(0)).iterator().next();
+
+                            if (cipConfig != null) {
+                                pathConfig.setClaimInformationPointConfig(cipConfig);
+                            }
+                        }
+                    } catch (Exception cause) {
+                        LOGGER.errorf(cause, "Could not lazy load resource with path [" + targetUri + "] from server");
+                        return null;
+                    }
+                }
+            }
+
+            pathCache.put(targetUri, pathConfig);
+
+            return pathConfig;
+        }
+
+        @Override
+        protected String getPath(PathConfig entry) {
+            return entry.getPath();
+        }
+
+        @Override
+        protected Collection<PathConfig> getPaths() {
+            return paths.values();
+        }
+
+        @Override
+        protected PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
+            if (originalConfig.hasPattern()) {
+                ProtectedResource resource = authzClient.protection().resource();
+
+                // search by an exact match
+                List<ResourceRepresentation> search = resource.findByUri(path);
+
+                // if exact match not found, try to obtain from current path the parent path.
+                // if path is /resource/1/test and pattern from pathConfig is /resource/{id}/*, parent path is /resource/1
+                // this logic allows to match sub resources of a resource instance (/resource/1) to the parent resource,
+                // so any permission granted to parent also applies to sub resources
+                if (search.isEmpty()) {
+                    search = resource.findByUri(buildUriFromTemplate(originalConfig.getPath(), path, true));
+                }
+
+                if (!search.isEmpty()) {
+                    ResourceRepresentation targetResource = search.get(0);
+                    PathConfig config = PathConfig.createPathConfigs(targetResource).iterator().next();
+
+                    config.setScopes(originalConfig.getScopes());
+                    config.setMethods(originalConfig.getMethods());
+                    config.setParentConfig(originalConfig);
+                    config.setEnforcementMode(originalConfig.getEnforcementMode());
+                    config.setClaimInformationPointConfig(originalConfig.getClaimInformationPointConfig());
+
+                    return config;
+                }
+            }
+
+            return null;
+        }
+
+        public void removeFromCache(String pathConfig) {
+            pathCache.remove(pathConfig);
+        }
+    };
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProvider.java

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.cip;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
+import org.keycloak.adapters.authorization.util.PlaceHolders;
+import org.keycloak.adapters.spi.HttpFacade;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class ClaimsInformationPointProvider implements ClaimInformationPointProvider {
+
+    private final Map<String, Object> config;
+
+    public ClaimsInformationPointProvider(Map<String, Object> config) {
+        this.config = config;
+    }
+
+    @Override
+    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
+        Map<String, List<String>> claims = new HashMap<>();
+
+        for (Entry<String, Object> configEntry : config.entrySet()) {
+            String claimName = configEntry.getKey();
+            Object claimValue = configEntry.getValue();
+            List<String> values = new ArrayList<>();
+
+            if (claimValue instanceof String) {
+                values = getValues(claimValue.toString(), httpFacade);
+            } else if (claimValue instanceof Collection) {
+                Iterator iterator = Collection.class.cast(claimValue).iterator();
+
+                while (iterator.hasNext()) {
+                    List<String> resolvedValues = getValues(iterator.next().toString(), httpFacade);
+
+                    if (!resolvedValues.isEmpty()) {
+                        values.addAll(resolvedValues);
+                    }
+                }
+            }
+
+            if (!values.isEmpty()) {
+                claims.put(claimName, values);
+            }
+        }
+
+        return claims;
+    }
+
+    private List<String> getValues(String value, HttpFacade httpFacade) {
+        return PlaceHolders.resolve(value, httpFacade);
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProviderFactory.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.cip;
+
+import java.util.Map;
+
+import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
+import org.keycloak.adapters.authorization.PolicyEnforcer;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class ClaimsInformationPointProviderFactory implements ClaimInformationPointProviderFactory<ClaimsInformationPointProvider> {
+
+    @Override
+    public String getName() {
+        return "claims";
+    }
+
+    @Override
+    public void init(PolicyEnforcer policyEnforcer) {
+
+    }
+
+    @Override
+    public ClaimsInformationPointProvider create(Map<String, Object> config) {
+        return new ClaimsInformationPointProvider(config);
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProvider.java

@@ -0,0 +1,210 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.cip;
+
+import java.io.BufferedInputStream;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.apache.http.HttpEntity;
+import org.apache.http.HttpResponse;
+import org.apache.http.StatusLine;
+import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.RequestBuilder;
+import org.apache.http.util.EntityUtils;
+import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
+import org.keycloak.adapters.authorization.PolicyEnforcer;
+import org.keycloak.adapters.authorization.util.JsonUtils;
+import org.keycloak.adapters.authorization.util.PlaceHolders;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.authorization.client.util.HttpResponseException;
+import org.keycloak.common.util.StreamUtil;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class HttpClaimInformationPointProvider implements ClaimInformationPointProvider {
+
+    private final Map<String, Object> config;
+    private final HttpClient httpClient;
+
+    public HttpClaimInformationPointProvider(Map<String, Object> config, PolicyEnforcer policyEnforcer) {
+        this.config = config;
+        this.httpClient = policyEnforcer.getDeployment().getClient();
+    }
+
+    @Override
+    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
+        try {
+            InputStream responseStream = executeRequest(httpFacade);
+
+            try (InputStream inputStream = new BufferedInputStream(responseStream)) {
+                JsonNode jsonNode = JsonSerialization.mapper.readTree(inputStream);
+                Map<String, List<String>> claims = new HashMap<>();
+                Map<String, Object> claimsDef = (Map<String, Object>) config.get("claims");
+
+                if (claimsDef == null) {
+                    Iterator<String> nodeNames = jsonNode.fieldNames();
+
+                    while (nodeNames.hasNext()) {
+                        String nodeName = nodeNames.next();
+                        claims.put(nodeName, JsonUtils.getValues(jsonNode.get(nodeName)));
+                    }
+                } else {
+                    for (Entry<String, Object> claimDef : claimsDef.entrySet()) {
+                        List<String> jsonPaths = new ArrayList<>();
+
+                        if (claimDef.getValue() instanceof Collection) {
+                            jsonPaths.addAll(Collection.class.cast(claimDef.getValue()));
+                        } else {
+                            jsonPaths.add(claimDef.getValue().toString());
+                        }
+
+                        List<String> claimValues = new ArrayList<>();
+
+                        for (String path : jsonPaths) {
+                            claimValues.addAll(JsonUtils.getValues(jsonNode, path));
+                        }
+
+                        claims.put(claimDef.getKey(), claimValues);
+                    }
+                }
+
+                return claims;
+            }
+        } catch (IOException cause) {
+            throw new RuntimeException("Could not obtain claims from http claim information point [" + config.get("url") + "] response", cause);
+        }
+    }
+
+    private InputStream executeRequest(HttpFacade httpFacade) {
+        String method = config.get("method").toString();
+
+        if (method == null) {
+            method = "GET";
+        }
+
+        RequestBuilder builder = null;
+
+        if ("GET".equalsIgnoreCase(method)) {
+            builder = RequestBuilder.get();
+        } else {
+            builder = RequestBuilder.post();
+        }
+
+        builder.setUri(config.get("url").toString());
+
+        byte[] bytes = new byte[0];
+
+        try {
+            setParameters(builder, httpFacade);
+
+            if (config.containsKey("headers")) {
+                setHeaders(builder, httpFacade);
+            }
+
+            HttpResponse response = httpClient.execute(builder.build());
+            HttpEntity entity = response.getEntity();
+
+            if (entity != null) {
+                bytes = EntityUtils.toByteArray(entity);
+            }
+
+            StatusLine statusLine = response.getStatusLine();
+            int statusCode = statusLine.getStatusCode();
+
+            if (statusCode < 200 || statusCode >= 300) {
+                throw new HttpResponseException("Unexpected response from server: " + statusCode + " / " + statusLine.getReasonPhrase(), statusCode, statusLine.getReasonPhrase(), bytes);
+            }
+
+            return new ByteArrayInputStream(bytes);
+        } catch (Exception cause) {
+            try {
+                throw new RuntimeException("Error executing http method [" + builder + "]. Response : " + StreamUtil.readString(new ByteArrayInputStream(bytes), Charset.forName("UTF-8")), cause);
+            } catch (Exception e) {
+                throw new RuntimeException("Error executing http method [" + builder + "]", cause);
+            }
+        }
+    }
+
+    private void setHeaders(RequestBuilder builder, HttpFacade httpFacade) {
+        Object headersDef = config.get("headers");
+
+        if (headersDef != null) {
+            Map<String, Object> headers = Map.class.cast(headersDef);
+
+            for (Entry<String, Object> header : headers.entrySet()) {
+                Object value = header.getValue();
+                List<String> headerValues = new ArrayList<>();
+
+                if (value instanceof Collection) {
+                    Collection values = Collection.class.cast(value);
+                    Iterator iterator = values.iterator();
+
+                    while (iterator.hasNext()) {
+                        headerValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
+                    }
+                } else {
+                    headerValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
+                }
+
+                for (String headerValue : headerValues) {
+                    builder.addHeader(header.getKey(), headerValue);
+                }
+            }
+        }
+    }
+
+    private void setParameters(RequestBuilder builder, HttpFacade httpFacade) {
+        Object config = this.config.get("parameters");
+
+        if (config != null) {
+            Map<String, Object> paramsDef = Map.class.cast(config);
+
+            for (Entry<String, Object> paramDef : paramsDef.entrySet()) {
+                Object value = paramDef.getValue();
+                List<String> paramValues = new ArrayList<>();
+
+                if (value instanceof Collection) {
+                    Collection values = Collection.class.cast(value);
+                    Iterator iterator = values.iterator();
+
+                    while (iterator.hasNext()) {
+                        paramValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
+                    }
+                } else {
+                    paramValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
+                }
+
+                for (String paramValue : paramValues) {
+                    builder.addParameter(paramDef.getKey(), paramValue);
+                }
+            }
+        }
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProviderFactory.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.cip;
+
+import java.util.Map;
+
+import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
+import org.keycloak.adapters.authorization.PolicyEnforcer;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class HttpClaimInformationPointProviderFactory implements ClaimInformationPointProviderFactory<HttpClaimInformationPointProvider> {
+
+    private PolicyEnforcer policyEnforcer;
+
+    @Override
+    public String getName() {
+        return "http";
+    }
+
+    @Override
+    public void init(PolicyEnforcer policyEnforcer) {
+        this.policyEnforcer = policyEnforcer;
+    }
+
+    @Override
+    public HttpClaimInformationPointProvider create(Map<String, Object> config) {
+        return new HttpClaimInformationPointProvider(config, policyEnforcer);
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/JsonUtils.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.util;
+
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class JsonUtils {
+
+    public static List<String> getValues(JsonNode jsonNode, String path) {
+        return getValues(jsonNode.at(path));
+    }
+
+    public static List<String> getValues(JsonNode jsonNode) {
+        List<String> values = new ArrayList<>();
+
+        if (jsonNode.isArray()) {
+            Iterator<JsonNode> iterator = jsonNode.iterator();
+
+            while (iterator.hasNext()) {
+                String value = iterator.next().textValue();
+
+                if (value != null) {
+                    values.add(value);
+                }
+            }
+        } else {
+            String value = jsonNode.textValue();
+
+            if (value != null) {
+                values.add(value);
+            }
+        }
+
+        return values;
+    }
+
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/KeycloakSecurityContextPlaceHolderResolver.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.util;
+
+import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
+
+import java.util.Arrays;
+import java.util.List;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.keycloak.KeycloakSecurityContext;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class KeycloakSecurityContextPlaceHolderResolver implements PlaceHolderResolver {
+
+    public static final String NAME = "keycloak";
+
+    @Override
+    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
+        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
+        OIDCHttpFacade oidcHttpFacade = OIDCHttpFacade.class.cast(httpFacade);
+        KeycloakSecurityContext securityContext = oidcHttpFacade.getSecurityContext();
+
+        if (securityContext == null) {
+            return null;
+        }
+
+        if (source.endsWith("access_token")) {
+            return Arrays.asList(securityContext.getTokenString());
+        }
+
+        if (source.endsWith("id_token")) {
+            return Arrays.asList(securityContext.getIdTokenString());
+        }
+
+        JsonNode jsonNode;
+
+        if (source.startsWith("access_token[")) {
+            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getToken());
+        } else if (source.startsWith("id_token[")) {
+            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getIdToken());
+        } else {
+            throw new RuntimeException("Invalid placeholder [" + placeHolder + "]");
+        }
+
+        return JsonUtils.getValues(jsonNode, getParameter(source, "Invalid placeholder [" + placeHolder + "]"));
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/PlaceHolderResolver.java

@@ -0,0 +1,30 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.util;
+
+import java.util.List;
+
+import org.keycloak.adapters.spi.HttpFacade;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public interface PlaceHolderResolver {
+
+    List<String> resolve(String placeHolder, HttpFacade httpFacade);
+
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/PlaceHolders.java

@@ -0,0 +1,107 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.util;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.keycloak.adapters.spi.HttpFacade;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class PlaceHolders {
+
+    private static Map<String, PlaceHolderResolver> resolvers = new HashMap<>();
+
+    static {
+        resolvers.put(RequestPlaceHolderResolver.NAME, new RequestPlaceHolderResolver());
+        resolvers.put(KeycloakSecurityContextPlaceHolderResolver.NAME, new KeycloakSecurityContextPlaceHolderResolver());
+    }
+
+    private static Pattern PLACEHOLDER_PATTERN = Pattern.compile("\\{(.+?)\\}");
+    private static Pattern PLACEHOLDER_PARAM_PATTERN = Pattern.compile("\\[(.+?)\\]");
+
+    public static List<String> resolve(String value, HttpFacade httpFacade) {
+        Map<String, List<String>> placeHolders = parsePlaceHolders(value, httpFacade);
+
+        if (!placeHolders.isEmpty()) {
+            value = formatPlaceHolder(value);
+
+            for (Entry<String, List<String>> entry : placeHolders.entrySet()) {
+                List<String> values = entry.getValue();
+
+                if (values.isEmpty() || values.size() > 1) {
+                    return values;
+                }
+
+                value = value.replaceAll(entry.getKey(), values.get(0)).trim();
+            }
+        }
+
+        return Arrays.asList(value);
+    }
+
+    static String getParameter(String source, String messageIfNotFound) {
+        Matcher matcher = PLACEHOLDER_PARAM_PATTERN.matcher(source);
+
+        while (matcher.find()) {
+            return matcher.group(1).replaceAll("'", "");
+        }
+
+        if (messageIfNotFound != null) {
+            throw new RuntimeException(messageIfNotFound);
+        }
+
+        return null;
+    }
+
+    private static Map<String, List<String>> parsePlaceHolders(String value, HttpFacade httpFacade) {
+        Map<String, List<String>> placeHolders = new HashMap<>();
+        Matcher matcher = PLACEHOLDER_PATTERN.matcher(value);
+
+        while (matcher.find()) {
+            String placeHolder = matcher.group(1);
+            int resolverNameIdx = placeHolder.indexOf('.');
+
+            if (resolverNameIdx == -1) {
+                throw new RuntimeException("Invalid placeholder [" + value + "]. Could not find resolver name.");
+            }
+
+            PlaceHolderResolver resolver = resolvers.get(placeHolder.substring(0, resolverNameIdx));
+
+            if (resolver != null) {
+                List<String> resolved = resolver.resolve(placeHolder, httpFacade);
+
+                if (resolved != null) {
+                    placeHolders.put(formatPlaceHolder(placeHolder), resolved);
+                }
+            }
+        }
+
+        return placeHolders;
+    }
+
+    private static String formatPlaceHolder(String placeHolder) {
+        return placeHolder.replaceAll("\\{", "").replace("}", "").replace("[", "").replace("]", "").replace("[", "").replace("]", "");
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/RequestPlaceHolderResolver.java

@@ -0,0 +1,175 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.authorization.util;
+
+import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
+
+import java.io.BufferedInputStream;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.spi.HttpFacade.Cookie;
+import org.keycloak.adapters.spi.HttpFacade.Request;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class RequestPlaceHolderResolver implements PlaceHolderResolver {
+
+    static String NAME = "request";
+
+    @Override
+    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
+        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
+        Request request = httpFacade.getRequest();
+
+        if (source.startsWith("parameter")) {
+            String parameterName = getParameter(source, "Could not obtain parameter name from placeholder [" + source + "]");
+            String parameterValue = request.getQueryParamValue(parameterName);
+
+            if (parameterValue == null) {
+                parameterValue = request.getFirstParam(parameterName);
+            }
+
+            if (parameterValue != null) {
+                return Arrays.asList(parameterValue);
+            }
+        } else if (source.startsWith("header")) {
+            String headerName = getParameter(source, "Could not obtain header name from placeholder [" + source + "]");
+            List<String> headerValue = request.getHeaders(headerName);
+
+            if (headerValue != null) {
+                return headerValue;
+            }
+        } else if (source.startsWith("cookie")) {
+            String cookieName = getParameter(source, "Could not obtain cookie name from placeholder [" + source + "]");
+            Cookie cookieValue = request.getCookie(cookieName);
+
+            if (cookieValue != null) {
+                return Arrays.asList(cookieValue.getValue());
+            }
+        } else if (source.startsWith("remoteAddr")) {
+            String value = request.getRemoteAddr();
+
+            if (value != null) {
+                return Arrays.asList(value);
+            }
+        } else if (source.startsWith("method")) {
+            String value = request.getMethod();
+
+            if (value != null) {
+                return Arrays.asList(value);
+            }
+        } else if (source.startsWith("uri")) {
+            String value = request.getURI();
+
+            if (value != null) {
+                return Arrays.asList(value);
+            }
+        } else if (source.startsWith("relativePath")) {
+            String value = request.getRelativePath();
+
+            if (value != null) {
+                return Arrays.asList(value);
+            }
+        } else if (source.startsWith("secure")) {
+            return Arrays.asList(String.valueOf(request.isSecure()));
+        } else if (source.startsWith("body")) {
+            String contentType = request.getHeader("Content-Type");
+
+            if (contentType == null) {
+                contentType = "";
+            }
+
+            InputStream body = request.getInputStream(true);
+
+            try {
+                if (body == null || body.available() == 0) {
+                    return Collections.emptyList();
+                }
+            } catch (IOException cause) {
+                throw new RuntimeException("Failed to check available bytes in request input stream", cause);
+            }
+
+            if (body.markSupported()) {
+                body.mark(0);
+            }
+
+            List<String> values = new ArrayList<>();
+
+            try {
+                switch (contentType) {
+                    case "application/json":
+                        try {
+                            JsonNode jsonNode = JsonSerialization.mapper.readTree(new BufferedInputStream(body) {
+                                @Override
+                                public void close() {
+                                    // we can't close the stream because it may be used later by the application
+                                }
+                            });
+                            String path = getParameter(source, null);
+
+                            if (path == null) {
+                                values.addAll(JsonUtils.getValues(jsonNode));
+                            } else {
+                                values.addAll(JsonUtils.getValues(jsonNode, path));
+                            }
+                        } catch (IOException cause) {
+                            throw new RuntimeException("Could not extract claim from request JSON body", cause);
+                        }
+                        break;
+                    default:
+                        StringBuilder value = new StringBuilder();
+                        BufferedReader reader = new BufferedReader(new InputStreamReader(body));
+
+                        try {
+                            int ch;
+
+                            while ((ch = reader.read()) != -1) {
+                                value.append((char) ch);
+                            }
+                        } catch (IOException cause) {
+                            throw new RuntimeException("Could not extract claim from request body", cause);
+                        }
+
+                        values.add(value.toString());
+                }
+            } finally {
+                if (body.markSupported()) {
+                    try {
+                        body.reset();
+                    } catch (IOException cause) {
+                        throw new RuntimeException("Failed to reset request input stream", cause);
+                    }
+                }
+            }
+
+            return values;
+        }
+
+        return Collections.emptyList();
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/AbstractKeycloakLoginModule.java

@@ -23,7 +23,7 @@ import org.keycloak.adapters.AdapterUtils;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.FindFile;
 import org.keycloak.common.util.reflections.Reflections;
@@ -37,8 +37,12 @@ import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.LoginException;
 import javax.security.auth.spi.LoginModule;
+
+import java.io.IOException;
 import java.io.InputStream;
 import java.lang.reflect.Constructor;
+import java.net.MalformedURLException;
+import java.net.URL;
 import java.security.Principal;
 import java.util.HashSet;
 import java.util.Map;
@@ -53,7 +57,7 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     public static final String KEYCLOAK_CONFIG_FILE_OPTION = "keycloak-config-file";
     public static final String ROLE_PRINCIPAL_CLASS_OPTION = "role-principal-class";
-
+    public static final String PROFILE_RESOURCE = "profile:";
     protected Subject subject;
     protected CallbackHandler callbackHandler;
     protected Auth auth;
@@ -84,14 +88,27 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     protected KeycloakDeployment resolveDeployment(String keycloakConfigFile) {
         try {
-            InputStream is = FindFile.findFile(keycloakConfigFile);
+            InputStream is = null;
+            if (keycloakConfigFile.startsWith(PROFILE_RESOURCE)) {
+                try {
+                    is = new URL(keycloakConfigFile).openStream();
+                } catch (MalformedURLException mfue) {
+                    throw new RuntimeException(mfue);
+                } catch (IOException ioe) {
+                    throw new RuntimeException(ioe);
+                }
+            } else {
+                is = FindFile.findFile(keycloakConfigFile);
+            }
             KeycloakDeployment kd = KeycloakDeploymentBuilder.build(is);
             return kd;
+
         } catch (RuntimeException e) {
             getLogger().debug("Unable to find or parse file " + keycloakConfigFile + " due to " + e.getMessage(), e);
             throw e;
         }
     }
+    
 
     @Override
     public boolean login() throws LoginException {
@@ -185,8 +202,16 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
 
     protected Auth bearerAuth(String tokenString) throws VerificationException {
-        AccessToken token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+        AccessToken token = AdapterTokenVerifier.verifyToken(tokenString, deployment);
+        return postTokenVerification(tokenString, token);
+    }
 
+
+    /**
+     * Called after accessToken was verified (including signature, expiration etc)
+     *
+     */
+    protected Auth postTokenVerification(String tokenString, AccessToken token) {
         boolean verifyCaller;
         if (deployment.isUseResourceRoleMappings()) {
             verifyCaller = token.isVerifyCaller(deployment.getResourceName());

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/DirectAccessGrantsLoginModule.java

@@ -27,6 +27,7 @@ import org.apache.http.message.BasicNameValuePair;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.constants.ServiceUrlConstants;
@@ -56,11 +57,15 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
 
     private static final Logger log = Logger.getLogger(DirectAccessGrantsLoginModule.class);
 
+    public static final String SCOPE_OPTION = "scope";
+
     private String refreshToken;
+    private String scope;
 
     @Override
     public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
         super.initialize(subject, callbackHandler, sharedState, options);
+        this.scope = (String)options.get(SCOPE_OPTION);
 
         // This is used just for logout
         Iterator<RefreshTokenHolder> iterator = subject.getPrivateCredentials(RefreshTokenHolder.class).iterator();
@@ -89,6 +94,10 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
         formparams.add(new BasicNameValuePair("username", username));
         formparams.add(new BasicNameValuePair("password", password));
 
+        if (scope != null) {
+            formparams.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scope));
+        }
+
         ClientCredentialsProviderUtils.setClientCredentials(deployment, post, formparams);
 
         UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
@@ -121,7 +130,8 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
         // refreshToken will be saved to privateCreds of Subject for now
         refreshToken = tokenResponse.getRefreshToken();
 
-        return bearerAuth(tokenResponse.getToken());
+        AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenResponse.getToken(), tokenResponse.getIdToken(), deployment);
+        return postTokenVerification(tokenResponse.getToken(), tokens.getAccessToken());
     }
 
     @Override

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/AdapterRSATokenVerifier.java

@@ -1,58 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.jboss.logging.Logger;
-import org.keycloak.RSATokenVerifier;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.representations.AccessToken;
-
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AdapterRSATokenVerifier {
-
-    private static final Logger log = Logger.getLogger(AdapterRSATokenVerifier.class);
-
-    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment) throws VerificationException {
-        return verifyToken(tokenString, deployment, true, true);
-    }
-
-
-    public static PublicKey getPublicKey(String kid, KeycloakDeployment deployment) throws VerificationException {
-        PublicKeyLocator pkLocator = deployment.getPublicKeyLocator();
-
-        PublicKey publicKey = pkLocator.getPublicKey(kid, deployment);
-        if (publicKey == null) {
-            log.errorf("Didn't find publicKey for kid: %s", kid);
-            throw new VerificationException("Didn't find publicKey for specified kid");
-        }
-
-        return publicKey;
-    }
-
-    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment, boolean checkActive, boolean checkTokenType) throws VerificationException {
-        RSATokenVerifier verifier = RSATokenVerifier.create(tokenString).realmUrl(deployment.getRealmInfoUrl()).checkActive(checkActive).checkTokenType(checkTokenType);
-        PublicKey publicKey = getPublicKey(verifier.getHeader().getKeyId(), deployment);
-        return verifier.publicKey(publicKey).verify().getToken();
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/AdapterTokenVerifier.java

@@ -0,0 +1,150 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.rotation;
+
+import org.jboss.logging.Logger;
+import org.keycloak.TokenVerifier;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.common.VerificationException;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.IDToken;
+import org.keycloak.representations.JsonWebToken;
+
+import java.security.PublicKey;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AdapterTokenVerifier {
+
+    private static final Logger log = Logger.getLogger(AdapterTokenVerifier.class);
+
+
+    /**
+     * Verifies bearer token. Typically called when bearer token (access token) is sent to the service, which wants to verify it. Hence it also checks the audience in the token.
+     *
+     * @param tokenString
+     * @param deployment
+     * @return
+     * @throws VerificationException
+     */
+    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment) throws VerificationException {
+        TokenVerifier<AccessToken> tokenVerifier = createVerifier(tokenString, deployment, true, AccessToken.class);
+
+        // Verify audience of bearer-token
+        if (deployment.isVerifyTokenAudience()) {
+            tokenVerifier.audience(deployment.getResourceName());
+        }
+
+        return tokenVerifier.verify().getToken();
+    }
+
+
+    /**
+     * Verify access token and ID token. Typically called after successful tokenResponse is received from Keycloak
+     *
+     * @param accessTokenString
+     * @param idTokenString
+     * @param deployment
+     * @return verified and parsed accessToken and idToken
+     * @throws VerificationException
+     */
+    public static VerifiedTokens verifyTokens(String accessTokenString, String idTokenString, KeycloakDeployment deployment) throws VerificationException {
+        // Adapters currently do most of the checks including signature etc on the access token
+        TokenVerifier<AccessToken> tokenVerifier = createVerifier(accessTokenString, deployment, true, AccessToken.class);
+        AccessToken accessToken = tokenVerifier.verify().getToken();
+
+        if (idTokenString != null) {
+            // Don't verify signature again on IDToken
+            IDToken idToken = TokenVerifier.create(idTokenString, IDToken.class).getToken();
+            TokenVerifier<IDToken> idTokenVerifier = TokenVerifier.createWithoutSignature(idToken);
+
+            // Always verify audience and azp on IDToken
+            idTokenVerifier.audience(deployment.getResourceName());
+            idTokenVerifier.issuedFor(deployment.getResourceName());
+
+            idTokenVerifier.verify();
+            return new VerifiedTokens(accessToken, idToken);
+        } else {
+            return new VerifiedTokens(accessToken, null);
+        }
+    }
+
+
+    /**
+     * Creates verifier, initializes it from the KeycloakDeployment and adds the publicKey and some default basic checks (activeness and tokenType). Useful if caller wants to add/remove/update
+     * some checks
+     *
+     * @param tokenString
+     * @param deployment
+     * @param withDefaultChecks
+     * @param tokenClass
+     * @param <T>
+     * @return tokenVerifier
+     * @throws VerificationException
+     */
+    public static <T extends JsonWebToken> TokenVerifier<T> createVerifier(String tokenString, KeycloakDeployment deployment, boolean withDefaultChecks, Class<T> tokenClass) throws VerificationException {
+        TokenVerifier<T> tokenVerifier = TokenVerifier.create(tokenString, tokenClass);
+
+        if (withDefaultChecks) {
+            tokenVerifier
+                    .withDefaultChecks()
+                    .realmUrl(deployment.getRealmInfoUrl());
+        }
+
+        String kid = tokenVerifier.getHeader().getKeyId();
+        PublicKey publicKey = getPublicKey(kid, deployment);
+        tokenVerifier.publicKey(publicKey);
+
+        return tokenVerifier;
+    }
+
+
+    private static PublicKey getPublicKey(String kid, KeycloakDeployment deployment) throws VerificationException {
+        PublicKeyLocator pkLocator = deployment.getPublicKeyLocator();
+
+        PublicKey publicKey = pkLocator.getPublicKey(kid, deployment);
+        if (publicKey == null) {
+            log.errorf("Didn't find publicKey for kid: %s", kid);
+            throw new VerificationException("Didn't find publicKey for specified kid");
+        }
+
+        return publicKey;
+    }
+
+
+    public static class VerifiedTokens {
+
+        private final AccessToken accessToken;
+        private final IDToken idToken;
+
+        public VerifiedTokens(AccessToken accessToken, IDToken idToken) {
+            this.accessToken = accessToken;
+            this.idToken = idToken;
+        }
+
+
+        public AccessToken getAccessToken() {
+            return accessToken;
+        }
+
+        public IDToken getIdToken() {
+            return idToken;
+        }
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/JWKPublicKeyLocator.java

@@ -81,7 +81,7 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
 
 
     private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
-        if (lastRequestTime + publicKeyCacheTtl > currentTime) {
+        if (lastRequestTime + publicKeyCacheTtl > currentTime && kid != null) {
             return currentKeys.get(kid);
         } else {
             return null;

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authentication.ClientCredentialsProvider

@@ -16,4 +16,5 @@
 #
 
 org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider
-org.keycloak.adapters.authentication.JWTClientCredentialsProvider
+org.keycloak.adapters.authentication.JWTClientCredentialsProvider
+org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory

@@ -0,0 +1,19 @@
+#
+# * Copyright 2018 Red Hat, Inc. and/or its affiliates
+# * and other contributors as indicated by the @author tags.
+# *
+# * Licensed under the Apache License, Version 2.0 (the "License");
+# * you may not use this file except in compliance with the License.
+# * You may obtain a copy of the License at
+# *
+# * http://www.apache.org/licenses/LICENSE-2.0
+# *
+# * Unless required by applicable law or agreed to in writing, software
+# * distributed under the License is distributed on an "AS IS" BASIS,
+# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# * See the License for the specific language governing permissions and
+# * limitations under the License.
+#
+
+org.keycloak.adapters.authorization.cip.ClaimsInformationPointProviderFactory
+org.keycloak.adapters.authorization.cip.HttpClaimInformationPointProviderFactory

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentBuilderTest.java

@@ -21,6 +21,7 @@ import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
 import org.junit.Test;
 import org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider;
 import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
+import org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider;
 import org.keycloak.adapters.rotation.HardcodedPublicKeyLocator;
 import org.keycloak.adapters.rotation.JWKPublicKeyLocator;
 import org.keycloak.common.enums.RelativeUrlsUsed;
@@ -29,10 +30,13 @@ import org.keycloak.common.util.PemUtils;
 import org.keycloak.enums.TokenStore;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
+ * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  */
 public class KeycloakDeploymentBuilderTest {
 
@@ -53,10 +57,12 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(1000, deployment.getCorsMaxAge());
         assertEquals("POST, PUT, DELETE, GET", deployment.getCorsAllowedMethods());
         assertEquals("X-Custom, X-Custom2", deployment.getCorsAllowedHeaders());
+        assertEquals("X-Custom3, X-Custom4", deployment.getCorsExposedHeaders());
         assertTrue(deployment.isBearerOnly());
         assertTrue(deployment.isPublicClient());
         assertTrue(deployment.isEnableBasicAuth());
         assertTrue(deployment.isExposeToken());
+        assertFalse(deployment.isOAuthQueryParameterEnabled());
         assertEquals("234234-234234-234234", deployment.getResourceCredentials().get("secret"));
         assertEquals(ClientIdAndSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
         assertEquals(20, ((ThreadSafeClientConnManager) deployment.getClient().getConnectionManager()).getMaxTotal());
@@ -70,6 +76,8 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(10, deployment.getTokenMinimumTimeToLive());
         assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
         assertEquals(120, deployment.getPublicKeyCacheTtl());
+        assertEquals("/api/$1", deployment.getRedirectRewriteRules().get("^/wsmaster/api/(.*)$"));
+        assertTrue(deployment.isVerifyTokenAudience());
     }
 
     @Test
@@ -88,4 +96,9 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(JWTClientCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
     }
 
+    @Test
+    public void loadSecretJwtCredentials() throws Exception {
+        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak-secret-jwt.json"));
+        assertEquals(JWTClientSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
+    }
 }

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentTest.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters;
+
+import org.junit.Test;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
+ * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
+ */
+public class KeycloakDeploymentTest {
+    @Test
+    public void shouldNotEnableOAuthQueryParamWhenIgnoreIsTrue() {
+        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
+        keycloakDeployment.setIgnoreOAuthQueryParameter(true);
+        assertFalse(keycloakDeployment.isOAuthQueryParameterEnabled());
+    }
+
+    @Test
+    public void shouldEnableOAuthQueryParamWhenIgnoreIsFalse() {
+        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
+        keycloakDeployment.setIgnoreOAuthQueryParameter(false);
+        assertTrue(keycloakDeployment.isOAuthQueryParameterEnabled());
+    }
+
+    @Test
+    public void shouldEnableOAuthQueryParamWhenIgnoreNotSet() {
+        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
+
+        assertTrue(keycloakDeployment.isOAuthQueryParameterEnabled());
+    }
+
+    @Test
+    public void stripDefaultPorts() {
+        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
+        keycloakDeployment.setRealm("test");
+        AdapterConfig config = new AdapterConfig();
+        config.setAuthServerUrl("http://localhost:80/auth");
+        keycloakDeployment.setAuthServerBaseUrl(config);
+
+        assertEquals("http://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
+
+        config.setAuthServerUrl("https://localhost:443/auth");
+        keycloakDeployment.setAuthServerBaseUrl(config);
+
+        assertEquals("https://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
+    }
+
+}

adapters/oidc/adapter-core/src/test/resources/keycloak-secret-jwt.json

@@ -0,0 +1,12 @@
+{
+    "realm": "demo",
+    "resource": "customer-portal",
+    "realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
+    "auth-server-url": "https://localhost:8443/auth",
+    "ssl-required": "external",
+    "credentials": {
+        "secret-jwt": {
+            "secret": "234234-234234-234234"
+        }
+    }
+}

adapters/oidc/adapter-core/src/test/resources/keycloak.json

@@ -9,6 +9,7 @@
     "cors-max-age": 1000,
     "cors-allowed-methods": "POST, PUT, DELETE, GET",
     "cors-allowed-headers": "X-Custom, X-Custom2",
+    "cors-exposed-headers": "X-Custom3, X-Custom4",
     "bearer-only": true,
     "public-client": true,
     "enable-basic-auth": true,
@@ -31,5 +32,10 @@
     "principal-attribute": "email",
     "token-minimum-time-to-live": 10,
     "min-time-between-jwks-requests": 20,
-    "public-key-cache-ttl": 120
+    "public-key-cache-ttl": 120,
+    "ignore-oauth-query-parameter": true,
+    "verify-token-audience": true,
+    "redirect-rewrite-rules" : {
+  	"^/wsmaster/api/(.*)$" : "/api/$1"
+     }
 }

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -47,7 +47,6 @@
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -86,17 +85,4 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
-
 </project>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -118,17 +118,4 @@
             <scope>test</scope>
         </dependency>
     </dependencies>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
-
 </project>

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/AuthenticatedActionsValve.java

@@ -0,0 +1,13 @@
+package org.keycloak.adapters.jbossweb;
+
+import org.apache.catalina.Container;
+import org.apache.catalina.Valve;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
+
+public class AuthenticatedActionsValve extends AbstractAuthenticatedActionsValve {
+
+    public AuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
+        super(deploymentContext, next, container);
+    }
+}

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/KeycloakAuthenticatorValve.java

@@ -17,11 +17,15 @@
 
 package org.keycloak.adapters.jbossweb;
 
+import org.apache.catalina.Container;
 import org.apache.catalina.LifecycleException;
+import org.apache.catalina.Valve;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
 import org.apache.catalina.core.StandardContext;
 import org.apache.catalina.deploy.LoginConfig;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
 import org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve;
 import org.keycloak.adapters.tomcat.GenericPrincipalFactory;
 
@@ -56,7 +60,6 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
         super.start();
     }
 
-
     public void logout(Request request) {
         logoutInternal(request);
     }
@@ -65,4 +68,9 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
     protected GenericPrincipalFactory createPrincipalFactory() {
         return new JBossWebPrincipalFactory();
     }
+
+    @Override
+    protected AbstractAuthenticatedActionsValve createAuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
+        return new AuthenticatedActionsValve(deploymentContext, next, container);
+    }
 }

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -88,7 +88,6 @@
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>3.1.0.GA</version>
         </dependency>
 
         <dependency>
@@ -104,7 +103,6 @@ projects that depend on this project.-->
         <dependency>
             <groupId>org.jboss.msc</groupId>
             <artifactId>jboss-msc</artifactId>
-            <version>1.0.2.GA</version>
         </dependency>
 
         <dependency>

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/SecureDeploymentDefinition.java

@@ -98,6 +98,12 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
                     .setValidator(new IntRangeValidator(-1, true))
                     .setAllowExpression(true)
                     .build();
+    protected static final SimpleAttributeDefinition PUBLIC_KEY_CACHE_TTL =
+            new SimpleAttributeDefinitionBuilder("public-key-cache-ttl", ModelType.INT, true)
+                    .setXmlName("public-key-cache-ttl")
+                    .setAllowExpression(true)
+                    .setValidator(new IntRangeValidator(-1, true))
+                    .build();
 
     protected static final List<SimpleAttributeDefinition> DEPLOYMENT_ONLY_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
@@ -110,6 +116,7 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TURN_OFF_CHANGE_SESSION);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TOKEN_MINIMUM_TIME_TO_LIVE);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(MIN_TIME_BETWEEN_JWKS_REQUESTS);
+        DEPLOYMENT_ONLY_ATTRIBUTES.add(PUBLIC_KEY_CACHE_TTL);
     }
 
     protected static final List<SimpleAttributeDefinition> ALL_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/SharedAttributeDefinitons.java

@@ -166,6 +166,20 @@ class SharedAttributeDefinitons {
                     .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                     .build();
 
+    protected static final SimpleAttributeDefinition PROXY_URL =
+            new SimpleAttributeDefinitionBuilder("proxy-url", ModelType.STRING, true)
+                    .setXmlName("proxy-url")
+                    .setAllowExpression(true)
+                    .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
+                    .build();
+
+    protected static final SimpleAttributeDefinition VERIFY_TOKEN_AUDIENCE =
+            new SimpleAttributeDefinitionBuilder("verify-token-audience", ModelType.BOOLEAN, true)
+                    .setXmlName("verify-token-audience")
+                    .setAllowExpression(true)
+                    .setDefaultValue(new ModelNode(false))
+                    .build();
+
 
 
     protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
@@ -192,6 +206,8 @@ class SharedAttributeDefinitons {
         ATTRIBUTES.add(REGISTER_NODE_PERIOD);
         ATTRIBUTES.add(TOKEN_STORE);
         ATTRIBUTES.add(PRINCIPAL_ATTRIBUTE);
+        ATTRIBUTES.add(PROXY_URL);
+        ATTRIBUTES.add(VERIFY_TOKEN_AUDIENCE);
     }
 
     /**

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/org/keycloak/subsystem/as7/LocalDescriptions.properties

@@ -46,6 +46,8 @@ keycloak.realm.register-node-at-startup=Cluster setting
 keycloak.realm.register-node-period=how often to re-register node
 keycloak.realm.token-store=cookie or session storage for auth session data
 keycloak.realm.principal-attribute=token attribute to use to set Principal name
+keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.
+keycloak.realm.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -82,7 +84,9 @@ keycloak.secure-deployment.principal-attribute=token attribute to use to set Pri
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-
+keycloak.secure-deployment.public-key-cache-ttl=Maximum time the downloaded public keys are considered valid. When this time reach, the adapter is forced to download public keys from keycloak server
+keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
+keycloak.secure-deployment.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 keycloak.secure-deployment.credential=Credential value
 
 keycloak.credential=Credential

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/schema/keycloak_1_1.xsd

@@ -65,6 +65,8 @@
             <xs:element name="register-node-period" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="token-store" type="xs:string" minOccurs="0" maxOccurs="1"/>
             <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>
@@ -107,6 +109,9 @@
             <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
             <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="public-key-cache-ttl" type="xs:integer" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -30,9 +30,26 @@
     <artifactId>keycloak-as7-integration-pom</artifactId>
     <packaging>pom</packaging>
 
+    <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+    </properties>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.jboss.as</groupId>
+                <artifactId>jboss-as-parent</artifactId>
+                <version>${jboss.as.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <modules>
         <module>as7-adapter-spi</module>
         <module>as7-adapter</module>
         <module>as7-subsystem</module>
     </modules>
-</project>
+</project>

adapters/oidc/fuse7/camel-undertow/pom.xml

@@ -0,0 +1,138 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-fuse7-integration-pom</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-camel-undertow</artifactId>
+    <name>Keycloak Fuse 7.0 Adapter - Camel + Undertow</name>
+    <packaging>bundle</packaging>
+
+    <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
+        <keycloak.osgi.export>
+            org.keycloak.adapters.camel.undertow;version="${project.version}"
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            org.keycloak.*;version="${project.version}",
+            org.apache.camel.*,
+            org.apache.camel.component.undertow,
+            io.undertow.*;version="[1.4,3)",
+            *;resolution:=optional
+        </keycloak.osgi.import>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.enterprise</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-runtime</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-spi</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.undertow</groupId>
+            <artifactId>undertow-servlet</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-undertow-adapter</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.camel</groupId>
+            <artifactId>camel-undertow</artifactId>
+            <version>2.21.2</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.camel</groupId>
+            <artifactId>camel-core</artifactId>
+            <version>2.21.2</version>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                        <Export-Service>org.apache.camel.spi.ComponentResolver;component=undertow-keycloak</Export-Service>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

adapters/oidc/fuse7/camel-undertow/src/main/java/org/keycloak/adapters/camel/undertow/UndertowKeycloakComponent.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.camel.undertow;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import org.apache.camel.CamelContext;
+import org.apache.camel.component.undertow.UndertowComponent;
+import org.apache.camel.component.undertow.UndertowEndpoint;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class UndertowKeycloakComponent extends UndertowComponent {
+
+    public UndertowKeycloakComponent() {
+    }
+
+    public UndertowKeycloakComponent(CamelContext context) {
+        super(context);
+    }
+
+    @Override
+    protected UndertowEndpoint createEndpointInstance(URI endpointUri, UndertowComponent component) throws URISyntaxException {
+        return new UndertowKeycloakEndpoint(endpointUri.toString(), component);
+    }
+
+    @Override
+    protected String getComponentName() {
+        return "undertow-keycloak";
+    }
+}

adapters/oidc/fuse7/camel-undertow/src/main/java/org/keycloak/adapters/camel/undertow/UndertowKeycloakConsumer.java

@@ -0,0 +1,219 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.camel.undertow;
+
+import org.keycloak.KeycloakPrincipal;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.AdapterTokenStore;
+import org.keycloak.adapters.AuthenticatedActionsHandler;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.NodesRegistrationManagement;
+import org.keycloak.adapters.PreAuthActionsHandler;
+import org.keycloak.adapters.RequestAuthenticator;
+import org.keycloak.adapters.spi.AuthChallenge;
+import org.keycloak.adapters.spi.AuthOutcome;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.spi.InMemorySessionIdMapper;
+import org.keycloak.adapters.spi.SessionIdMapper;
+import org.keycloak.adapters.undertow.KeycloakUndertowAccount;
+import org.keycloak.adapters.undertow.OIDCUndertowHttpFacade;
+import org.keycloak.adapters.undertow.SessionManagementBridge;
+import org.keycloak.adapters.undertow.UndertowCookieTokenStore;
+import org.keycloak.adapters.undertow.UndertowRequestAuthenticator;
+import org.keycloak.adapters.undertow.UndertowSessionTokenStore;
+import org.keycloak.adapters.undertow.UndertowUserSessionManagement;
+import org.keycloak.enums.TokenStore;
+import io.undertow.security.api.SecurityContext;
+import io.undertow.security.idm.Account;
+import io.undertow.security.idm.Credential;
+import io.undertow.security.idm.IdentityManager;
+import io.undertow.security.impl.SecurityContextImpl;
+import io.undertow.server.HttpServerExchange;
+import io.undertow.server.session.InMemorySessionManager;
+import io.undertow.server.session.SessionManager;
+import io.undertow.util.AttachmentKey;
+import io.undertow.util.StatusCodes;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.regex.Pattern;
+import org.apache.camel.Processor;
+import org.apache.camel.component.undertow.UndertowConsumer;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class UndertowKeycloakConsumer extends UndertowConsumer {
+
+    private static final Logger LOG = Logger.getLogger(UndertowKeycloakConsumer.class.getName());
+
+    public static final AttachmentKey<KeycloakPrincipal> KEYCLOAK_PRINCIPAL_KEY = AttachmentKey.create(KeycloakPrincipal.class);
+
+    private static final IdentityManager IDENTITY_MANAGER = new IdentityManager() {
+        @Override
+        public Account verify(Account account) {
+            return account;
+        }
+
+        @Override
+        public Account verify(String id, Credential credential) {
+            throw new IllegalStateException("Should never be called in Keycloak flow");
+        }
+
+        @Override
+        public Account verify(Credential credential) {
+            throw new IllegalStateException("Should never be called in Keycloak flow");
+        }
+    };
+
+    protected SessionIdMapper idMapper = new InMemorySessionIdMapper();
+
+    protected final NodesRegistrationManagement nodesRegistrationManagement = new NodesRegistrationManagement();
+
+    private final UndertowUserSessionManagement userSessionManagement = new UndertowUserSessionManagement();
+
+    protected final AdapterDeploymentContext deploymentContext;
+
+    protected final SessionManager sessionManager;
+
+    protected final List<String> allowedRoles;
+
+    private final int confidentialPort;
+
+    private final Pattern skipPattern;
+
+    public UndertowKeycloakConsumer(UndertowKeycloakEndpoint endpoint, Processor processor, 
+      AdapterDeploymentContext deploymentContext, Pattern skipPattern, List<String> allowedRoles, int confidentialPort) {
+        super(endpoint, processor);
+        this.sessionManager = new InMemorySessionManager(endpoint.getEndpointUri());
+        this.deploymentContext = deploymentContext;
+        this.skipPattern = skipPattern;
+        this.confidentialPort = confidentialPort;
+        this.allowedRoles = allowedRoles == null ? Collections.<String>emptyList() : allowedRoles;
+    }
+
+    public int getConfidentialPort() {
+        return confidentialPort;
+    }
+
+    @Override
+    public void handleRequest(HttpServerExchange httpExchange) throws Exception {
+        if (shouldSkip(httpExchange.getRequestPath())) {
+            super.handleRequest(httpExchange);
+            return;
+        }
+
+        //perform only non-blocking operation on exchange
+        if (httpExchange.isInIoThread()) {
+            httpExchange.dispatch(this);
+            return;
+        }
+
+        OIDCUndertowHttpFacade facade = new OIDCUndertowHttpFacade(httpExchange);
+        KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
+
+        if (deployment == null || !deployment.isConfigured()) {
+            httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
+            LOG.fine("deployment not configured");
+            return;
+        }
+
+        LOG.fine("executing PreAuthActionsHandler");
+        SessionManagementBridge bridge = new SessionManagementBridge(userSessionManagement, sessionManager);
+        PreAuthActionsHandler preAuth = new PreAuthActionsHandler(bridge, deploymentContext, facade);
+        if (preAuth.handleRequest()) return;
+
+        SecurityContext securityContext = httpExchange.getSecurityContext();
+        if (securityContext == null) {
+            securityContext = new SecurityContextImpl(httpExchange, IDENTITY_MANAGER);
+        }
+        AdapterTokenStore tokenStore = getTokenStore(httpExchange, facade, deployment, securityContext);
+        tokenStore.checkCurrentToken();
+
+        LOG.fine("executing AuthenticatedActionsHandler");
+        RequestAuthenticator authenticator = new UndertowRequestAuthenticator(facade, deployment, confidentialPort, securityContext, httpExchange, tokenStore);
+        AuthOutcome outcome = authenticator.authenticate();
+
+        if (outcome == AuthOutcome.AUTHENTICATED) {
+            LOG.fine("AUTHENTICATED");
+            if (httpExchange.isResponseComplete()) {
+                return;
+            }
+            AuthenticatedActionsHandler actions = new AuthenticatedActionsHandler(deployment, facade);
+            if (actions.handledRequest()) {
+                return;
+            } else {
+                final Account authenticatedAccount = securityContext.getAuthenticatedAccount();
+                if (authenticatedAccount instanceof KeycloakUndertowAccount) {
+                    final KeycloakUndertowAccount kua = (KeycloakUndertowAccount) authenticatedAccount;
+                    httpExchange.putAttachment(KEYCLOAK_PRINCIPAL_KEY, (KeycloakPrincipal) kua.getPrincipal());
+                }
+
+                Set<String> roles = Optional
+                  .ofNullable(authenticatedAccount.getRoles())
+                  .orElse((Set<String>) Collections.EMPTY_SET);
+
+                LOG.log(Level.FINE, "Allowed roles: {0}, current roles: {1}", new Object[] {allowedRoles, roles});
+
+                if (isRoleAllowed(roles, httpExchange)) {
+                    super.handleRequest(httpExchange);
+                } else {
+                    httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
+                }
+
+                return;
+            }
+        }
+
+        AuthChallenge challenge = authenticator.getChallenge();
+        if (challenge != null) {
+            LOG.fine("challenge");
+            challenge.challenge(facade);
+            return;
+        }
+
+        httpExchange.setStatusCode(StatusCodes.FORBIDDEN);
+    }
+
+    public boolean isRoleAllowed(Set<String> roles, HttpServerExchange httpExchange) throws Exception {
+        for (String role : allowedRoles) {
+            if (roles.contains(role)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    protected AdapterTokenStore getTokenStore(HttpServerExchange exchange, HttpFacade facade, KeycloakDeployment deployment, SecurityContext securityContext) {
+        if (deployment.getTokenStore() == TokenStore.SESSION) {
+            return new UndertowSessionTokenStore(exchange, deployment, userSessionManagement, securityContext);
+        } else {
+            return new UndertowCookieTokenStore(facade, deployment, securityContext);
+        }
+    }
+
+    private boolean shouldSkip(String requestPath) {
+        return skipPattern != null && skipPattern.matcher(requestPath).matches();
+    }
+
+}

adapters/oidc/fuse7/camel-undertow/src/main/java/org/keycloak/adapters/camel/undertow/UndertowKeycloakEndpoint.java

@@ -0,0 +1,152 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.camel.undertow;
+
+import org.keycloak.KeycloakPrincipal;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.KeycloakConfigResolver;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import io.undertow.server.HttpServerExchange;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.regex.Pattern;
+import org.apache.camel.Consumer;
+import org.apache.camel.Exchange;
+import org.apache.camel.Processor;
+import org.apache.camel.component.undertow.UndertowComponent;
+import org.apache.camel.component.undertow.UndertowEndpoint;
+import static org.keycloak.adapters.camel.undertow.UndertowKeycloakConsumer.KEYCLOAK_PRINCIPAL_KEY;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class UndertowKeycloakEndpoint extends UndertowEndpoint {
+
+    private static final Logger LOG = Logger.getLogger(UndertowKeycloakEndpoint.class.getName());
+
+    private KeycloakConfigResolver configResolver;
+
+    private AdapterConfig adapterConfig;
+
+    private String skipPattern;
+
+    private List<String> allowedRoles = Collections.emptyList();
+
+    private int confidentialPort = 8443;
+
+    public UndertowKeycloakEndpoint(String uri, UndertowComponent component) {
+        super(uri, component);
+    }
+
+    public AdapterConfig getAdapterConfig() {
+        return adapterConfig;
+    }
+
+    public void setAdapterConfig(AdapterConfig adapterConfig) {
+        LOG.info("adapterConfig");
+        this.adapterConfig = adapterConfig;
+    }
+
+    public String getSkipPattern() {
+        return skipPattern;
+    }
+
+    public void setSkipPattern(String skipPattern) {
+        this.skipPattern = skipPattern;
+    }
+
+    public List<String> getAllowedRoles() {
+        return allowedRoles;
+    }
+
+    public void setAllowedRoles(List<String> allowedRoles) {
+        this.allowedRoles = allowedRoles;
+    }
+
+    public void setAllowedRoles(String allowedRoles) {
+        this.allowedRoles = allowedRoles == null ? null : Arrays.asList(allowedRoles.split("\\s*,\\s*"));
+    }
+
+    public int getConfidentialPort() {
+        return confidentialPort;
+    }
+
+    public void setConfidentialPort(int confidentialPort) {
+        this.confidentialPort = confidentialPort;
+    }
+
+    public KeycloakConfigResolver getConfigResolver() {
+        return configResolver;
+    }
+
+    public void setConfigResolver(KeycloakConfigResolver configResolver) {
+        this.configResolver = configResolver;
+    }
+
+    @Override
+    public Consumer createConsumer(Processor processor) throws Exception {
+        return new UndertowKeycloakConsumer(this, processor, getDeploymentContext(), getSkipPatternAsPattern(), computeAllowedRoles(), this.confidentialPort);
+    }
+
+    public List<String> computeAllowedRoles() {
+        List<String> res = this.allowedRoles == null ? Collections.<String>emptyList() : this.allowedRoles;
+        if (res.isEmpty()) {
+            LOG.warning("No roles were configured, Keycloak will deny every request");
+        }
+        LOG.log(Level.FINE, "Allowed roles: {0}", res);
+        return res;
+    }
+
+    @Override
+    public Exchange createExchange(HttpServerExchange httpExchange) throws Exception {
+        final Exchange res = super.createExchange(httpExchange);
+
+        KeycloakPrincipal principal = httpExchange.getAttachment(KEYCLOAK_PRINCIPAL_KEY);
+        LOG.log(Level.FINE, "principal: {0}", principal);
+        if (principal != null) {
+            res.setProperty(KeycloakPrincipal.class.getName(), principal);
+        }
+
+        return res;
+    }
+
+    private AdapterDeploymentContext getDeploymentContext() {
+        if (configResolver != null) {
+            LOG.log(Level.INFO, "Using {0} to resolve Keycloak configuration on a per-request basis.", configResolver.getClass());
+            return new AdapterDeploymentContext(configResolver);
+        } else if (adapterConfig != null) {
+            KeycloakDeployment kd = KeycloakDeploymentBuilder.build(adapterConfig);
+            return new AdapterDeploymentContext(kd);
+        }
+
+        LOG.warning("Adapter is unconfigured, Keycloak will deny every request");
+        return new AdapterDeploymentContext();
+    }
+
+    private Pattern getSkipPatternAsPattern() {
+        return skipPattern == null
+          ? null
+          : Pattern.compile(skipPattern, Pattern.DOTALL);
+    }
+}

adapters/oidc/fuse7/camel-undertow/src/main/resources/META-INF/services/org/apache/camel/component/undertow-keycloak

@@ -0,0 +1 @@
+class=org.keycloak.adapters.camel.undertow.UndertowKeycloakComponent

adapters/oidc/fuse7/jetty94/pom.xml

@@ -0,0 +1,122 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-fuse7-integration-pom</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-pax-web-jetty94</artifactId>
+    <name>Keycloak Fuse 7.0 Adapter - Jetty 9.4</name>
+    <packaging>bundle</packaging>
+
+    <properties>
+        <keycloak.osgi.export>
+            org.keycloak.adapters.osgi.jetty94.*;version="${project.version}"
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            !org.keycloak.adapters.osgi.jetty94,
+            org.ops4j.pax.web.*;version="[7.1,9)",
+            org.keycloak.*;version="${project.version}",
+            *;resolution:=optional
+        </keycloak.osgi.import>
+        <keycloak.osgi.fragment>org.ops4j.pax.web.pax-web-jetty</keycloak.osgi.fragment>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-spi</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.enterprise</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-jetty94-adapter</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-security</artifactId>
+            <version>${jetty9.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                        <Fragment-Host>${keycloak.osgi.fragment}</Fragment-Host>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

adapters/oidc/fuse7/jetty94/src/main/java/org/keycloak/adapters/osgi/jetty94/KeycloakAuthenticatorService.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.osgi.jetty94;
+
+import org.ops4j.pax.web.service.AuthenticatorService;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class KeycloakAuthenticatorService implements AuthenticatorService {
+
+    @Override
+    public <T> T getAuthenticatorService(String method, Class<T> iface) {
+        if (method == null || iface != org.eclipse.jetty.security.Authenticator.class) {
+            return null;
+        }
+
+        if ("KEYCLOAK".equalsIgnoreCase(method)) {
+            return iface.cast(new org.keycloak.adapters.jetty.KeycloakJettyAuthenticator());
+        }
+
+        return null;
+    }
+
+}

adapters/oidc/fuse7/jetty94/src/main/java/org/keycloak/adapters/osgi/jetty94/PaxWebIntegrationService.java

@@ -0,0 +1,280 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.osgi.jetty94;
+
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.util.security.Constraint;
+import org.jboss.logging.Logger;
+import org.ops4j.pax.web.service.WebContainer;
+import org.ops4j.pax.web.service.spi.model.SecurityConstraintMappingModel;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.ServiceReference;
+import org.osgi.service.http.HttpContext;
+import org.osgi.util.tracker.ServiceTracker;
+import org.osgi.util.tracker.ServiceTrackerCustomizer;
+
+import java.net.URL;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Integration with pax-web, which allows to inject custom jetty-web.xml configuration from current bundle classpath into {@link WebContainer}
+ * and allows to inject custom security constraint for securing resources by Keycloak.
+ *
+ * <p>It assumes that pax-web {@link WebContainer} is used as implementation of OSGI {@link org.osgi.service.http.HttpService}, which
+ * is true in karaf/fuse environment</p>
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PaxWebIntegrationService {
+
+    protected static final Logger log = Logger.getLogger(PaxWebIntegrationService.class);
+
+    private BundleContext bundleContext;
+    private String jettyWebXmlLocation;
+    private List<Object> constraintMappings;
+
+    private ServiceTracker webContainerTracker;
+    private HttpContext httpContext;
+
+    public BundleContext getBundleContext() {
+        return bundleContext;
+    }
+
+    public void setBundleContext(BundleContext bundleContext) {
+        this.bundleContext = bundleContext;
+    }
+
+    public String getJettyWebXmlLocation() {
+        return jettyWebXmlLocation;
+    }
+
+    public void setJettyWebXmlLocation(String jettyWebXmlLocation) {
+        this.jettyWebXmlLocation = jettyWebXmlLocation;
+    }
+
+    public List<Object> getConstraintMappings() {
+        return constraintMappings;
+    }
+
+    public void setConstraintMappings(List<Object> constraintMappings) {
+        this.constraintMappings = constraintMappings;
+    }
+
+    protected ServiceTracker getWebContainerTracker() {
+        return webContainerTracker;
+    }
+
+    protected HttpContext getHttpContext() {
+        return httpContext;
+    }
+
+    public void setHttpContext(HttpContext httpContext) {
+        this.httpContext = httpContext;
+    }
+
+    public void start() {
+        ServiceTrackerCustomizer trackerCustomizer = new ServiceTrackerCustomizer() {
+
+            @Override
+            public Object addingService(ServiceReference reference) {
+                return addingWebContainerCallback(reference);
+            }
+
+            @Override
+            public void modifiedService(ServiceReference reference, Object service) {
+            }
+
+            @Override
+            public void removedService(ServiceReference reference, Object service) {
+                removingWebContainerCallback(reference);
+            }
+        };
+
+        webContainerTracker = new ServiceTracker(bundleContext, WebContainer.class.getName(), trackerCustomizer);
+        webContainerTracker.open();
+    }
+
+    public void stop() {
+        webContainerTracker.remove(webContainerTracker.getServiceReference());
+    }
+
+    protected WebContainer addingWebContainerCallback(ServiceReference webContainerServiceReference) {
+        WebContainer service = (WebContainer) bundleContext.getService(webContainerServiceReference);
+        if (httpContext == null) {
+            httpContext = service.createDefaultHttpContext();
+        }
+
+        addJettyWebXml(service);
+
+        if (constraintMappings == null) {
+            throw new IllegalStateException("constraintMappings was null!");
+        }
+        List<ConstraintHandler> handlers = new ArrayList<>();
+        try {
+            handlers.add(new JettyConstraintHandler());
+        } catch (Throwable t) {
+            // Ignore
+        }
+        try {
+            handlers.add(new PaxWebConstraintHandler());
+        } catch (Throwable t) {
+            // Ignore
+        }
+        for (Object constraintMapping : constraintMappings) {
+            boolean handled = false;
+            for (ConstraintHandler handler : handlers) {
+                handled |= handler.addConstraintMapping(httpContext, service, constraintMapping);
+            }
+            if (!handled) {
+                log.warnv("Unable to add constraint mapping for constraint of type " + constraintMapping.getClass().toString());
+            }
+        }
+
+        service.registerLoginConfig("BASIC", "does-not-matter", null, null, httpContext);
+
+        return service;
+    }
+
+    protected void addJettyWebXml(WebContainer service) {
+        String jettyWebXmlLoc;
+        if (this.jettyWebXmlLocation == null) {
+            jettyWebXmlLoc = "/WEB-INF/jetty-web.xml";
+        } else {
+            jettyWebXmlLoc = this.jettyWebXmlLocation;
+        }
+
+        URL jettyWebXml = bundleContext.getBundle().getResource(jettyWebXmlLoc);
+        if (jettyWebXml != null) {
+            log.debug("Found jetty-web XML configuration on bundle classpath on " + jettyWebXmlLoc);
+            service.registerJettyWebXml(jettyWebXml, httpContext);
+        } else {
+            log.debug("Not found jetty-web XML configuration on bundle classpath on " + jettyWebXmlLoc);
+        }
+    }
+
+    protected void addConstraintMapping(WebContainer service, SecurityConstraintMappingModel constraintMapping) {
+        String name = constraintMapping.getConstraintName();
+        if (name == null) {
+            name = "Constraint-" + new SecureRandom().nextInt(Integer.MAX_VALUE);
+        }
+        log.debug("Adding security constraint name=" + name + ", url=" + constraintMapping.getUrl() + ", dataConstraint=" + constraintMapping.getDataConstraint() + ", canAuthenticate="
+                + constraintMapping.isAuthentication() + ", roles=" + constraintMapping.getRoles());
+        service.registerConstraintMapping(name, constraintMapping.getUrl(), constraintMapping.getMapping(), constraintMapping.getDataConstraint(), constraintMapping.isAuthentication(), constraintMapping.getRoles(), httpContext);
+    }
+
+    protected void addConstraintMapping(WebContainer service, ConstraintMapping constraintMapping) {
+        Constraint constraint = constraintMapping.getConstraint();
+        String[] roles = constraint.getRoles();
+        // name property is unavailable on constraint object :/
+
+        String name = "Constraint-" + new SecureRandom().nextInt(Integer.MAX_VALUE);
+
+        int dataConstraint = constraint.getDataConstraint();
+        String dataConstraintStr;
+        switch (dataConstraint) {
+            case Constraint.DC_UNSET: dataConstraintStr = null; break;
+            case Constraint.DC_NONE: dataConstraintStr = "NONE"; break;
+            case Constraint.DC_CONFIDENTIAL: dataConstraintStr = "CONFIDENTIAL"; break;
+            case Constraint.DC_INTEGRAL: dataConstraintStr = "INTEGRAL"; break;
+            default:
+                log.warnv("Unknown data constraint: " + dataConstraint);
+                dataConstraintStr = "CONFIDENTIAL";
+        }
+        List<String> rolesList = Arrays.asList(roles);
+
+        log.debug("Adding security constraint name=" + name + ", url=" + constraintMapping.getPathSpec() + ", dataConstraint=" + dataConstraintStr + ", canAuthenticate="
+        + constraint.getAuthenticate() + ", roles=" + rolesList);
+        service.registerConstraintMapping(name, constraintMapping.getPathSpec(), null, dataConstraintStr, constraint.getAuthenticate(), rolesList, httpContext);
+    }
+
+    protected void removingWebContainerCallback(ServiceReference serviceReference) {
+        WebContainer service = (WebContainer)bundleContext.getService(serviceReference);
+        if (service != null) {
+            service.unregisterLoginConfig(httpContext);
+            service.unregisterConstraintMapping(httpContext);
+        }
+    }
+
+    private interface ConstraintHandler {
+        boolean addConstraintMapping(HttpContext httpContext, WebContainer service, Object cm);
+    }
+
+    private static class PaxWebConstraintHandler implements ConstraintHandler {
+
+        public boolean addConstraintMapping(HttpContext httpContext, WebContainer service, Object cm) {
+            if (cm instanceof SecurityConstraintMappingModel) {
+                SecurityConstraintMappingModel constraintMapping = (SecurityConstraintMappingModel) cm;
+                String name = constraintMapping.getConstraintName();
+                if (name == null) {
+                    name = "Constraint-" + new SecureRandom().nextInt(Integer.MAX_VALUE);
+                }
+                log.debug("Adding security constraint name=" + name + ", url=" + constraintMapping.getUrl() + ", dataConstraint=" + constraintMapping.getDataConstraint() + ", canAuthenticate="
+                        + constraintMapping.isAuthentication() + ", roles=" + constraintMapping.getRoles());
+                service.registerConstraintMapping(name, constraintMapping.getUrl(), constraintMapping.getMapping(), constraintMapping.getDataConstraint(), constraintMapping.isAuthentication(), constraintMapping.getRoles(), httpContext);
+                return true;
+            }
+            return false;
+        }
+
+    }
+
+    private static class JettyConstraintHandler implements ConstraintHandler {
+
+        public boolean addConstraintMapping(HttpContext httpContext, WebContainer service, Object cm) {
+            if (cm instanceof ConstraintMapping) {
+                ConstraintMapping constraintMapping = (ConstraintMapping) cm;
+                Constraint constraint = constraintMapping.getConstraint();
+                String[] roles = constraint.getRoles();
+                // name property is unavailable on constraint object :/
+
+                String name = "Constraint-" + new SecureRandom().nextInt(Integer.MAX_VALUE);
+
+                int dataConstraint = constraint.getDataConstraint();
+                String dataConstraintStr;
+                switch (dataConstraint) {
+                    case Constraint.DC_UNSET:
+                        dataConstraintStr = null;
+                        break;
+                    case Constraint.DC_NONE:
+                        dataConstraintStr = "NONE";
+                        break;
+                    case Constraint.DC_CONFIDENTIAL:
+                        dataConstraintStr = "CONFIDENTIAL";
+                        break;
+                    case Constraint.DC_INTEGRAL:
+                        dataConstraintStr = "INTEGRAL";
+                        break;
+                    default:
+                        log.warnv("Unknown data constraint: " + dataConstraint);
+                        dataConstraintStr = "CONFIDENTIAL";
+                }
+                List<String> rolesList = Arrays.asList(roles);
+
+                log.debug("Adding security constraint name=" + name + ", url=" + constraintMapping.getPathSpec() + ", dataConstraint=" + dataConstraintStr + ", canAuthenticate="
+                        + constraint.getAuthenticate() + ", roles=" + rolesList);
+                service.registerConstraintMapping(name, constraintMapping.getPathSpec(), null, dataConstraintStr, constraint.getAuthenticate(), rolesList, httpContext);
+                return true;
+            }
+            return false;
+        }
+
+    }
+}

adapters/oidc/fuse7/jetty94/src/main/resources/META-INF/services/org.ops4j.pax.web.service.AuthenticatorService

@@ -0,0 +1 @@
+org.keycloak.adapters.osgi.jetty94.KeycloakAuthenticatorService

adapters/oidc/fuse7/pom.xml

@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-fuse7-integration-pom</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak Fuse 7.0 Integration</name>
+
+    <properties>
+        <fuse7.version>7.0.1-SNAPSHOT</fuse7.version>
+        <tomcat.version>8.0.14</tomcat.version>
+        <jetty9.version>9.4.2.v20170220</jetty9.version>
+    </properties>
+
+    <modules>
+        <module>camel-undertow</module>
+        <module>undertow</module>
+    </modules>
+
+    <profiles>
+        <profile>
+            <id>community</id>
+            <activation>
+                <property>
+                    <name>!product</name>
+                </property>
+            </activation>
+            <modules>
+                <module>jetty94</module>
+                <module>tomcat8</module>
+            </modules>
+        </profile>
+    </profiles>
+</project>

adapters/oidc/fuse7/tomcat8/pom.xml

@@ -0,0 +1,107 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-fuse7-integration-pom</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-pax-web-tomcat8</artifactId>
+    <name>Keycloak Fuse 7.0 Adapter - Tomcat 8</name>
+    <packaging>bundle</packaging>
+
+    <properties>
+        <keycloak.osgi.export>
+            org.keycloak.adapters.osgi.tomcat.*;version="${project.version}"
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            !org.keycloak.adapters.osgi.tomcat,
+            org.ops4j.pax.web.*;version="[7.1,9)",
+            org.keycloak.*;version="${project.version}",
+            *;resolution:=optional
+        </keycloak.osgi.import>
+        <keycloak.osgi.fragment>org.ops4j.pax.web.pax-web-tomcat</keycloak.osgi.fragment>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-tomcat8-adapter</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-catalina</artifactId>
+            <version>${tomcat.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                        <Fragment-Host>${keycloak.osgi.fragment}</Fragment-Host>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

adapters/oidc/fuse7/tomcat8/src/main/java/org/keycloak/adapters/osgi/tomcat/KeycloakAuthenticatorService.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.osgi.tomcat;
+
+import org.ops4j.pax.web.service.AuthenticatorService;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class KeycloakAuthenticatorService implements AuthenticatorService {
+
+    @Override
+    public <T> T getAuthenticatorService(String method, Class<T> iface) {
+        if (method == null || iface != org.apache.catalina.Valve.class) {
+            return null;
+        }
+
+        if ("KEYCLOAK".equalsIgnoreCase(method)) {
+            return iface.cast(new org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve());
+        }
+
+        return null;
+    }
+
+}

adapters/oidc/fuse7/tomcat8/src/main/resources/META-INF/services/org.ops4j.pax.web.service.AuthenticatorService

@@ -0,0 +1 @@
+org.keycloak.adapters.osgi.tomcat.KeycloakAuthenticatorService

adapters/oidc/fuse7/undertow/pom.xml

@@ -0,0 +1,147 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-fuse7-integration-pom</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-pax-web-undertow</artifactId>
+    <name>Keycloak Fuse 7.0 Adapter - Undertow</name>
+    <packaging>bundle</packaging>
+
+    <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
+        <keycloak.osgi.export>
+            org.keycloak.adapters.osgi.undertow.*;version="${project.version}"
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            !org.keycloak.adapters.osgi.undertow,
+            org.keycloak.*;version="${project.version}",
+            org.keycloak.adapters.osgi.*;version="${project.version}",
+            org.ops4j.pax.web.*;version="[7.1,9)",
+            javax.servlet.*;version="[2.5,4)";resolution:=optional,
+            org.apache.cxf.transport.http;resolution:=optional;version="[3,4)",
+            org.apache.cxf.transport.http_undertow;resolution:=optional;version="[3,4)",
+            org.apache.cxf.transport.servlet;resolution:=optional;version="[3,4)",
+            io.undertow.*;version="[1.4,3)",
+            *;resolution:=optional
+        </keycloak.osgi.import>
+        <keycloak.osgi.fragment>org.ops4j.pax.web.pax-web-undertow</keycloak.osgi.fragment>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.osgi</groupId>
+            <artifactId>org.osgi.enterprise</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-spi</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.ops4j.pax.web</groupId>
+            <artifactId>pax-web-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http</artifactId>
+            <version>${cxf.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http-undertow</artifactId>
+            <version>${cxf.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>io.undertow</groupId>
+            <artifactId>undertow-servlet</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-undertow-adapter</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-osgi-adapter</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                        <Fragment-Host>${keycloak.osgi.fragment}</Fragment-Host>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

adapters/oidc/fuse7/undertow/src/main/java/org/keycloak/adapters/osgi/undertow/CxfKeycloakAuthHandler.java

@@ -0,0 +1,174 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.osgi.undertow;
+
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.KeycloakConfigResolver;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.NodesRegistrationManagement;
+import org.keycloak.adapters.spi.InMemorySessionIdMapper;
+import org.keycloak.adapters.spi.SessionIdMapper;
+import org.keycloak.adapters.undertow.UndertowAuthenticationMechanism;
+import org.keycloak.adapters.undertow.UndertowUserSessionManagement;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import io.undertow.security.api.AuthenticationMechanism;
+import io.undertow.security.api.AuthenticationMode;
+import io.undertow.security.handlers.AuthenticationCallHandler;
+import io.undertow.security.handlers.AuthenticationConstraintHandler;
+import io.undertow.security.handlers.AuthenticationMechanismsHandler;
+import io.undertow.security.handlers.SecurityInitialHandler;
+import io.undertow.security.idm.Account;
+import io.undertow.security.idm.Credential;
+import io.undertow.security.idm.IdentityManager;
+import io.undertow.server.HttpHandler;
+import io.undertow.server.HttpServerExchange;
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.regex.Pattern;
+import org.apache.cxf.transport.http_undertow.CXFUndertowHttpHandler;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class CxfKeycloakAuthHandler implements CXFUndertowHttpHandler {
+
+    private static final Logger LOG = Logger.getLogger(CxfKeycloakAuthHandler.class.getName());
+
+    private static final IdentityManager IDENTITY_MANAGER = new IdentityManager() {
+        @Override
+        public Account verify(Account account) {
+            return account;
+        }
+
+        @Override
+        public Account verify(String id, Credential credential) {
+            throw new IllegalStateException("Should never be called in Keycloak flow");
+        }
+
+        @Override
+        public Account verify(Credential credential) {
+            throw new IllegalStateException("Should never be called in Keycloak flow");
+        }
+    };
+
+    private final UndertowUserSessionManagement userSessionManagement = new UndertowUserSessionManagement();
+
+    protected final NodesRegistrationManagement nodesRegistrationManagement = new NodesRegistrationManagement();
+
+    protected final SessionIdMapper idMapper = new InMemorySessionIdMapper();
+
+    private final AtomicReference<HttpHandler> securityHandler = new AtomicReference<>();
+
+    private Pattern skipPattern;
+
+    private int confidentialPort = 8443;
+
+    private HttpHandler next;
+
+    private KeycloakConfigResolver configResolver;
+
+    private AdapterConfig adapterConfig;
+
+    @Override
+    public void handleRequest(HttpServerExchange exchange) throws Exception {
+        if (shouldSkip(exchange.getRequestPath())) {
+            next.handleRequest(exchange);
+        } else {
+            getSecurityHandler().handleRequest(exchange);
+        }
+    }
+
+    private HttpHandler getSecurityHandler() {
+        if (this.securityHandler.get() == null) {
+            HttpHandler handler = this.next;
+
+            handler = new AuthenticationCallHandler(handler);
+            handler = new AuthenticationConstraintHandler(handler);
+
+            AdapterDeploymentContext deploymentContext = buildDeploymentContext();
+
+            final List<AuthenticationMechanism> mechanisms
+                = Collections.<AuthenticationMechanism>singletonList(
+                  new UndertowAuthenticationMechanism(deploymentContext, userSessionManagement, nodesRegistrationManagement, confidentialPort, null));
+            handler = new AuthenticationMechanismsHandler(handler, mechanisms);
+
+            this.securityHandler.compareAndSet(null, new SecurityInitialHandler(AuthenticationMode.PRO_ACTIVE, IDENTITY_MANAGER, "KEYCLOAK", handler));
+        }
+
+        return this.securityHandler.get();
+    }
+
+    private AdapterDeploymentContext buildDeploymentContext() {
+        if (configResolver != null) {
+            LOG.log(Level.INFO, "Using {0} to resolve Keycloak configuration on a per-request basis.", configResolver.getClass());
+            return new AdapterDeploymentContext(configResolver);
+        } else if (adapterConfig != null) {
+            KeycloakDeployment kd = KeycloakDeploymentBuilder.build(adapterConfig);
+            return new AdapterDeploymentContext(kd);
+        }
+
+        LOG.warning("Adapter is unconfigured, Keycloak will deny every request");
+        return new AdapterDeploymentContext();
+    }
+
+    @Override
+    public void setNext(HttpHandler nextHandler) {
+        this.next = nextHandler;
+    }
+
+    private boolean shouldSkip(String requestPath) {
+        return skipPattern != null && skipPattern.matcher(requestPath).matches();
+    }
+
+    public KeycloakConfigResolver getConfigResolver() {
+        return configResolver;
+    }
+
+    public void setConfigResolver(KeycloakConfigResolver configResolver) {
+        this.configResolver = configResolver;
+    }
+
+    public int getConfidentialPort() {
+        return confidentialPort;
+    }
+
+    public void setConfidentialPort(int confidentialPort) {
+        this.confidentialPort = confidentialPort;
+    }
+
+    public AdapterConfig getAdapterConfig() {
+        return adapterConfig;
+    }
+
+    public void setAdapterConfig(AdapterConfig adapterConfig) {
+        this.adapterConfig = adapterConfig;
+    }
+
+    public String getSkipPattern() {
+        return skipPattern.pattern();
+    }
+
+    public void setSkipPattern(String skipPattern) {
+        this.skipPattern = Pattern.compile(skipPattern, Pattern.DOTALL);
+    }
+
+}

adapters/oidc/fuse7/undertow/src/main/java/org/keycloak/adapters/osgi/undertow/KeycloakAuthenticatorService.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.osgi.undertow;
+
+import org.ops4j.pax.web.service.AuthenticatorService;
+
+/**
+ *
+ * @author hmlnarik
+ */
+public class KeycloakAuthenticatorService implements AuthenticatorService {
+
+    @Override
+    public <T> T getAuthenticatorService(String method, Class<T> iface) {
+        if (method == null || iface != io.undertow.servlet.ServletExtension.class) {
+            return null;
+        }
+
+        if ("KEYCLOAK".equalsIgnoreCase(method)) {
+            return iface.cast(new org.keycloak.adapters.undertow.KeycloakServletExtension());
+        }
+
+        return null;
+    }
+
+}

adapters/oidc/fuse7/undertow/src/main/java/org/keycloak/adapters/osgi/undertow/PaxWebIntegrationService.java

@@ -0,0 +1,142 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.osgi.undertow;
+
+import org.keycloak.adapters.osgi.PaxWebSecurityConstraintMapping;
+import org.jboss.logging.Logger;
+import org.ops4j.pax.web.service.WebContainer;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.ServiceReference;
+import org.osgi.service.http.HttpContext;
+import org.osgi.util.tracker.ServiceTracker;
+import org.osgi.util.tracker.ServiceTrackerCustomizer;
+
+import java.util.List;
+
+/**
+ * Integration with pax-web, which allows to inject custom security constraint for securing resources by Keycloak.
+ *
+ * <p>It assumes that pax-web {@link WebContainer} is used as implementation of OSGI {@link org.osgi.service.http.HttpService}, which
+ * is true in karaf/fuse environment</p>
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PaxWebIntegrationService {
+
+    protected static final Logger log = Logger.getLogger(PaxWebIntegrationService.class);
+
+    private BundleContext bundleContext;
+    private List<PaxWebSecurityConstraintMapping> constraintMappings;
+
+    private ServiceTracker webContainerTracker;
+    private HttpContext httpContext;
+
+    public BundleContext getBundleContext() {
+        return bundleContext;
+    }
+
+    public void setBundleContext(BundleContext bundleContext) {
+        this.bundleContext = bundleContext;
+    }
+
+    public List<PaxWebSecurityConstraintMapping> getConstraintMappings() {
+        return constraintMappings;
+    }
+
+    public void setConstraintMappings(List<PaxWebSecurityConstraintMapping> constraintMappings) {
+        this.constraintMappings = constraintMappings;
+    }
+
+    protected ServiceTracker getWebContainerTracker() {
+        return webContainerTracker;
+    }
+
+    protected HttpContext getHttpContext() {
+        return httpContext;
+    }
+
+    public void setHttpContext(HttpContext httpContext) {
+        this.httpContext = httpContext;
+    }
+
+    public void start() {
+        ServiceTrackerCustomizer trackerCustomizer = new ServiceTrackerCustomizer() {
+
+            @Override
+            public Object addingService(ServiceReference reference) {
+                return addingWebContainerCallback(reference);
+            }
+
+            @Override
+            public void modifiedService(ServiceReference reference, Object service) {
+            }
+
+            @Override
+            public void removedService(ServiceReference reference, Object service) {
+                removingWebContainerCallback(reference);
+            }
+        };
+
+        webContainerTracker = new ServiceTracker(bundleContext, WebContainer.class.getName(), trackerCustomizer);
+        webContainerTracker.open();
+    }
+
+    public void stop() {
+        webContainerTracker.remove(webContainerTracker.getServiceReference());
+    }
+
+    protected WebContainer addingWebContainerCallback(ServiceReference webContainerServiceReference) {
+        WebContainer service = (WebContainer) bundleContext.getService(webContainerServiceReference);
+        if (httpContext == null) {
+            httpContext = service.createDefaultHttpContext();
+        }
+
+        if (constraintMappings == null) {
+            throw new IllegalStateException("constraintMappings was null!");
+        }
+        for (PaxWebSecurityConstraintMapping constraintMapping : constraintMappings) {
+            addConstraintMapping(service, constraintMapping);
+        }
+
+        service.registerLoginConfig("KEYCLOAK", "specified-in-keycloak-json", null, null, httpContext);
+
+        return service;
+    }
+
+    protected void addConstraintMapping(WebContainer service, PaxWebSecurityConstraintMapping cm) {
+        log.debug("Adding security constraint name=" + cm.getConstraintName() + ", url=" + cm.getUrl() + ", dataConstraint=" + cm.getDataConstraint() + ", canAuthenticate="
+                + cm.isAuthentication() + ", roles=" + cm.getRoles());
+        service.registerConstraintMapping(
+          cm.getConstraintName(),
+          cm.getMapping(),
+          cm.getUrl(),
+          cm.getDataConstraint(),
+          cm.isAuthentication(),
+          cm.getRoles(),
+          httpContext
+        );
+    }
+
+    protected void removingWebContainerCallback(ServiceReference serviceReference) {
+        WebContainer service = (WebContainer)bundleContext.getService(serviceReference);
+        if (service != null) {
+            service.unregisterLoginConfig(httpContext);
+            service.unregisterConstraintMapping(httpContext);
+        }
+    }
+}

adapters/oidc/fuse7/undertow/src/main/resources/META-INF/services/org.ops4j.pax.web.service.AuthenticatorService

@@ -0,0 +1 @@
+org.keycloak.adapters.osgi.undertow.KeycloakAuthenticatorService

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -63,19 +63,15 @@
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-client</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.spec.javax.ws.rs</groupId>
+            <artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
+        </dependency>
+
     </dependencies>
 
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
-
 </project>

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KcinitDriver.java

@@ -0,0 +1,702 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.installed;
+
+import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.ServerRequest;
+import org.keycloak.common.util.Base64;
+import org.keycloak.common.util.Time;
+import org.keycloak.jose.jwe.*;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+import javax.crypto.SecretKey;
+import javax.crypto.SecretKeyFactory;
+import javax.crypto.spec.PBEKeySpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.ws.rs.client.Client;
+import javax.ws.rs.client.Entity;
+import javax.ws.rs.client.WebTarget;
+import javax.ws.rs.core.Form;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.io.*;
+import java.nio.file.Paths;
+import java.security.NoSuchAlgorithmException;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.KeySpec;
+import java.util.*;
+
+/**
+ * All kcinit commands that take input ask for
+ * <p>
+ * 1. . kcinit
+ * - setup and export KC_SESSION_KEY env var if not set.
+ * - checks to see if master token valid, refresh is possible, exit if token valid
+ * - performs command line login
+ * - stores master token for master client
+ * 2. app.sh is a wrapper for app cli.
+ * - token=`kcinit token app`
+ * - checks to see if token for app client has been fetched, refresh if valid, output token to sys.out if exists
+ * - if no token, login.  Prompts go to stderr.
+ * - pass token as cmd line param to app or as environment variable.
+ * <p>
+ * 3. kcinit password {password}
+ * - outputs password key that is used for encryption.
+ * - can be used in .bashrc as export KC_SESSSION_KEY=`kcinit password {password}` or just set it in .bat file
+ * <p>
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KcinitDriver {
+
+    public static final String KC_SESSION_KEY = "KC_SESSION_KEY";
+    public static final String KC_LOGIN_CONFIG_PATH = "KC_LOGIN_CONFIG_PATH";
+    protected Map<String, String> config;
+    protected boolean debug = true;
+
+    protected static byte[] salt = new byte[]{-4, 88, 66, -101, 78, -94, 21, 105};
+
+    String[] args = null;
+
+    protected boolean forceLogin;
+    protected boolean browserLogin;
+
+    public void mainCmd(String[] args) throws Exception {
+
+        this.args = args;
+
+
+        if (args.length == 0) {
+            printHelp();
+            return;
+        }
+
+        if (args[0].equalsIgnoreCase("token")) {
+            //System.err.println("executing token");
+            token();
+        } else if (args[0].equalsIgnoreCase("login")) {
+            login();
+        } else if (args[0].equalsIgnoreCase("logout")) {
+            logout();
+        } else if (args[0].equalsIgnoreCase("env")) {
+            System.out.println(System.getenv().toString());
+        } else if (args[0].equalsIgnoreCase("install")) {
+            install();
+        } else if (args[0].equalsIgnoreCase("uninstall")) {
+            uninstall();
+        } else if (args[0].equalsIgnoreCase("password")) {
+            passwordKey();
+        } else {
+            KeycloakInstalled.console().writer().println("Unknown command: " + args[0]);
+            KeycloakInstalled.console().writer().println();
+            printHelp();
+        }
+    }
+
+    public String getHome() {
+        String home = System.getenv("HOME");
+        if (home == null) {
+            home = System.getProperty("HOME");
+            if (home == null) {
+                home = Paths.get("").toAbsolutePath().normalize().toString();
+            }
+        }
+        return home;
+    }
+
+    public void passwordKey() {
+        if (args.length < 2) {
+            printHelp();
+            System.exit(1);
+        }
+        String password = args[1];
+        try {
+            String encodedKey = generateEncryptionKey(password);
+            System.out.printf(encodedKey);
+        } catch (Exception e) {
+            e.printStackTrace();
+            System.exit(1);
+        }
+    }
+
+    protected String generateEncryptionKey(String password) throws NoSuchAlgorithmException, InvalidKeySpecException {
+        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
+        KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 100, 128);
+        SecretKey tmp = factory.generateSecret(spec);
+        byte[] aeskey = tmp.getEncoded();
+        return Base64.encodeBytes(aeskey);
+    }
+
+    public JWE createJWE() {
+        String key = getEncryptionKey();
+        if (key == null) {
+            throw new RuntimeException(KC_SESSION_KEY + " env var not set");
+        }
+        byte[] aesKey = null;
+        try {
+            aesKey = Base64.decode(key.getBytes("UTF-8"));
+        } catch (IOException e) {
+            throw new RuntimeException("invalid " + KC_SESSION_KEY + "env var");
+        }
+
+        JWE jwe = new JWE();
+        final SecretKey aesSecret = new SecretKeySpec(aesKey, "AES");
+        jwe.getKeyStorage()
+                .setEncryptionKey(aesSecret);
+        return jwe;
+    }
+
+    protected String encryptionKey;
+
+    protected String getEncryptionKey() {
+        if (encryptionKey != null) return encryptionKey;
+        return System.getenv(KC_SESSION_KEY);
+    }
+
+    public String encrypt(String payload) {
+        JWE jwe = createJWE();
+        JWEHeader jweHeader = new JWEHeader(JWEConstants.A128KW, JWEConstants.A128CBC_HS256, null);
+        try {
+            jwe.header(jweHeader).content(payload.getBytes("UTF-8"));
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException("cannot encode payload as UTF-8");
+        }
+        try {
+            return jwe.encodeJwe();
+        } catch (JWEException e) {
+            throw new RuntimeException("cannot encrypt payload", e);
+        }
+    }
+
+    public String decrypt(String encoded) {
+        JWE jwe = createJWE();
+        try {
+            jwe.verifyAndDecodeJwe(encoded);
+            byte[] content = jwe.getContent();
+            if (content == null) return null;
+            return new String(content, "UTF-8");
+        } catch (Exception ex) {
+            throw new RuntimeException("cannot decrypt payload", ex);
+
+        }
+
+    }
+
+    public static String getenv(String name, String defaultValue) {
+        String val = System.getenv(name);
+        return val == null ? defaultValue : val;
+    }
+
+    public File getConfigDirectory() {
+        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit").toFile();
+    }
+
+
+    public File getConfigFile() {
+        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "config.json").toFile();
+    }
+
+    public File getTokenFilePath(String client) {
+        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens", client).toFile();
+    }
+
+    public File getTokenDirectory() {
+        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens").toFile();
+    }
+
+    protected boolean encrypted = false;
+
+    protected void checkEnv() {
+        File configFile = getConfigFile();
+        if (!configFile.exists()) {
+            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
+            System.exit(1);
+        }
+        byte[] data = new byte[0];
+        try {
+            data = readFileRaw(configFile);
+        } catch (IOException e) {
+
+        }
+        if (data == null) {
+            KeycloakInstalled.console().writer().println("Config file unreadable.  Please run 'kcinit install' to configure.");
+            System.exit(1);
+
+        }
+        String encodedJwe = null;
+        try {
+            encodedJwe = new String(data, "UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            e.printStackTrace();
+        }
+
+        if (encodedJwe.contains("realm")) {
+            encrypted = false;
+            return;
+        } else {
+            encrypted = true;
+        }
+
+        if (System.getenv(KC_SESSION_KEY) == null) {
+            promptLocalPassword();
+        }
+    }
+
+    protected void promptLocalPassword() {
+        String password = KeycloakInstalled.console().passwordPrompt("Enter password to unlock kcinit config files: ");
+        try {
+            encryptionKey = generateEncryptionKey(password);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+
+    protected String readFile(File fp) {
+        try {
+            byte[] data = readFileRaw(fp);
+            if (data == null) return null;
+            String file = new String(data, "UTF-8");
+            if (!encrypted) {
+                return file;
+            }
+            String decrypted = decrypt(file);
+            if (decrypted == null)
+                throw new RuntimeException("Unable to decrypt file.  Did you set your local password correctly?");
+            return decrypted;
+        } catch (IOException e) {
+            throw new RuntimeException("failed to decrypt file: " + fp.getAbsolutePath() + " Did you set your local password correctly?", e);
+        }
+
+
+    }
+
+    protected byte[] readFileRaw(File fp) throws IOException {
+        if (!fp.exists()) return null;
+        FileInputStream fis = new FileInputStream(fp);
+        byte[] data = new byte[(int) fp.length()];
+        fis.read(data);
+        fis.close();
+        return data;
+    }
+
+    protected void writeFile(File fp, String payload) {
+        try {
+            String data = payload;
+            if (encrypted) data = encrypt(payload);
+            FileOutputStream fos = new FileOutputStream(fp);
+            fos.write(data.getBytes("UTF-8"));
+            fos.flush();
+            fos.close();
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+
+    public void install() {
+        if (getEncryptionKey() == null) {
+            if (KeycloakInstalled.console().confirm("Do you want to protect tokens stored locally with a password? (y/n): ")) {
+                String password = "p";
+                String confirm = "c";
+                do {
+                    password = KeycloakInstalled.console().passwordPrompt("Enter local password: ");
+                    confirm = KeycloakInstalled.console().passwordPrompt("Confirm local password: ");
+                    if (!password.equals(confirm)) {
+                        KeycloakInstalled.console().writer().println();
+                        KeycloakInstalled.console().writer().println("Confirmation does not match.  Try again.");
+                        KeycloakInstalled.console().writer().println();
+                    }
+                } while (!password.equals(confirm));
+                try {
+                    this.encrypted = true;
+                    this.encryptionKey = generateEncryptionKey(password);
+                } catch (Exception e) {
+                    e.printStackTrace();
+                    System.exit(1);
+                }
+            }
+        } else {
+            if (!KeycloakInstalled.console().confirm("KC_SESSION_KEY env var already set.  Do you want to use this as your local encryption key? (y/n): ")) {
+                KeycloakInstalled.console().writer().println("Unset KC_SESSION_KEY env var and run again");
+                System.exit(1);
+            }
+            this.encrypted = true;
+            this.encryptionKey = getEncryptionKey();
+        }
+        String server = KeycloakInstalled.console().readLine("Authentication server URL [http://localhost:8080/auth]: ").trim();
+        String realm = KeycloakInstalled.console().readLine("Name of realm [master]: ").trim();
+        String client = KeycloakInstalled.console().readLine("CLI client id [kcinit]: ").trim();
+        String secret = KeycloakInstalled.console().readLine("CLI client secret [none]: ").trim();
+        if (server.equals("")) {
+            server = "http://localhost:8080/auth";
+        }
+        if (realm.equals("")) {
+            realm = "master";
+        }
+        if (client.equals("")) {
+            client = "kcinit";
+        }
+        File configDir = getTokenDirectory();
+        configDir.mkdirs();
+
+        File configFile = getConfigFile();
+        Map<String, String> props = new HashMap<>();
+        props.put("server", server);
+        props.put("realm", realm);
+        props.put("client", client);
+        props.put("secret", secret);
+
+        try {
+            String json = JsonSerialization.writeValueAsString(props);
+            writeFile(configFile, json);
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+
+        KeycloakInstalled.console().writer().println();
+        KeycloakInstalled.console().writer().println("Installation complete!");
+        KeycloakInstalled.console().writer().println();
+    }
+
+
+    public void printHelp() {
+        KeycloakInstalled.console().writer().println("Commands:");
+        KeycloakInstalled.console().writer().println("  login [-f] -f forces login");
+        KeycloakInstalled.console().writer().println("  logout");
+        KeycloakInstalled.console().writer().println("  token [client] - print access token of desired client.  Defaults to default master client.  Will print either 'error', 'not-allowed',  or 'login-required' on error.");
+        KeycloakInstalled.console().writer().println("  install - Install this utility.  Will store in $HOME/.keycloak/kcinit unless " + KC_LOGIN_CONFIG_PATH + " env var is set");
+        System.exit(1);
+    }
+
+
+    public AdapterConfig getConfig() {
+        File configFile = getConfigFile();
+        if (!configFile.exists()) {
+            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
+            System.exit(1);
+            return null;
+        }
+
+        AdapterConfig config = new AdapterConfig();
+        config.setAuthServerUrl((String) getConfigProperties().get("server"));
+        config.setRealm((String) getConfigProperties().get("realm"));
+        config.setResource((String) getConfigProperties().get("client"));
+        config.setSslRequired("external");
+        String secret = (String) getConfigProperties().get("secret");
+        if (secret != null && !secret.trim().equals("")) {
+            Map<String, Object> creds = new HashMap<>();
+            creds.put("secret", secret);
+            config.setCredentials(creds);
+        } else {
+            config.setPublicClient(true);
+        }
+        return config;
+    }
+
+    private Map<String, String> getConfigProperties() {
+        if (this.config != null) return this.config;
+        if (!getConfigFile().exists()) {
+            KeycloakInstalled.console().writer().println();
+            KeycloakInstalled.console().writer().println(("Config file does not exist.  Run kcinit install to set it up."));
+            System.exit(1);
+        }
+        String json = readFile(getConfigFile());
+        try {
+            Map map = JsonSerialization.readValue(json, Map.class);
+            config = (Map<String, String>) map;
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+        return this.config;
+    }
+
+    public String readToken(String client) throws Exception {
+        String json = getTokenResponse(client);
+        if (json == null) return null;
+
+
+        if (json != null) {
+            try {
+                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                if (Time.currentTime() < tokenResponse.getExpiresIn()) {
+                    return tokenResponse.getToken();
+                }
+                AdapterConfig config = getConfig();
+                KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+                installed.refreshToken(tokenResponse.getRefreshToken());
+                processResponse(installed, client);
+                return tokenResponse.getToken();
+            } catch (Exception e) {
+                File tokenFile = getTokenFilePath(client);
+                if (tokenFile.exists()) {
+                    tokenFile.delete();
+                }
+
+                return null;
+            }
+        }
+        return null;
+
+    }
+
+    public String readRefreshToken(String client) throws Exception {
+        String json = getTokenResponse(client);
+        if (json == null) return null;
+
+
+        if (json != null) {
+            try {
+                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                return tokenResponse.getRefreshToken();
+            } catch (Exception e) {
+                if (debug) {
+                    e.printStackTrace();
+                }
+                File tokenFile = getTokenFilePath(client);
+                if (tokenFile.exists()) {
+                    tokenFile.delete();
+                }
+
+                return null;
+            }
+        }
+        return null;
+
+    }
+
+
+    private String getTokenResponse(String client) throws IOException {
+        File tokenFile = getTokenFilePath(client);
+        try {
+            return readFile(tokenFile);
+        } catch (Exception e) {
+            if (debug) {
+                System.err.println("Failed to read encrypted file");
+                e.printStackTrace();
+            }
+            if (tokenFile.exists()) tokenFile.delete();
+            return null;
+        }
+    }
+
+
+    public void token() throws Exception {
+        KeycloakInstalled.console().stderrOutput();
+
+        checkEnv();
+        String masterClient = getMasterClient();
+        String client = masterClient;
+        if (args.length > 1) {
+            client = args[1];
+        }
+        //System.err.println("readToken: " + client);
+        String token = readToken(client);
+        if (token != null) {
+            System.out.print(token);
+            return;
+        }
+        if (token == null && client.equals(masterClient)) {
+            //System.err.println("not logged in, logging in.");
+            doConsoleLogin();
+            token = readToken(client);
+            if (token != null) {
+                System.out.print(token);
+                return;
+            }
+
+        }
+        String masterToken = readToken(masterClient);
+        if (masterToken == null) {
+            //System.err.println("not logged in, logging in.");
+            doConsoleLogin();
+            masterToken = readToken(masterClient);
+            if (masterToken == null) {
+                System.err.println("Login failed.  Cannot retrieve token");
+                System.exit(1);
+            }
+        }
+
+        //System.err.println("exchange: " + client);
+        Client httpClient = getHttpClient();
+
+        WebTarget exchangeUrl = httpClient.target(getServer())
+                .path("/realms")
+                .path(getRealm())
+                .path("protocol/openid-connect/token");
+
+        Form form = new Form()
+                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
+                .param(OAuth2Constants.CLIENT_ID, masterClient)
+                .param(OAuth2Constants.SUBJECT_TOKEN, masterToken)
+                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
+                .param(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE)
+                .param(OAuth2Constants.AUDIENCE, client);
+        if (getMasterClientSecret() != null) {
+            form.param(OAuth2Constants.CLIENT_SECRET, getMasterClientSecret());
+        }
+        Response response = exchangeUrl.request().post(Entity.form(
+                form
+        ));
+
+        if (response.getStatus() == 401 || response.getStatus() == 403) {
+            response.close();
+            System.err.println("Not allowed to exchange for client token");
+            System.exit(1);
+        }
+
+        if (response.getStatus() != 200) {
+            if (response.getMediaType() != null && response.getMediaType().equals(MediaType.APPLICATION_JSON_TYPE)) {
+                try {
+                    String json = response.readEntity(String.class);
+                    OAuth2ErrorRepresentation error = JsonSerialization.readValue(json, OAuth2ErrorRepresentation.class);
+                    System.err.println("Failed to exchange token: " + error.getError() + ". " + error.getErrorDescription());
+                    System.exit(1);
+                } catch (Exception ignore) {
+                    ignore.printStackTrace();
+
+                }
+            }
+
+            response.close();
+            System.err.println("Unknown error exchanging for client token: " + response.getStatus());
+            System.exit(1);
+        }
+
+        String json = response.readEntity(String.class);
+        response.close();
+        AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+        if (tokenResponse.getToken() != null) {
+            getTokenDirectory().mkdirs();
+            tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
+            tokenResponse.setIdToken(null);
+            json = JsonSerialization.writeValueAsString(tokenResponse);
+            writeFile(getTokenFilePath(client), json);
+            System.out.printf(tokenResponse.getToken());
+        } else {
+            System.err.println("Error processing token");
+            System.exit(1);
+        }
+    }
+
+    protected String getMasterClientSecret() {
+        return getProperty("secret");
+    }
+
+    protected String getServer() {
+        return getProperty("server");
+    }
+
+    protected String getRealm() {
+        return getProperty("realm");
+    }
+
+    public String getProperty(String name) {
+        return (String) getConfigProperties().get(name);
+    }
+
+    protected boolean forceLogin() {
+        return args.length > 0 && args[0].equals("-f");
+
+    }
+
+    public Client getHttpClient() {
+        return new ResteasyClientBuilder().disableTrustManager().build();
+    }
+
+    public void login() throws Exception {
+        checkEnv();
+        this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
+        for (String arg : args) {
+            if (arg.equals("-f") || arg.equals("-force")) {
+                forceLogin = true;
+                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
+            } else if (arg.equals("-browser") || arg.equals("-b")) {
+                browserLogin = true;
+                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
+            } else {
+                System.err.println("Illegal argument: " + arg);
+                printHelp();
+                System.exit(1);
+            }
+        }
+
+        String masterClient = getMasterClient();
+        if (!forceLogin && readToken(masterClient) != null) {
+            KeycloakInstalled.console().writer().println("Already logged in.  `kcinit -f` to force relogin");
+            return;
+        }
+        doConsoleLogin();
+        KeycloakInstalled.console().writer().println("Login successful!");
+    }
+
+    public void doConsoleLogin() throws Exception {
+        String masterClient = getMasterClient();
+        AdapterConfig config = getConfig();
+        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+        //System.err.println("calling loginCommandLine");
+        if (!installed.loginCommandLine()) {
+            System.exit(1);
+        }
+        processResponse(installed, masterClient);
+    }
+
+    private String getMasterClient() {
+        return getProperty("client");
+    }
+
+    private void processResponse(KeycloakInstalled installed, String client) throws IOException {
+        AccessTokenResponse tokenResponse = installed.getTokenResponse();
+        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
+        tokenResponse.setIdToken(null);
+        String json = JsonSerialization.writeValueAsString(tokenResponse);
+        getTokenDirectory().mkdirs();
+        writeFile(getTokenFilePath(client), json);
+    }
+
+    public void logout() throws Exception {
+        String token = readRefreshToken(getMasterClient());
+        if (token != null) {
+            try {
+                KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getConfig());
+                ServerRequest.invokeLogout(deployment, token);
+            } catch (Exception e) {
+                if (debug) {
+                    e.printStackTrace();
+                }
+            }
+
+        }
+        if (getTokenDirectory().exists()) {
+            for (File fp : getTokenDirectory().listFiles()) fp.delete();
+        }
+    }
+    public void uninstall() throws Exception {
+        File configFile = getConfigFile();
+        if (configFile.exists()) configFile.delete();
+        if (getTokenDirectory().exists()) {
+            for (File fp : getTokenDirectory().listFiles()) fp.delete();
+        }
+    }
+}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakInstalled.java

@@ -17,40 +17,47 @@
 
 package org.keycloak.adapters.installed;
 
+import org.jboss.resteasy.client.jaxrs.ResteasyClient;
+import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.ServerRequest;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
 
+import javax.ws.rs.client.Entity;
+import javax.ws.rs.core.Form;
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.Response;
 import java.awt.*;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.io.OutputStreamWriter;
-import java.io.PrintStream;
-import java.io.PrintWriter;
-import java.io.Reader;
+import java.io.*;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.util.Locale;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public class KeycloakInstalled {
 
+    public interface HttpResponseWriter {
+        void success(PrintWriter pw, KeycloakInstalled ki);
+
+        void failure(PrintWriter pw, KeycloakInstalled ki);
+    }
+
     private static final String KEYCLOAK_JSON = "META-INF/keycloak.json";
 
     private KeycloakDeployment deployment;
@@ -59,12 +66,21 @@ public class KeycloakInstalled {
         LOGGED_MANUAL, LOGGED_DESKTOP
     }
 
+    private AccessTokenResponse tokenResponse;
     private String tokenString;
     private String idTokenString;
     private IDToken idToken;
     private AccessToken token;
     private String refreshToken;
     private Status status;
+    private Locale locale;
+    private HttpResponseWriter loginResponseWriter;
+    private HttpResponseWriter logoutResponseWriter;
+    private ResteasyClient resteasyClient;
+    Pattern callbackPattern = Pattern.compile("callback\\s*=\\s*\"([^\"]+)\"");
+    Pattern paramPattern = Pattern.compile("param=\"([^\"]+)\"\\s+label=\"([^\"]+)\"\\s+mask=(\\S+)");
+    Pattern codePattern = Pattern.compile("code=([^&]+)");
+
 
     public KeycloakInstalled() {
         InputStream config = Thread.currentThread().getContextClassLoader().getResourceAsStream(KEYCLOAK_JSON);
@@ -75,6 +91,38 @@ public class KeycloakInstalled {
         deployment = KeycloakDeploymentBuilder.build(config);
     }
 
+    public KeycloakInstalled(KeycloakDeployment deployment) {
+        this.deployment = deployment;
+    }
+
+    public HttpResponseWriter getLoginResponseWriter() {
+        return null;
+    }
+
+    public HttpResponseWriter getLogoutResponseWriter() {
+        return null;
+    }
+
+    public void setLoginResponseWriter(HttpResponseWriter loginResponseWriter) {
+        this.loginResponseWriter = loginResponseWriter;
+    }
+
+    public void setLogoutResponseWriter(HttpResponseWriter logoutResponseWriter) {
+        this.logoutResponseWriter = logoutResponseWriter;
+    }
+
+    public void setResteasyClient(ResteasyClient resteasyClient) {
+        this.resteasyClient = resteasyClient;
+    }
+
+    public Locale getLocale() {
+        return locale;
+    }
+
+    public void setLocale(Locale locale) {
+        this.locale = locale;
+    }
+
     public void login() throws IOException, ServerRequest.HttpFailure, VerificationException, InterruptedException, OAuthErrorException, URISyntaxException {
         if (isDesktopSupported()) {
             loginDesktop();
@@ -108,19 +156,22 @@ public class KeycloakInstalled {
     }
 
     public void loginDesktop() throws IOException, VerificationException, OAuthErrorException, URISyntaxException, ServerRequest.HttpFailure, InterruptedException {
-        CallbackListener callback = new CallbackListener();
+        CallbackListener callback = new CallbackListener(getLoginResponseWriter());
         callback.start();
 
         String redirectUri = "http://localhost:" + callback.server.getLocalPort();
         String state = UUID.randomUUID().toString();
 
-        String authUrl = deployment.getAuthUrl().clone()
+        KeycloakUriBuilder builder = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
                 .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
                 .queryParam(OAuth2Constants.STATE, state)
-                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
-                .build().toString();
+                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID);
+        if (locale != null) {
+            builder.queryParam(OAuth2Constants.UI_LOCALES_PARAM, locale.getLanguage());
+        }
+        String authUrl = builder.build().toString();
 
         Desktop.getDesktop().browse(new URI(authUrl));
 
@@ -144,7 +195,7 @@ public class KeycloakInstalled {
     }
 
     private void logoutDesktop() throws IOException, URISyntaxException, InterruptedException {
-        CallbackListener callback = new CallbackListener();
+        CallbackListener callback = new CallbackListener(getLogoutResponseWriter());
         callback.start();
 
         String redirectUri = "http://localhost:" + callback.server.getLocalPort();
@@ -167,9 +218,6 @@ public class KeycloakInstalled {
     }
 
     public void loginManual(PrintStream printer, Reader reader) throws IOException, ServerRequest.HttpFailure, VerificationException {
-        CallbackListener callback = new CallbackListener();
-        callback.start();
-
         String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
 
         String authUrl = deployment.getAuthUrl().clone()
@@ -190,6 +238,272 @@ public class KeycloakInstalled {
         status = Status.LOGGED_MANUAL;
     }
 
+    public static class Console {
+        protected java.io.Console console = System.console();
+        protected PrintWriter writer;
+        protected BufferedReader reader;
+
+        static Console SINGLETON = new Console();
+
+        private Console() {
+        }
+
+
+        public PrintWriter writer() {
+            if (console == null) {
+                if (writer == null) {
+                    writer = new PrintWriter(System.err, true);
+                }
+                return writer;
+            }
+            return console.writer();
+        }
+
+        public Reader reader() {
+            if (console == null) {
+                return getReader();
+            }
+            return console.reader();
+        }
+
+        protected BufferedReader getReader() {
+            if (reader != null) return reader;
+            reader = new BufferedReader(new BufferedReader(new InputStreamReader(System.in)));
+            return reader;
+        }
+
+        public Console format(String fmt, Object... args) {
+            if (console == null) {
+                writer().format(fmt, args);
+                return this;
+            }
+            console.format(fmt, args);
+            return this;
+        }
+
+        public Console printf(String format, Object... args) {
+            if (console == null) {
+                writer().printf(format, args);
+                return this;
+            }
+            console.printf(format, args);
+            return this;
+        }
+
+        public String readLine(String fmt, Object... args) {
+            if (console == null) {
+                format(fmt, args);
+                return readLine();
+            }
+            return console.readLine(fmt, args);
+        }
+
+        public boolean confirm(String fmt, Object... args) {
+            String prompt = "";
+            while (!"y".equals(prompt) && !"n".equals(prompt)) {
+                prompt = readLine(fmt, args);
+            }
+            return "y".equals(prompt);
+
+        }
+
+        public String prompt(String fmt, Object... args) {
+            String prompt = "";
+            while (prompt.equals("")) {
+                prompt = readLine(fmt, args).trim();
+            }
+            return prompt;
+
+        }
+
+        public String passwordPrompt(String fmt, Object... args) {
+            String prompt = "";
+            while (prompt.equals("")) {
+                char[] val = readPassword(fmt, args);
+                prompt = new String(val);
+                prompt = prompt.trim();
+            }
+            return prompt;
+
+        }
+
+        public String readLine() {
+            if (console == null) {
+                try {
+                    return getReader().readLine();
+                } catch (IOException e) {
+                    throw new RuntimeException(e);
+                }
+            }
+            return console.readLine();
+        }
+
+        public char[] readPassword(String fmt, Object... args) {
+            if (console == null) {
+                return readLine(fmt, args).toCharArray();
+
+            }
+            return console.readPassword(fmt, args);
+        }
+
+        public char[] readPassword() {
+            if (console == null) {
+                return readLine().toCharArray();
+            }
+            return console.readPassword();
+        }
+
+        public void flush() {
+            if (console == null) {
+                System.err.flush();
+                return;
+            }
+            console.flush();
+        }
+
+        public void stderrOutput() {
+            //System.err.println("not using System.console()");
+            console = null;
+        }
+    }
+
+    public static Console console() {
+        return Console.SINGLETON;
+    }
+
+    public boolean loginCommandLine() throws IOException, ServerRequest.HttpFailure, VerificationException {
+        String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
+
+        return loginCommandLine(redirectUri);
+    }
+
+
+    /**
+     * Experimental proprietary WWW-Authentication challenge protocol.
+     * WWW-Authentication: X-Text-Form-Challenge callback="{url}" param="{param-name}" label="{param-display-label}"
+     *
+     * @param redirectUri
+     * @return
+     * @throws IOException
+     * @throws ServerRequest.HttpFailure
+     * @throws VerificationException
+     */
+    public boolean loginCommandLine(String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
+        String authUrl = deployment.getAuthUrl().clone()
+                .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
+                .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
+                .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
+                .queryParam("display", "console")
+                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
+                .build().toString();
+        ResteasyClient client = createResteasyClient();
+        try {
+            //System.err.println("initial request");
+            Response response = client.target(authUrl).request().get();
+            while (true) {
+                if (response.getStatus() == 403) {
+                    if (response.getMediaType() != null) {
+                        String splash = response.readEntity(String.class);
+                        console().writer().println(splash);
+                    } else {
+                        System.err.println("Forbidden to login");
+                    }
+                    return false;
+                } else if (response.getStatus() == 401) {
+                    String authenticationHeader = response.getHeaderString(HttpHeaders.WWW_AUTHENTICATE);
+                    if (authenticationHeader == null) {
+                        System.err.println("Failure:  Invalid protocol.  No WWW-Authenticate header");
+                        return false;
+                    }
+                    //System.err.println("got header: " + authenticationHeader);
+                    if (!authenticationHeader.contains("X-Text-Form-Challenge")) {
+                        System.err.println("Failure:  Invalid WWW-Authenticate header.");
+                        return false;
+                    }
+                    if (response.getMediaType() != null) {
+                        String splash = response.readEntity(String.class);
+                        console().writer().println(splash);
+                    } else {
+                        response.close();
+                    }
+                    Matcher m = callbackPattern.matcher(authenticationHeader);
+                    if (!m.find()) {
+                        System.err.println("Failure: Invalid WWW-Authenticate header.");
+                        return false;
+                    }
+                    String callback = m.group(1);
+                    //System.err.println("callback: " + callback);
+                    m = paramPattern.matcher(authenticationHeader);
+                    Form form = new Form();
+                    while (m.find()) {
+                        String param = m.group(1);
+                        String label = m.group(2);
+                        String mask = m.group(3).trim();
+                        boolean maskInput = mask.equals("true");
+                        String value = null;
+                        if (maskInput) {
+                            char[] txt = console().readPassword(label);
+                            value = new String(txt);
+                        } else {
+                            value = console().readLine(label);
+                        }
+                        form.param(param, value);
+                    }
+                    response.close();
+                    client.close();
+                    client = createResteasyClient();
+                    response = client.target(callback).request().post(Entity.form(form));
+                } else if (response.getStatus() == 302) {
+                    int redirectCount = 0;
+                    do {
+                        String location = response.getLocation().toString();
+                        Matcher m = codePattern.matcher(location);
+                        if (!m.find()) {
+                            response.close();
+                            client.close();
+                            client = createResteasyClient();
+                            response = client.target(location).request().get();
+                        } else {
+                            response.close();
+                            client.close();
+                            String code = m.group(1);
+                            processCode(code, redirectUri);
+                            return true;
+                        }
+                        if (response.getStatus() == 302 && redirectCount++ > 4) {
+                            System.err.println("Too many redirects.  Aborting");
+                            return false;
+                        }
+                    } while (response.getStatus() == 302);
+                } else {
+                    System.err.println("Unknown response from server: " + response.getStatus());
+                    return false;
+                }
+            }
+        } catch (Exception ex) {
+            throw ex;
+        } finally {
+            client.close();
+
+        }
+    }
+
+    protected ResteasyClient getResteasyClient() {
+        if (this.resteasyClient == null) {
+            this.resteasyClient = createResteasyClient();
+        }
+        return this.resteasyClient;
+    }
+
+    protected ResteasyClient createResteasyClient() {
+        return new ResteasyClientBuilder()
+                .connectionCheckoutTimeout(1, TimeUnit.HOURS)
+                .connectionTTL(1, TimeUnit.HOURS)
+                .socketTimeout(1, TimeUnit.HOURS)
+                .disableTrustManager().build();
+    }
+
+
     public String getTokenString() throws VerificationException, IOException, ServerRequest.HttpFailure {
         return tokenString;
     }
@@ -208,20 +522,21 @@ public class KeycloakInstalled {
         parseAccessToken(tokenResponse);
     }
 
+    public void refreshToken(String refreshToken) throws IOException, ServerRequest.HttpFailure, VerificationException {
+        AccessTokenResponse tokenResponse = ServerRequest.invokeRefresh(deployment, refreshToken);
+        parseAccessToken(tokenResponse);
+
+    }
+
     private void parseAccessToken(AccessTokenResponse tokenResponse) throws VerificationException {
+        this.tokenResponse = tokenResponse;
         tokenString = tokenResponse.getToken();
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
 
-        token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
-        if (idTokenString != null) {
-            try {
-                JWSInput input = new JWSInput(idTokenString);
-                idToken = input.readJsonContent(IDToken.class);
-            } catch (JWSInputException e) {
-                throw new VerificationException();
-            }
-        }
+        AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, idTokenString, deployment);
+        token = tokens.getAccessToken();
+        idToken = tokens.getIdToken();
     }
 
     public AccessToken getToken() {
@@ -240,6 +555,10 @@ public class KeycloakInstalled {
         return refreshToken;
     }
 
+    public AccessTokenResponse getTokenResponse() {
+        return tokenResponse;
+    }
+
     public boolean isDesktopSupported() {
         return Desktop.isDesktopSupported();
     }
@@ -248,6 +567,7 @@ public class KeycloakInstalled {
         return deployment;
     }
 
+
     private void processCode(String code, String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, redirectUri, null);
         parseAccessToken(tokenResponse);
@@ -269,6 +589,7 @@ public class KeycloakInstalled {
         return sb.toString();
     }
 
+
     public class CallbackListener extends Thread {
 
         private ServerSocket server;
@@ -283,14 +604,19 @@ public class KeycloakInstalled {
 
         private String state;
 
-        public CallbackListener() throws IOException {
+        private Socket socket;
+
+        private HttpResponseWriter writer;
+
+        public CallbackListener(HttpResponseWriter writer) throws IOException {
+            this.writer = writer;
             server = new ServerSocket(0);
         }
 
         @Override
         public void run() {
             try {
-                Socket socket = server.accept();
+                socket = server.accept();
 
                 BufferedReader br = new BufferedReader(new InputStreamReader(socket.getInputStream()));
                 String request = br.readLine();
@@ -314,10 +640,30 @@ public class KeycloakInstalled {
                     }
                 }
 
-                PrintWriter pw = new PrintWriter(new OutputStreamWriter(socket.getOutputStream()));
-                pw.println("Please close window and return to application");
-                pw.flush();
+                OutputStreamWriter out = new OutputStreamWriter(socket.getOutputStream());
+                PrintWriter pw = new PrintWriter(out);
+                if (writer != null) {
+                    System.err.println("Using a writer is deprecated.  Please remove its usage.  This is now handled by endpoint on server");
+                }
 
+                if (error == null) {
+                     if (writer != null) {
+                         writer.success(pw, KeycloakInstalled.this);
+                     } else {
+                         pw.println("HTTP/1.1 302 Found");
+                         pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated"));
+
+                     }
+                } else {
+                    if (writer != null) {
+                        writer.failure(pw, KeycloakInstalled.this);
+                    } else {
+                        pw.println("HTTP/1.1 302 Found");
+                        pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated?error=true"));
+
+                    }
+                }
+                pw.flush();
                 socket.close();
             } catch (IOException e) {
                 errorException = e;
@@ -328,6 +674,8 @@ public class KeycloakInstalled {
             } catch (IOException e) {
             }
         }
+
     }
 
+
 }

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
+        <version>4.7.0.Final-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -33,7 +33,7 @@
     <dependencies>
         <dependency>
             <groupId>org.jboss.spec.javax.ws.rs</groupId>
-            <artifactId>jboss-jaxrs-api_2.0_spec</artifactId>
+            <artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -87,17 +87,5 @@
             <scope>provided</scope>
         </dependency>
     </dependencies>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-        </plugins>
-    </build>
 
 </project>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -27,6 +27,9 @@ import javax.security.cert.X509Certificate;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.SecurityContext;
+
+import java.io.BufferedInputStream;
+import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.List;
@@ -51,6 +54,8 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
     protected class RequestFacade implements OIDCHttpFacade.Request {
 
+        private InputStream inputStream;
+
         @Override
         public String getFirstParam(String param) {
             throw new RuntimeException("NOT IMPLEMENTED");
@@ -108,6 +113,19 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
         @Override
         public InputStream getInputStream() {
+            return getInputStream(false);
+        }
+
+        @Override
+        public InputStream getInputStream(boolean buffered) {
+            if (inputStream != null) {
+                return inputStream;
+            }
+
+            if (buffered) {
+                return inputStream = new BufferedInputStream(requestContext.getEntityStream());
+            }
+
             return requestContext.getEntityStream();
         }
 

adapters/oidc/jetty/jetty-core/pom.xml

@@ -14,21 +14,24 @@
   ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
-  -->
+-->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
 
-	<artifactId>keycloak-jetty-core</artifactId>
-	<name>Keycloak Jetty Core Integration</name>
+    <artifactId>keycloak-jetty-core</artifactId>
+    <name>Keycloak Jetty Core Integration</name>
     <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
         <jetty9.version>8.1.17.v20150415</jetty9.version>
         <keycloak.osgi.export>
             org.keycloak.adapters.jetty.core.*
@@ -40,18 +43,17 @@
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>
-	<description />
+    <description />
 
-	<dependencies>
+    <dependencies>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
         </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-adapter-spi</artifactId>
@@ -61,29 +63,29 @@
             <artifactId>keycloak-jetty-adapter-spi</artifactId>
         </dependency>
         <dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-adapter-core</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-adapter-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-		</dependency>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
@@ -105,23 +107,14 @@
             <scope>provided</scope>
         </dependency>
 
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>
@@ -154,7 +147,7 @@
                     </instructions>
                 </configuration>
             </plugin>
-		</plugins>
-	</build>
+        </plugins>
+    </build>
 
 </project>

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/AbstractKeycloakJettyAuthenticator.java

@@ -106,6 +106,8 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
 
     public abstract AdapterTokenStore createSessionTokenStore(Request request, KeycloakDeployment resolvedDeployment);
 
+    public abstract JettyUserSessionManagement createSessionManagement(Request request);
+
     public void logoutCurrent(Request request) {
         AdapterDeploymentContext deploymentContext = (AdapterDeploymentContext) request.getAttribute(AdapterDeploymentContext.class.getName());
         KeycloakSecurityContext ksc = (KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
@@ -287,7 +289,7 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
             log.debug("*** deployment isn't configured return false");
             return Authentication.UNAUTHENTICATED;
         }
-        PreAuthActionsHandler handler = new PreAuthActionsHandler(new JettyUserSessionManagement(request.getSessionManager()), deploymentContext, facade);
+        PreAuthActionsHandler handler = new PreAuthActionsHandler(createSessionManagement(request), deploymentContext, facade);
         if (handler.handleRequest()) {
             return Authentication.SEND_SUCCESS;
         }

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/JettyCookieTokenStore.java

@@ -85,7 +85,7 @@ public class JettyCookieTokenStore implements AdapterTokenStore {
 
     @Override
     public void logout() {
-        CookieTokenStore.removeCookie(facade);
+        CookieTokenStore.removeCookie(deployment, facade);
 
     }
 
@@ -113,7 +113,7 @@ public class JettyCookieTokenStore implements AdapterTokenStore {
         if (success && session.isActive()) return principal;
 
         log.debugf("Cleanup and expire cookie for user %s after failed refresh", principal.getName());
-        CookieTokenStore.removeCookie(facade);
+        CookieTokenStore.removeCookie(deployment, facade);
         return null;
     }
 

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -14,21 +14,24 @@
   ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
-  -->
+-->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
 
-	<artifactId>keycloak-jetty81-adapter</artifactId>
-	<name>Keycloak Jetty 8.1.x Integration</name>
+    <artifactId>keycloak-jetty81-adapter</artifactId>
+    <name>Keycloak Jetty 8.1.x Integration</name>
     <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
         <jetty9.version>8.1.17.v20150415</jetty9.version>
         <keycloak.osgi.export>
             org.keycloak.adapters.jetty.*
@@ -39,18 +42,17 @@
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>
-	<description />
+    <description />
 
-	<dependencies>
+    <dependencies>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
         </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-adapter-core</artifactId>
@@ -63,26 +65,26 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-jetty-core</artifactId>
         </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-		</dependency>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
@@ -104,23 +106,14 @@
             <scope>provided</scope>
         </dependency>
 
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>
@@ -153,7 +146,7 @@
                     </instructions>
                 </configuration>
             </plugin>
-		</plugins>
-	</build>
+        </plugins>
+    </build>
 
 </project>

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/Jetty81SessionManager.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.jetty;
+
+import org.eclipse.jetty.server.SessionManager;
+import org.keycloak.adapters.jetty.spi.JettySessionManager;
+
+import javax.servlet.http.HttpSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Jetty81SessionManager implements JettySessionManager {
+    protected SessionManager sessionManager;
+
+    public Jetty81SessionManager(SessionManager sessionManager) {
+        this.sessionManager = sessionManager;
+    }
+
+    @Override
+    public HttpSession getHttpSession(String id) {
+        return sessionManager.getHttpSession(id);
+    }
+}

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -25,6 +25,7 @@ import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
+import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -44,6 +45,11 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
+    @Override
+    public JettyUserSessionManagement createSessionManagement(Request request) {
+        return new JettyUserSessionManagement(new Jetty81SessionManager(request.getSessionManager()));
+    }
+
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request)?(Request)req: AbstractHttpConnection.getCurrentConnection().getRequest();

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -14,20 +14,20 @@
   ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
-  -->
+-->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
 
-	<artifactId>keycloak-jetty91-adapter</artifactId>
-	<name>Keycloak Jetty 9.1.x Integration</name>
+    <artifactId>keycloak-jetty91-adapter</artifactId>
+    <name>Keycloak Jetty 9.1.x Integration</name>
     <properties>
         <jetty9.version>9.1.5.v20140505</jetty9.version>
         <keycloak.osgi.export>
@@ -40,18 +40,17 @@
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>
-	<description />
+    <description />
 
-	<dependencies>
+    <dependencies>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
         </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-adapter-core</artifactId>
@@ -67,33 +66,33 @@
                 <exclusion>
                     <groupId>org.eclipse.jetty</groupId>
                     <artifactId>jetty-util</artifactId>
-               </exclusion>
+                </exclusion>
                 <exclusion>
                     <groupId>org.eclipse.jetty</groupId>
                     <artifactId>jetty-security</artifactId>
                 </exclusion>
             </exclusions>
         </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-		</dependency>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
@@ -115,22 +114,22 @@
             <scope>provided</scope>
         </dependency>
 
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>1.6</source>
+                    <target>1.6</target>
+                </configuration>
+            </plugin>
 
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
@@ -164,7 +163,7 @@
                     </instructions>
                 </configuration>
             </plugin>
-		</plugins>
-	</build>
+        </plugins>
+    </build>
 
 </project>

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/Jetty91SessionManager.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.jetty;
+
+import org.eclipse.jetty.server.SessionManager;
+import org.keycloak.adapters.jetty.spi.JettySessionManager;
+
+import javax.servlet.http.HttpSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Jetty91SessionManager implements JettySessionManager {
+    protected SessionManager sessionManager;
+
+    public Jetty91SessionManager(SessionManager sessionManager) {
+        this.sessionManager = sessionManager;
+    }
+
+    @Override
+    public HttpSession getHttpSession(String id) {
+        return sessionManager.getHttpSession(id);
+    }
+}

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,6 +27,7 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
+import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -46,6 +47,11 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
+    @Override
+    public JettyUserSessionManagement createSessionManagement(Request request) {
+        return new JettyUserSessionManagement(new Jetty91SessionManager(request.getSessionManager()));
+    }
+
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request) ? (Request)req : HttpChannel.getCurrentHttpChannel().getRequest();

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -14,21 +14,24 @@
   ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
-  -->
+-->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
 
-	<artifactId>keycloak-jetty92-adapter</artifactId>
-	<name>Keycloak Jetty 9.2.x Integration</name>
+    <artifactId>keycloak-jetty92-adapter</artifactId>
+    <name>Keycloak Jetty 9.2.x Integration</name>
     <properties>
+        <maven.compiler.target>1.7</maven.compiler.target>
+        <maven.compiler.source>1.7</maven.compiler.source>
+
         <jetty9.version>9.2.4.v20141103</jetty9.version>
         <keycloak.osgi.export>
             org.keycloak.adapters.jetty.*
@@ -40,18 +43,17 @@
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>
-	<description />
+    <description />
 
-	<dependencies>
+    <dependencies>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
         </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-adapter-core</artifactId>
@@ -60,26 +62,26 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-jetty-core</artifactId>
         </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-		</dependency>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
@@ -101,23 +103,14 @@
             <scope>provided</scope>
         </dependency>
 
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>
@@ -150,7 +143,7 @@
                     </instructions>
                 </configuration>
             </plugin>
-		</plugins>
-	</build>
+        </plugins>
+    </build>
 
 </project>

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/Jetty92SessionManager.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.jetty;
+
+import org.eclipse.jetty.server.SessionManager;
+import org.keycloak.adapters.jetty.spi.JettySessionManager;
+
+import javax.servlet.http.HttpSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Jetty92SessionManager implements JettySessionManager {
+    protected SessionManager sessionManager;
+
+    public Jetty92SessionManager(SessionManager sessionManager) {
+        this.sessionManager = sessionManager;
+    }
+
+    @Override
+    public HttpSession getHttpSession(String id) {
+        return sessionManager.getHttpSession(id);
+    }
+}

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,6 +27,7 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
+import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -61,6 +62,11 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
+    @Override
+    public JettyUserSessionManagement createSessionManagement(Request request) {
+        return new JettyUserSessionManagement(new Jetty92SessionManager(request.getSessionManager()));
+    }
+
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -14,20 +14,20 @@
   ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
-  -->
+-->
 
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>2.5.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
 
-	<artifactId>keycloak-jetty93-adapter</artifactId>
-	<name>Keycloak Jetty 9.3.x Integration</name>
+    <artifactId>keycloak-jetty93-adapter</artifactId>
+    <name>Keycloak Jetty 9.3.x Integration</name>
     <properties>
         <jetty9.version>9.3.9.v20160517</jetty9.version>
         <keycloak.osgi.export>
@@ -40,18 +40,17 @@
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>
-	<description />
+    <description />
 
-	<dependencies>
+    <dependencies>
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
         </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-adapter-core</artifactId>
@@ -60,26 +59,26 @@
             <groupId>org.keycloak</groupId>
             <artifactId>keycloak-jetty-core</artifactId>
         </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
+        </dependency>
+        <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-		</dependency>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
@@ -101,23 +100,14 @@
             <scope>provided</scope>
         </dependency>
 
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
             <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>
@@ -150,7 +140,7 @@
                     </instructions>
                 </configuration>
             </plugin>
-		</plugins>
-	</build>
+        </plugins>
+    </build>
 
 </project>

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/Jetty93SessionManager.java

@@ -0,0 +1,40 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.jetty;
+
+import org.eclipse.jetty.server.SessionManager;
+import org.keycloak.adapters.jetty.spi.JettySessionManager;
+
+import javax.servlet.http.HttpSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class Jetty93SessionManager implements JettySessionManager {
+    protected SessionManager sessionManager;
+
+    public Jetty93SessionManager(SessionManager sessionManager) {
+        this.sessionManager = sessionManager;
+    }
+
+    @Override
+    public HttpSession getHttpSession(String id) {
+        return sessionManager.getHttpSession(id);
+    }
+}

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -26,6 +26,7 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
+import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -60,6 +61,11 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
+    @Override
+    public JettyUserSessionManagement createSessionManagement(Request request) {
+        return new JettyUserSessionManagement(new Jetty93SessionManager(request.getSessionManager()));
+    }
+
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -0,0 +1,146 @@
+<?xml version="1.0"?>
+<!--
+  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
+  ~ and other contributors as indicated by the @author tags.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~ http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+-->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>4.7.0.Final-SNAPSHOT</version>
+        <relativePath>../../../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-jetty94-adapter</artifactId>
+    <name>Keycloak Jetty 9.4.x Integration</name>
+    <properties>
+        <jetty9.version>9.4.2.v20170220</jetty9.version>
+        <keycloak.osgi.export>
+            org.keycloak.adapters.jetty.*
+        </keycloak.osgi.export>
+        <keycloak.osgi.import>
+            org.eclipse.jetty.*;resolution:=optional,
+            javax.servlet.*;version="[3.0,4)";resolution:=optional,
+            org.keycloak.*;version="${project.version}",
+            *;resolution:=optional
+        </keycloak.osgi.import>
+    </properties>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-adapter-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-jetty-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpclient</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk15on</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-server</artifactId>
+            <version>${jetty9.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-util</artifactId>
+            <version>${jetty9.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-security</artifactId>
+            <version>${jetty9.version}</version>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
+            <plugin>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <executions>
+                    <execution>
+                        <id>bundle-manifest</id>
+                        <phase>process-classes</phase>
+                        <goals>
+                            <goal>manifest</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <instructions>
+                        <Bundle-ClassPath>.</Bundle-ClassPath>
+                        <Bundle-Name>${project.name}</Bundle-Name>
+                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
+                        <Import-Package>${keycloak.osgi.import}</Import-Package>
+                        <Export-Package>${keycloak.osgi.export}</Export-Package>
+                    </instructions>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>