Set version to 2.3.0.Final

KEYCLOAK-3789 KcRegTests are failing on CI

.gitignore

@@ -14,7 +14,6 @@
 nbactions.xml
 nb-configuration.xml
 catalog.xml
-nbproject
 
 # Compiled source #
 ###################

.travis.yml

@@ -11,12 +11,6 @@ env:
   global:
     - MAVEN_SKIP_RC=true
     - MAVEN_OPTS="-Xms512m -Xmx2048m"
-  matrix:
-    - TESTS=group1
-    - TESTS=group2
-    - TESTS=group3
-    - TESTS=group4
-    - TESTS=old
 
 jdk:
   - oraclejdk8
@@ -25,9 +19,9 @@ before_script:
   - export MAVEN_SKIP_RC=true
 
 install: 
-  - travis_wait 60 mvn install --no-snapshot-updates -Pdistribution -DskipTests=true -B -V -q
+  - travis_wait 60 mvn install -Pdistribution -DskipTests=true -B -V -q
 
 script:
-  - ./travis-run-tests.sh $TESTS
+  - mvn test -B
 
 sudo: false

README.md

@@ -9,7 +9,7 @@ For more information about Keycloak visit [Keycloak homepage](http://keycloak.or
 Building
 --------
 
-Ensure you have JDK 8 (or newer), Maven 3.1.1 (or newer) and Git installed
+Ensure you have JDK 8 (or newer), Maven 3.2.1 (or newer) and Git installed
 
     java -version
     mvn -version

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -342,12 +342,6 @@ public class AdapterDeploymentContext {
             return delegate.getNotBefore();
         }
 
-        @Override
-        public void updateNotBefore(int notBefore) {
-            delegate.setNotBefore(notBefore);
-            getPublicKeyLocator().reset(this);
-        }
-
         @Override
         public void setExposeToken(boolean exposeToken) {
             delegate.setExposeToken(exposeToken);
@@ -452,16 +446,6 @@ public class AdapterDeploymentContext {
         public int getMinTimeBetweenJwksRequests() {
             return delegate.getMinTimeBetweenJwksRequests();
         }
-
-        @Override
-        public int getPublicKeyCacheTtl() {
-            return delegate.getPublicKeyCacheTtl();
-        }
-
-        @Override
-        public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-            delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
-        }
     }
 
     protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -142,13 +142,9 @@ public class AuthenticatedActionsHandler {
             AuthorizationContext authorizationContext = policyEnforcer.enforce(facade);
             RefreshableKeycloakSecurityContext session = (RefreshableKeycloakSecurityContext) facade.getSecurityContext();
 
-            if (session != null) {
-                session.setAuthorizationContext(authorizationContext);
+            session.setAuthorizationContext(authorizationContext);
 
-                return authorizationContext.isGranted();
-            }
-
-            return true;
+            return  authorizationContext.isGranted();
         } catch (Exception e) {
             throw new RuntimeException("Failed to enforce policy decisions.", e);
         }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpAdapterUtils.java

@@ -46,7 +46,14 @@ public class HttpAdapterUtils {
             }
             InputStream is = entity.getContent();
             try {
-                return JsonSerialization.readValue(is, clazz);
+                ByteArrayOutputStream os = new ByteArrayOutputStream();
+                int c;
+                while ((c = is.read()) != -1) {
+                    os.write(c);
+                }
+                byte[] bytes = os.toByteArray();
+                String json = new String(bytes);
+                return JsonSerialization.readValue(json, clazz);
             } finally {
                 try {
                     is.close();

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpClientBuilder.java

@@ -38,7 +38,7 @@ import org.apache.http.params.BasicHttpParams;
 import org.apache.http.params.HttpConnectionParams;
 import org.keycloak.common.util.EnvUtil;
 import org.keycloak.common.util.KeystoreUtil;
-import org.keycloak.representations.adapters.config.AdapterHttpClientConfig;
+import org.keycloak.representations.adapters.config.AdapterConfig;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
@@ -333,7 +333,7 @@ public class HttpClientBuilder {
         }
     }
 
-    public HttpClient build(AdapterHttpClientConfig adapterConfig) {
+    public HttpClient build(AdapterConfig adapterConfig) {
         disableCookieCache(); // disable cookie cache as we don't want sticky sessions for load balancing
 
         String truststorePath = adapterConfig.getTruststore();
@@ -379,13 +379,13 @@ public class HttpClientBuilder {
     /**
      * Configures a the proxy to use for auth-server requests if provided.
      * <p>
-     * If the given {@link AdapterHttpClientConfig} contains the attribute {@code proxy-url} we use the
+     * If the given {@link AdapterConfig} contains the attribute {@code proxy-url} we use the
      * given URL as a proxy server, otherwise the proxy configuration is ignored.
      * </p>
      *
      * @param adapterConfig
      */
-    private void configureProxyForAuthServerIfProvided(AdapterHttpClientConfig adapterConfig) {
+    private void configureProxyForAuthServerIfProvided(AdapterConfig adapterConfig) {
 
         if (adapterConfig == null || adapterConfig.getProxyUrl() == null || adapterConfig.getProxyUrl().trim().isEmpty()) {
             return;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java

@@ -57,7 +57,6 @@ public class KeycloakDeployment {
 
     protected String resourceName;
     protected boolean bearerOnly;
-    protected boolean autodetectBearerOnly;
     protected boolean enableBasicAuth;
     protected boolean publicClient;
     protected Map<String, Object> resourceCredentials = new HashMap<>();
@@ -82,12 +81,8 @@ public class KeycloakDeployment {
     protected volatile int notBefore;
     protected int tokenMinimumTimeToLive;
     protected int minTimeBetweenJwksRequests;
-    protected int publicKeyCacheTtl;
     private PolicyEnforcer policyEnforcer;
 
-    // https://tools.ietf.org/html/rfc7636
-    protected boolean pkce = false;
-
     public KeycloakDeployment() {
     }
 
@@ -205,14 +200,6 @@ public class KeycloakDeployment {
         this.bearerOnly = bearerOnly;
     }
 
-    public boolean isAutodetectBearerOnly() {
-        return autodetectBearerOnly;
-    }
-
-    public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
-        this.autodetectBearerOnly = autodetectBearerOnly;
-    }
-
     public boolean isEnableBasicAuth() {
         return enableBasicAuth;
     }
@@ -341,11 +328,6 @@ public class KeycloakDeployment {
         this.notBefore = notBefore;
     }
 
-    public void updateNotBefore(int notBefore) {
-        this.notBefore = notBefore;
-        getPublicKeyLocator().reset(this);
-    }
-
     public boolean isAlwaysRefreshToken() {
         return alwaysRefreshToken;
     }
@@ -402,14 +384,6 @@ public class KeycloakDeployment {
         this.minTimeBetweenJwksRequests = minTimeBetweenJwksRequests;
     }
 
-    public int getPublicKeyCacheTtl() {
-        return publicKeyCacheTtl;
-    }
-
-    public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-        this.publicKeyCacheTtl = publicKeyCacheTtl;
-    }
-
     public void setPolicyEnforcer(PolicyEnforcer policyEnforcer) {
         this.policyEnforcer = policyEnforcer;
     }
@@ -417,14 +391,4 @@ public class KeycloakDeployment {
     public PolicyEnforcer getPolicyEnforcer() {
         return policyEnforcer;
     }
-
-    // https://tools.ietf.org/html/rfc7636
-    public boolean isPkce() {
-        return pkce;
-    }
-
-    public void setPkce(boolean pkce) {
-        this.pkce = pkce;
-    }
-
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java

@@ -98,20 +98,13 @@ public class KeycloakDeploymentBuilder {
             deployment.setCorsAllowedMethods(adapterConfig.getCorsAllowedMethods());
         }
 
-        // https://tools.ietf.org/html/rfc7636
-        if (adapterConfig.isPkce()) {
-            deployment.setPkce(true);
-        }
-
         deployment.setBearerOnly(adapterConfig.isBearerOnly());
-        deployment.setAutodetectBearerOnly(adapterConfig.isAutodetectBearerOnly());
         deployment.setEnableBasicAuth(adapterConfig.isEnableBasicAuth());
         deployment.setAlwaysRefreshToken(adapterConfig.isAlwaysRefreshToken());
         deployment.setRegisterNodeAtStartup(adapterConfig.isRegisterNodeAtStartup());
         deployment.setRegisterNodePeriod(adapterConfig.getRegisterNodePeriod());
         deployment.setTokenMinimumTimeToLive(adapterConfig.getTokenMinimumTimeToLive());
         deployment.setMinTimeBetweenJwksRequests(adapterConfig.getMinTimeBetweenJwksRequests());
-        deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());
 
         if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
             throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -25,7 +25,6 @@ import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.Encode;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.common.util.UriUtils;
 import org.keycloak.constants.AdapterConstants;
@@ -170,7 +169,7 @@ public class OAuthRequestAuthenticator {
         KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, Encode.encodeQueryParamAsIs(url)) // Need to encode uri ourselves as queryParam() will not encode % characters.
+                .queryParam(OAuth2Constants.REDIRECT_URI, url)
                 .queryParam(OAuth2Constants.STATE, state)
                 .queryParam("login", "true");
         if(loginHint != null && loginHint.length() > 0){
@@ -196,13 +195,15 @@ public class OAuthRequestAuthenticator {
         return sslRedirectPort;
     }
 
+    protected static final AtomicLong counter = new AtomicLong();
+
     protected String getStateCode() {
-        return AdapterUtils.generateId();
+        return counter.getAndIncrement() + "/" + AdapterUtils.generateId();
     }
 
     protected AuthChallenge loginRedirect() {
         final String state = getStateCode();
-        final String redirect =  getRedirectUri(state);
+        final String redirect = getRedirectUri(state);
         if (redirect == null) {
             return challenge(403, OIDCAuthenticationError.Reason.NO_REDIRECT_URI, null);
         }
@@ -356,7 +357,7 @@ public class OAuthRequestAuthenticator {
             return challenge(403, OIDCAuthenticationError.Reason.INVALID_TOKEN, null);
         }
         if (tokenResponse.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(tokenResponse.getNotBeforePolicy());
+            deployment.setNotBefore(tokenResponse.getNotBeforePolicy());
         }
         if (token.getIssuedAt() < deployment.getNotBefore()) {
             log.error("Stale token");

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/PreAuthActionsHandler.java

@@ -155,7 +155,7 @@ public class PreAuthActionsHandler {
             } else {
                 log.debugf("logout of all sessions for application '%s'", action.getResource());
                 if (action.getNotBefore() > deployment.getNotBefore()) {
-                    deployment.updateNotBefore(action.getNotBefore());
+                    deployment.setNotBefore(action.getNotBefore());
                 }
                 userSessionManagement.logoutAll();
             }
@@ -177,7 +177,7 @@ public class PreAuthActionsHandler {
             }
             PushNotBeforeAction action = JsonSerialization.readValue(token.getContent(), PushNotBeforeAction.class);
             if (!validateAction(action)) return;
-            deployment.updateNotBefore(action.getNotBefore());
+            deployment.setNotBefore(action.getNotBefore());
         } catch (Exception e) {
             throw new RuntimeException(e);
         }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RefreshableKeycloakSecurityContext.java

@@ -144,7 +144,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
         }
 
         if (response.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(response.getNotBeforePolicy());
+            deployment.setNotBefore(response.getNotBeforePolicy());
         }
 
         this.token = token;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RequestAuthenticator.java

@@ -17,14 +17,11 @@
 
 package org.keycloak.adapters;
 
-import java.util.Collections;
-import java.util.List;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.common.enums.SslRequired;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -119,12 +116,6 @@ public abstract class RequestAuthenticator {
             return AuthOutcome.NOT_ATTEMPTED;
         }
 
-        if (isAutodetectedBearerOnly(facade.getRequest())) {
-            challenge = bearer.getChallenge();
-            log.debug("NOT_ATTEMPTED: Treating as bearer only");
-            return AuthOutcome.NOT_ATTEMPTED;
-        }
-
         if (log.isTraceEnabled()) {
             log.trace("try oauth");
         }
@@ -161,43 +152,12 @@ public abstract class RequestAuthenticator {
 
     protected boolean verifySSL() {
         if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
-            log.warnf("SSL is required to authenticate. Remote address %s is secure: %s, SSL required for: %s .",
-                    facade.getRequest().getRemoteAddr(), facade.getRequest().isSecure(), deployment.getSslRequired().name());
+            log.warn("SSL is required to authenticate");
             return true;
         }
         return false;
     }
 
-    protected boolean isAutodetectedBearerOnly(HttpFacade.Request request) {
-        if (!deployment.isAutodetectBearerOnly()) return false;
-
-        String headerValue = facade.getRequest().getHeader("X-Requested-With");
-        if (headerValue != null && headerValue.equalsIgnoreCase("XMLHttpRequest")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("Faces-Request");
-        if (headerValue != null && headerValue.startsWith("partial/")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("SOAPAction");
-        if (headerValue != null) {
-            return true;
-        }
-
-        List<String> accepts = facade.getRequest().getHeaders("Accept");
-        if (accepts == null) accepts = Collections.emptyList();
-
-        for (String accept : accepts) {
-            if (accept.contains("text/html") || accept.contains("text/*") || accept.contains("*/*")) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
     protected abstract OAuthRequestAuthenticator createOAuthAuthenticator();
 
     protected BearerTokenRequestAuthenticator createBearerTokenAuthenticator() {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/ServerRequest.java

@@ -33,8 +33,6 @@ import org.keycloak.constants.AdapterConstants;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
 
-import org.jboss.logging.Logger;
-
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -48,8 +46,6 @@ import java.util.List;
  */
 public class ServerRequest {
 
-	private static Logger logger = Logger.getLogger(ServerRequest.class);
-
     public static class HttpFailure extends Exception {
         private int status;
         private String error;
@@ -140,62 +136,6 @@ public class ServerRequest {
         }
     }
 
-    // https://tools.ietf.org/html/rfc7636#section-4
-    public static AccessTokenResponse invokeAccessCodeToToken(KeycloakDeployment deployment, String code, String redirectUri, String sessionId, String codeVerifier) throws IOException, HttpFailure {
-        List<NameValuePair> formparams = new ArrayList<>();
-        redirectUri = stripOauthParametersFromRedirect(redirectUri);
-        formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, "authorization_code"));
-        formparams.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
-        formparams.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, redirectUri));
-        if (sessionId != null) {
-            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, sessionId));
-            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, HostUtils.getHostName()));
-        }
-        // https://tools.ietf.org/html/rfc7636#section-4
-        if (codeVerifier != null) {
-            logger.debugf("add to POST parameters of Token Request, codeVerifier = %s", codeVerifier);
-            formparams.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
-        } else {
-            logger.debug("add to POST parameters of Token Request without codeVerifier");
-        }
-
-        HttpPost post = new HttpPost(deployment.getTokenUrl());
-        ClientCredentialsProviderUtils.setClientCredentials(deployment, post, formparams);
-
-        UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
-        post.setEntity(form);
-        HttpResponse response = deployment.getClient().execute(post);
-        int status = response.getStatusLine().getStatusCode();
-        HttpEntity entity = response.getEntity();
-        if (status != 200) {
-            error(status, entity);
-        }
-        if (entity == null) {
-            throw new HttpFailure(status, null);
-        }
-        InputStream is = entity.getContent();
-        try {
-            ByteArrayOutputStream os = new ByteArrayOutputStream();
-            int c;
-            while ((c = is.read()) != -1) {
-                os.write(c);
-            }
-            byte[] bytes = os.toByteArray();
-            String json = new String(bytes);
-            try {
-                return JsonSerialization.readValue(json, AccessTokenResponse.class);
-            } catch (IOException e) {
-                throw new IOException(json, e);
-            }
-        } finally {
-            try {
-                is.close();
-            } catch (IOException ignored) {
-
-            }
-        }
-    }
-
     public static AccessTokenResponse invokeRefresh(KeycloakDeployment deployment, String refreshToken) throws IOException, HttpFailure {
         List<NameValuePair> formparams = new ArrayList<NameValuePair>();
         formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -17,25 +17,27 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
-import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.OIDCHttpFacade;
 import org.keycloak.adapters.spi.HttpFacade.Request;
+import org.keycloak.adapters.spi.HttpFacade.Response;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.ClientAuthorizationContext;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.resource.ProtectedResource;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
 
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -45,7 +47,7 @@ public abstract class AbstractPolicyEnforcer {
     private final PolicyEnforcerConfig enforcerConfig;
     private final PolicyEnforcer policyEnforcer;
 
-    private Map<String, PathConfig> paths;
+    private List<PathConfig> paths;
     private AuthzClient authzClient;
     private PathMatcher pathMatcher;
 
@@ -53,8 +55,8 @@ public abstract class AbstractPolicyEnforcer {
         this.policyEnforcer = policyEnforcer;
         this.enforcerConfig = policyEnforcer.getEnforcerConfig();
         this.authzClient = policyEnforcer.getClient();
-        this.pathMatcher = policyEnforcer.getPathMatcher();
-        this.paths = policyEnforcer.getPaths();
+        this.pathMatcher = new PathMatcher();
+        this.paths = new ArrayList<>(policyEnforcer.getPaths());
     }
 
     public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
@@ -64,55 +66,40 @@ public abstract class AbstractPolicyEnforcer {
             return createEmptyAuthorizationContext(true);
         }
 
-        KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
+        AccessToken accessToken = httpFacade.getSecurityContext().getToken();
+        Request request = httpFacade.getRequest();
+        Response response = httpFacade.getResponse();
+        String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+        String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+        PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
 
-        if (securityContext != null) {
-            AccessToken accessToken = securityContext.getToken();
+        LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
 
-            if (accessToken != null) {
-                Request request = httpFacade.getRequest();
-                String path = getPath(request);
-                PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
-
-                LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
-
-                if (pathConfig == null) {
-                    if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
-                        return createAuthorizationContext(accessToken);
-                    }
-
-                    LOGGER.debugf("Could not find a configuration for path [%s]", path);
-
-                    if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
-                        return createAuthorizationContext(accessToken);
-                    }
-
-                    handleAccessDenied(httpFacade);
-
-                    return createEmptyAuthorizationContext(false);
-                }
-
-                if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                    return createEmptyAuthorizationContext(true);
-                }
-
-                Set<String> requiredScopes = getRequiredScopes(pathConfig, request);
-
-                if (isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
-                    try {
-                        return createAuthorizationContext(accessToken);
-                    } catch (Exception e) {
-                        throw new RuntimeException("Error processing path [" + pathConfig.getPath() + "].", e);
-                    }
-                }
-
-                LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
-
-                if (!challenge(pathConfig, requiredScopes, httpFacade)) {
-                    LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
-                    handleAccessDenied(httpFacade);
-                }
+        if (pathConfig == null) {
+            if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
+                return createAuthorizationContext(accessToken);
             }
+
+            LOGGER.debugf("Could not find a configuration for path [%s]", path);
+            response.sendError(403, "Could not find a configuration for path [" + path + "].");
+
+            return createEmptyAuthorizationContext(false);
+        }
+
+        PathConfig actualPathConfig = resolvePathConfig(pathConfig, request);
+        Set<String> requiredScopes = getRequiredScopes(actualPathConfig, request);
+
+        if (isAuthorized(actualPathConfig, requiredScopes, accessToken, httpFacade)) {
+            try {
+                return createAuthorizationContext(accessToken);
+            } catch (Exception e) {
+                throw new RuntimeException("Error processing path [" + actualPathConfig.getPath() + "].", e);
+            }
+        }
+
+        if (!challenge(actualPathConfig, requiredScopes, httpFacade)) {
+            LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
+            response.sendError(403, "Authorization failed.");
         }
 
         return createEmptyAuthorizationContext(false);
@@ -123,9 +110,12 @@ public abstract class AbstractPolicyEnforcer {
     protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         Request request = httpFacade.getRequest();
         PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
+        String accessDeniedPath = enforcerConfig.getAccessDeniedPath();
 
-        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
-            return true;
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
         }
 
         AccessToken.Authorization authorization = accessToken.getAuthorization();
@@ -135,17 +125,14 @@ public abstract class AbstractPolicyEnforcer {
         }
 
         List<Permission> permissions = authorization.getPermissions();
-        boolean hasPermission = false;
 
         for (Permission permission : permissions) {
             if (permission.getResourceSetId() != null) {
                 if (isResourcePermission(actualPathConfig, permission)) {
-                    hasPermission = true;
-
                     if (actualPathConfig.isInstance() && !matchResourcePermission(actualPathConfig, permission)) {
                         continue;
-                    }
 
+                    }
                     if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
                         LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, permissions);
                         if (request.getMethod().equalsIgnoreCase("DELETE") && actualPathConfig.isInstance()) {
@@ -156,36 +143,16 @@ public abstract class AbstractPolicyEnforcer {
                 }
             } else {
                 if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
-                    hasPermission = true;
                     return true;
                 }
             }
         }
 
-        if (!hasPermission && EnforcementMode.PERMISSIVE.equals(actualPathConfig.getEnforcementMode())) {
-            return true;
-        }
-
         LOGGER.debugf("Authorization FAILED for path [%s]. No enough permissions [%s].", actualPathConfig, permissions);
 
         return false;
     }
 
-    protected void handleAccessDenied(OIDCHttpFacade httpFacade) {
-        httpFacade.getResponse().sendError(403);
-    }
-
-    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
-        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
-
-        if (accessDeniedPath != null) {
-            if (request.getURI().contains(accessDeniedPath)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
     private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
         Set<String> allowedScopes = permission.getScopes();
         return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
@@ -204,7 +171,7 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private AuthorizationContext createEmptyAuthorizationContext(final boolean granted) {
-        return new ClientAuthorizationContext(authzClient) {
+        return new AuthorizationContext() {
             @Override
             public boolean hasPermission(String resourceName, String scopeName) {
                 return granted;
@@ -232,8 +199,33 @@ public abstract class AbstractPolicyEnforcer {
         };
     }
 
-    private String getPath(Request request) {
-        return request.getRelativePath();
+    private PathConfig resolvePathConfig(PathConfig originalConfig, Request request) {
+        if (originalConfig.hasPattern()) {
+            String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+            String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+            ProtectedResource resource = this.authzClient.protection().resource();
+            Set<String> search = resource.findByFilter("uri=" + path);
+
+            if (!search.isEmpty()) {
+                // resource does exist on the server, cache it
+                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
+                PathConfig config = new PathConfig();
+
+                config.setId(targetResource.getId());
+                config.setName(targetResource.getName());
+                config.setType(targetResource.getType());
+                config.setPath(targetResource.getUri());
+                config.setScopes(originalConfig.getScopes());
+                config.setMethods(originalConfig.getMethods());
+                config.setParentConfig(originalConfig);
+
+                this.paths.add(config);
+
+                return config;
+            }
+        }
+
+        return originalConfig;
     }
 
     private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
@@ -253,7 +245,7 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private AuthorizationContext createAuthorizationContext(AccessToken accessToken) {
-        return new ClientAuthorizationContext(accessToken, this.paths, authzClient);
+        return new AuthorizationContext(accessToken, this.paths);
     }
 
     private boolean isResourcePermission(PathConfig actualPathConfig, Permission permission) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/BearerTokenPolicyEnforcer.java

@@ -41,7 +41,7 @@ public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
 
     @Override
     protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
-        if (getEnforcerConfig().getUserManagedAccess() != null) {
+        if (getEnforcerConfig().getUmaProtocolConfig() != null) {
             challengeUmaAuthentication(pathConfig, requiredScopes, facade);
         } else {
             challengeEntitlementAuthentication(facade);
@@ -56,9 +56,6 @@ public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
         String  authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/entitlement";
         response.setStatus(401);
         response.setHeader("WWW-Authenticate", "KC_ETT realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\"");
-        if (LOGGER.isDebugEnabled()) {
-            LOGGER.debug("Sending Entitlement challenge");
-        }
     }
 
     private void challengeUmaAuthentication(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
@@ -69,9 +66,6 @@ public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
         String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/authorize";
         response.setStatus(401);
         response.setHeader("WWW-Authenticate", "UMA realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\",ticket=\"" + ticket + "\"");
-        if (LOGGER.isDebugEnabled()) {
-            LOGGER.debug("Sending UMA challenge");
-        }
     }
 
     private String getPermissionTicket(PathConfig pathConfig, Set<String> requiredScopes, AuthzClient authzClient) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -17,10 +17,6 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Set;
-
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
@@ -38,6 +34,10 @@ import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
 
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -51,45 +51,44 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
 
     @Override
     protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+        int retry = 2;
         AccessToken original = accessToken;
 
-        if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
-            return true;
+        while (retry > 0) {
+            if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+                return true;
+            }
+
+            accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
+
+            if (accessToken == null) {
+                return false;
+            }
+
+            AccessToken.Authorization authorization = original.getAuthorization();
+
+            if (authorization == null) {
+                authorization = new AccessToken.Authorization();
+                authorization.setPermissions(new ArrayList<Permission>());
+            }
+
+            AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
+
+            if (newAuthorization != null) {
+                authorization.getPermissions().addAll(newAuthorization.getPermissions());
+            }
+
+            original.setAuthorization(authorization);
+
+            retry--;
         }
 
-        accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
-
-        if (accessToken == null) {
-            return false;
-        }
-
-        AccessToken.Authorization authorization = original.getAuthorization();
-
-        if (authorization == null) {
-            authorization = new AccessToken.Authorization();
-            authorization.setPermissions(new ArrayList<Permission>());
-        }
-
-        AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
-
-        if (newAuthorization != null) {
-            authorization.getPermissions().addAll(newAuthorization.getPermissions());
-        }
-
-        original.setAuthorization(authorization);
-
-        return super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade);
+        return false;
     }
 
     @Override
     protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
-        handleAccessDenied(facade);
-        return true;
-    }
-
-    @Override
-    protected void handleAccessDenied(OIDCHttpFacade facade) {
-        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
+        String accessDeniedPath = getEnforcerConfig().getAccessDeniedPath();
         HttpFacade.Response response = facade.getResponse();
 
         if (accessDeniedPath != null) {
@@ -98,6 +97,8 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         } else {
             response.sendError(403);
         }
+
+        return true;
     }
 
     private AccessToken requestAuthorizationToken(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade httpFacade) {
@@ -106,8 +107,8 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
             AuthzClient authzClient = getAuthzClient();
             KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
 
-            if (getEnforcerConfig().getUserManagedAccess() != null) {
-                LOGGER.debug("Obtaining authorization for authenticated user.");
+            if (getEnforcerConfig().getUmaProtocolConfig() != null) {
+                LOGGER.debug("Obtaining authorization for  authenticated user.");
                 PermissionRequest permissionRequest = new PermissionRequest();
 
                 permissionRequest.setResourceSetId(pathConfig.getId());
@@ -135,14 +136,12 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
                     permissionRequest.setResourceSetId(pathConfig.getId());
                     permissionRequest.setResourceSetName(pathConfig.getName());
                     permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
-                    LOGGER.debugf("Sending entitlements request: resource_set_id [%s], resource_set_name [%s], scopes [%s].", permissionRequest.getResourceSetId(), permissionRequest.getResourceSetName(), permissionRequest.getScopes());
                     request.addPermission(permissionRequest);
                     EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getClientId(), request);
                     return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
                 }
             }
         } catch (AuthorizationDeniedException e) {
-            LOGGER.debug("Authorization denied", e);
             return null;
         } catch (Exception e) {
             throw new RuntimeException("Unexpected error during authorization request.", e);

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathCache.java

@@ -1,170 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.locks.LockSupport;
-
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class PathCache {
-
-    /**
-     * The load factor.
-     */
-    private static final float DEFAULT_LOAD_FACTOR = 0.75f;
-
-    private final Map<String, CacheEntry> cache;
-
-    private final AtomicBoolean writing = new AtomicBoolean(false);
-
-    private final long maxAge;
-
-    /**
-     * Creates a new instance.
-     *
-     * @param maxEntries the maximum number of entries to keep in the cache
-     */
-    public PathCache(int maxEntries) {
-        this(maxEntries, -1);
-    }
-
-    /**
-     * Creates a new instance.
-     *
-     * @param maxEntries the maximum number of entries to keep in the cache
-     * @param maxAge the time in milliseconds that an entry can stay in the cache. If {@code -1}, entries never expire
-     */
-    public PathCache(final int maxEntries, long maxAge) {
-        cache = new LinkedHashMap<String, CacheEntry>(16, DEFAULT_LOAD_FACTOR, true) {
-            @Override
-            protected boolean removeEldestEntry(Map.Entry eldest) {
-                return cache.size()  > maxEntries;
-            }
-        };
-        this.maxAge = maxAge;
-    }
-
-    public void put(String uri, PathConfig newValue) {
-        try {
-            if (parkForWriteAndCheckInterrupt()) {
-                return;
-            }
-
-            CacheEntry cacheEntry = cache.get(uri);
-
-            if (cacheEntry == null) {
-                cache.put(uri, new CacheEntry(uri, newValue, maxAge));
-            }
-        } finally {
-            writing.lazySet(false);
-        }
-    }
-
-    public PathConfig get(String uri) {
-        if (parkForReadAndCheckInterrupt()) {
-            return null;
-        }
-
-        CacheEntry cached = cache.get(uri);
-
-        if (cached != null) {
-            return removeIfExpired(cached);
-        }
-
-        return null;
-    }
-
-    public void remove(String key) {
-        try {
-            if (parkForWriteAndCheckInterrupt()) {
-                return;
-            }
-
-            cache.remove(key);
-        } finally {
-            writing.lazySet(false);
-        }
-    }
-
-    private PathConfig removeIfExpired(CacheEntry cached) {
-        if (cached == null) {
-            return null;
-        }
-
-        if (cached.isExpired()) {
-            remove(cached.key());
-            return null;
-        }
-
-        return cached.value();
-    }
-
-    private boolean parkForWriteAndCheckInterrupt() {
-        while (!writing.compareAndSet(false, true)) {
-            LockSupport.parkNanos(1L);
-            if (Thread.interrupted()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private boolean parkForReadAndCheckInterrupt() {
-        while (writing.get()) {
-            LockSupport.parkNanos(1L);
-            if (Thread.interrupted()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private static final class CacheEntry {
-
-        final String key;
-        final PathConfig value;
-        final long expiration;
-
-        CacheEntry(String key, PathConfig value, long maxAge) {
-            this.key = key;
-            this.value = value;
-            if(maxAge == -1) {
-                expiration = -1;
-            } else {
-                expiration = System.currentTimeMillis() + maxAge;
-            }
-        }
-
-        String key() {
-            return key;
-        }
-
-        PathConfig value() {
-            return value;
-        }
-
-        boolean isExpired() {
-            return expiration != -1 ? System.currentTimeMillis() > expiration : false;
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathMatcher.java

@@ -17,226 +17,87 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.Arrays;
-import java.util.Map;
-import java.util.Set;
-
-import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.representation.ResourceRepresentation;
-import org.keycloak.authorization.client.resource.ProtectedResource;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
+import java.util.List;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
 class PathMatcher {
 
-    private static final char WILDCARD = '*';
-    private final AuthzClient authzClient;
-    // TODO: make this configurable
-    private PathCache cache = new PathCache(100, 30000);
+    private static final String ANY_RESOURCE_PATTERN = "/*";
 
-    public PathMatcher(AuthzClient authzClient) {
-        this.authzClient = authzClient;
-    }
+    PathConfig matches(final String requestedUri, List<PathConfig> paths) {
+        PathConfig actualConfig = null;
 
-    public PathConfig matches(final String targetUri, Map<String, PathConfig> paths) {
-        PathConfig pathConfig = paths.get(targetUri) == null ? cache.get(targetUri) : paths.get(targetUri);
+        for (PathConfig entry : paths) {
+            String protectedUri = entry.getPath();
+            String selectedUri = null;
 
-        if (pathConfig != null) {
-            return pathConfig;
-        }
-
-        PathConfig matchingAnyPath = null;
-        PathConfig matchingAnySuffixPath = null;
-
-        for (PathConfig entry : paths.values()) {
-            String expectedUri = entry.getPath();
-            String matchingUri = null;
-
-            if (exactMatch(expectedUri, targetUri, expectedUri)) {
-                matchingUri = expectedUri;
+            if (protectedUri.equals(ANY_RESOURCE_PATTERN) && actualConfig == null) {
+                selectedUri = protectedUri;
             }
 
-            if (isTemplate(expectedUri)) {
-                String templateUri = buildUriFromTemplate(expectedUri, targetUri);
+            int suffixIndex = protectedUri.indexOf(ANY_RESOURCE_PATTERN + ".");
 
-                if (templateUri != null) {
-                    if (exactMatch(expectedUri, targetUri, templateUri)) {
-                        matchingUri = templateUri;
-                        entry = resolvePathConfig(entry, targetUri);
-                    }
+            if (suffixIndex != -1) {
+                String protectedSuffix = protectedUri.substring(suffixIndex + ANY_RESOURCE_PATTERN.length());
+
+                if (requestedUri.endsWith(protectedSuffix)) {
+                    selectedUri = protectedUri;
                 }
             }
 
-            if (matchingUri != null) {
-                StringBuilder path = new StringBuilder(expectedUri);
-                int patternIndex = path.indexOf("/" + WILDCARD);
+            if (protectedUri.equals(requestedUri)) {
+                selectedUri = protectedUri;
+            }
 
-                if (patternIndex != -1) {
-                    path.delete(patternIndex, path.length());
+            if (protectedUri.endsWith(ANY_RESOURCE_PATTERN)) {
+                String formattedPattern = removeWildCardsFromUri(protectedUri);
+
+                if (!formattedPattern.equals("/") && requestedUri.startsWith(formattedPattern)) {
+                    selectedUri = protectedUri;
                 }
 
-                patternIndex = path.indexOf("{");
-
-                if (patternIndex != -1) {
-                    path.delete(patternIndex, path.length());
+                if (!formattedPattern.equals("/") && formattedPattern.endsWith("/") && formattedPattern.substring(0, formattedPattern.length() - 1).equals(requestedUri)) {
+                    selectedUri = protectedUri;
                 }
+            }
 
-                String pathString = path.toString();
+            int startRegex = protectedUri.indexOf('{');
 
-                if ("".equals(pathString)) {
-                    pathString = "/";
+            if (startRegex != -1) {
+                String prefix = protectedUri.substring(0, startRegex);
+
+                if (requestedUri.startsWith(prefix)) {
+                    selectedUri = protectedUri;
                 }
+            }
 
-                if (matchingUri.equals(targetUri)) {
-                    cache.put(targetUri, entry);
-                    return entry;
-                }
+            if (selectedUri != null) {
+                selectedUri = protectedUri;
+            }
 
-                if (WILDCARD == expectedUri.charAt(expectedUri.length() - 1)) {
-                    matchingAnyPath = entry;
+            if (selectedUri != null) {
+                if (actualConfig == null) {
+                    actualConfig = entry;
                 } else {
-                    int suffixIndex = expectedUri.indexOf(WILDCARD + ".");
+                    if (actualConfig.equals(ANY_RESOURCE_PATTERN)) {
+                        actualConfig = entry;
+                    }
 
-                    if (suffixIndex != -1) {
-                        String protectedSuffix = expectedUri.substring(suffixIndex + 1);
-
-                        if (targetUri.endsWith(protectedSuffix)) {
-                            matchingAnySuffixPath = entry;
-                        }
+                    if (protectedUri.startsWith(removeWildCardsFromUri(actualConfig.getPath()))) {
+                        actualConfig = entry;
                     }
                 }
             }
         }
 
-        if (matchingAnySuffixPath != null) {
-            cache.put(targetUri, matchingAnySuffixPath);
-            return matchingAnySuffixPath;
-        }
-
-        if (matchingAnyPath != null) {
-            cache.put(targetUri, matchingAnyPath);
-        }
-
-        return matchingAnyPath;
+        return actualConfig;
     }
 
-    private boolean exactMatch(String expectedUri, String targetUri, String value) {
-        if (targetUri.equals(value)) {
-            return value.equals(targetUri);
-        }
-
-        if (endsWithWildcard(expectedUri)) {
-            return targetUri.startsWith(expectedUri.substring(0, expectedUri.length() - 2));
-        }
-
-        String suffix = "/*.";
-        int suffixIndex = expectedUri.indexOf(suffix);
-
-        if (suffixIndex != -1) {
-            return targetUri.endsWith(expectedUri.substring(suffixIndex + suffix.length() - 1));
-        }
-
-        return false;
-    }
-
-    public String buildUriFromTemplate(String expectedUri, String targetUri) {
-        int patternStartIndex = expectedUri.indexOf("{");
-
-        if (patternStartIndex == -1 || patternStartIndex >= targetUri.length()) {
-            return null;
-        }
-
-        if (expectedUri.split("/").length > targetUri.split("/").length) {
-            return null;
-        }
-
-        char[] expectedUriChars = expectedUri.toCharArray();
-        char[] matchingUri = Arrays.copyOfRange(expectedUriChars, 0, patternStartIndex);
-        int matchingUriLastIndex = matchingUri.length;
-        String targetUriParams = targetUri.substring(patternStartIndex);
-
-        if (Arrays.equals(matchingUri, Arrays.copyOf(targetUri.toCharArray(), matchingUri.length))) {
-            matchingUri = Arrays.copyOf(matchingUri, targetUri.length());
-            int paramIndex = 0;
-
-            for (int i = patternStartIndex; i < expectedUriChars.length; i++) {
-                if (matchingUriLastIndex >= matchingUri.length) {
-                    break;
-                }
-
-                char c = expectedUriChars[i];
-
-                if (c == '{' || c == '*') {
-                    String[] params = targetUriParams.split("/");
-
-                    for (int k = paramIndex; k <= (c == '*' ? params.length : paramIndex); k++) {
-                        if (k == params.length) {
-                            break;
-                        }
-
-                        int paramLength = params[k].length();
-
-                        if (matchingUriLastIndex + paramLength > matchingUri.length) {
-                            return null;
-                        }
-
-                        for (int j = 0; j < paramLength; j++) {
-                            matchingUri[matchingUriLastIndex++] = params[k].charAt(j);
-                        }
-
-                        if (c == '*' && matchingUriLastIndex < matchingUri.length) {
-                            matchingUri[matchingUriLastIndex++] = '/';
-                        }
-                    }
-
-                    i = expectedUri.indexOf('}', i);
-                } else {
-                    if (c == '/') {
-                        paramIndex++;
-                    }
-                    matchingUri[matchingUriLastIndex++] = c;
-                }
-            }
-
-            if (matchingUri[matchingUri.length - 1] == '\u0000') {
-                return null;
-            }
-
-            return String.valueOf(matchingUri);
-        }
-
-        return null;
-    }
-
-    public boolean endsWithWildcard(String expectedUri) {
-        return WILDCARD == expectedUri.charAt(expectedUri.length() - 1);
-    }
-
-    private boolean isTemplate(String uri) {
-        return uri.indexOf("{") != -1;
-    }
-
-    private PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
-        if (originalConfig.hasPattern()) {
-            ProtectedResource resource = this.authzClient.protection().resource();
-            Set<String> search = resource.findByFilter("uri=" + path);
-
-            if (!search.isEmpty()) {
-                // resource does exist on the server, cache it
-                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
-                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
-
-                config.setScopes(originalConfig.getScopes());
-                config.setMethods(originalConfig.getMethods());
-                config.setParentConfig(originalConfig);
-                config.setEnforcementMode(originalConfig.getEnforcementMode());
-
-                return config;
-            }
-        }
-
-        return originalConfig;
+    private String removeWildCardsFromUri(String protectedUri) {
+        return protectedUri.replaceAll("/[*]", "/");
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PolicyEnforcer.java

@@ -21,9 +21,7 @@ import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.authorization.client.Configuration;
 import org.keycloak.authorization.client.representation.RegistrationResponse;
 import org.keycloak.authorization.client.representation.ResourceRepresentation;
@@ -36,10 +34,8 @@ import org.keycloak.representations.idm.authorization.Permission;
 
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
-import java.util.Map;
 import java.util.Set;
 
 /**
@@ -52,24 +48,17 @@ public class PolicyEnforcer {
     private final KeycloakDeployment deployment;
     private final AuthzClient authzClient;
     private final PolicyEnforcerConfig enforcerConfig;
-    private final Map<String, PathConfig> paths;
-    private final PathMatcher pathMatcher;
+    private final List<PathConfig> paths;
 
     public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
         this.deployment = deployment;
         this.enforcerConfig = adapterConfig.getPolicyEnforcerConfig();
-        this.authzClient = AuthzClient.create(new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient()), new ClientAuthenticator() {
-            @Override
-            public void configureClientCredentials(HashMap<String, String> requestParams, HashMap<String, String> requestHeaders) {
-                ClientCredentialsProviderUtils.setClientCredentials(PolicyEnforcer.this.deployment, requestHeaders, requestParams);
-            }
-        });
-        this.pathMatcher = new PathMatcher(this.authzClient);
+        this.authzClient = AuthzClient.create(new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient()));
         this.paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Initialization complete. Path configurations:");
-            for (PathConfig pathConfig : this.paths.values()) {
+            for (PathConfig pathConfig : this.paths) {
                 LOGGER.debug(pathConfig);
             }
         }
@@ -107,29 +96,16 @@ public class PolicyEnforcer {
         return authzClient;
     }
 
-    public Map<String, PathConfig> getPaths() {
-        return paths;
-    }
-
-    void addPath(PathConfig pathConfig) {
-        paths.put(pathConfig.getPath(), pathConfig);
+    public List<PathConfig> getPaths() {
+        return Collections.unmodifiableList(paths);
     }
 
     KeycloakDeployment getDeployment() {
         return deployment;
     }
 
-    private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        boolean loadPathsFromServer = true;
-
-        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
-            if (!PolicyEnforcerConfig.EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                loadPathsFromServer = false;
-                break;
-            }
-        }
-
-        if (loadPathsFromServer) {
+    private List<PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        if (enforcerConfig.getPaths().isEmpty()) {
             LOGGER.info("No path provided in configuration.");
             return configureAllPathsForResourceServer(protectedResource);
         } else {
@@ -138,8 +114,8 @@ public class PolicyEnforcer {
         }
     }
 
-    private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+    private List<PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        List<PathConfig> paths = new ArrayList<>();
 
         for (PathConfig pathConfig : enforcerConfig.getPaths()) {
             Set<String> search;
@@ -187,7 +163,7 @@ public class PolicyEnforcer {
 
             PathConfig existingPath = null;
 
-            for (PathConfig current : paths.values()) {
+            for (PathConfig current : paths) {
                 if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                     existingPath = current;
                     break;
@@ -195,7 +171,7 @@ public class PolicyEnforcer {
             }
 
             if (existingPath == null) {
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(pathConfig);
             } else {
                 existingPath.getMethods().addAll(pathConfig.getMethods());
                 existingPath.getScopes().addAll(pathConfig.getScopes());
@@ -205,36 +181,28 @@ public class PolicyEnforcer {
         return paths;
     }
 
-    private Map<String, PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
+    private List<PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
         LOGGER.info("Querying the server for all resources associated with this application.");
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+        List<PathConfig> paths = new ArrayList<>();
 
         for (String id : protectedResource.findAll()) {
             RegistrationResponse response = protectedResource.findById(id);
             ResourceRepresentation resourceDescription = response.getResourceDescription();
 
             if (resourceDescription.getUri() != null) {
-                PathConfig pathConfig = createPathConfig(resourceDescription);
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(createPathConfig(resourceDescription));
             }
         }
 
         return paths;
     }
 
-    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+    private PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
         PathConfig pathConfig = new PathConfig();
 
         pathConfig.setId(resourceDescription.getId());
         pathConfig.setName(resourceDescription.getName());
-
-        String uri = resourceDescription.getUri();
-
-        if (uri == null || "".equals(uri.trim())) {
-            throw new RuntimeException("Failed to configure paths. Resource [" + resourceDescription.getName() + "] has an invalid or empty URI [" + uri + "].");
-        }
-
-        pathConfig.setPath(uri);
+        pathConfig.setPath(resourceDescription.getUri());
 
         List<String> scopeNames = new ArrayList<>();
 
@@ -247,8 +215,4 @@ public class PolicyEnforcer {
 
         return pathConfig;
     }
-
-    public PathMatcher getPathMatcher() {
-        return pathMatcher;
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/HardcodedPublicKeyLocator.java

@@ -37,9 +37,4 @@ public class HardcodedPublicKeyLocator implements PublicKeyLocator {
     public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
         return publicKey;
     }
-
-    @Override
-    public void reset(KeycloakDeployment deployment) {
-
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/JWKPublicKeyLocator.java

@@ -25,6 +25,7 @@ import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.common.util.Time;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
+import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.util.JWKSUtils;
 
 import java.security.PublicKey;
@@ -47,51 +48,36 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
     @Override
     public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
         int minTimeBetweenRequests = deployment.getMinTimeBetweenJwksRequests();
-        int publicKeyCacheTtl = deployment.getPublicKeyCacheTtl();
-        int currentTime = Time.currentTime();
 
         // Check if key is in cache.
-        PublicKey publicKey = lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
+        PublicKey publicKey = currentKeys.get(kid);
         if (publicKey != null) {
             return publicKey;
         }
 
+        int currentTime = Time.currentTime();
+
         // Check if we are allowed to send request
-        synchronized (this) {
-            currentTime = Time.currentTime();
-            if (currentTime > lastRequestTime + minTimeBetweenRequests) {
-                sendRequest(deployment);
-                lastRequestTime = currentTime;
-            } else {
-                log.debug("Won't send request to realm jwks url. Last request time was " + lastRequestTime);
+        if (currentTime > lastRequestTime + minTimeBetweenRequests) {
+            synchronized (this) {
+                currentTime = Time.currentTime();
+                if (currentTime > lastRequestTime + minTimeBetweenRequests) {
+                    sendRequest(deployment);
+                    lastRequestTime = currentTime;
+                } else {
+                    log.debugf("Won't send request to realm jwks url. Last request time was %d", lastRequestTime);
+                }
             }
-
-            return lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
         }
-    }
 
+        return currentKeys.get(kid);
 
-    @Override
-    public void reset(KeycloakDeployment deployment) {
-        synchronized (this) {
-            sendRequest(deployment);
-            lastRequestTime = Time.currentTime();
-        }
-    }
-
-
-    private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
-        if (lastRequestTime + publicKeyCacheTtl > currentTime) {
-            return currentKeys.get(kid);
-        } else {
-            return null;
-        }
     }
 
 
     private void sendRequest(KeycloakDeployment deployment) {
         if (log.isTraceEnabled()) {
-            log.trace("Going to send request to retrieve new set of realm public keys for client " + deployment.getResourceName());
+            log.tracef("Going to send request to retrieve new set of realm public keys for client %s", deployment.getResourceName());
         }
 
         HttpGet getMethod = new HttpGet(deployment.getJwksUrl());
@@ -101,7 +87,7 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
             Map<String, PublicKey> publicKeys = JWKSUtils.getKeysForUse(jwks, JWK.Use.SIG);
 
             if (log.isDebugEnabled()) {
-                log.debug("Realm public keys successfully retrieved for client " +  deployment.getResourceName() + ". New kids: " + publicKeys.keySet().toString());
+                log.debugf("Realm public keys successfully retrieved for client %s. New kids: %s", deployment.getResourceName(), publicKeys.keySet().toString());
             }
 
             // Update current keys

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/PublicKeyLocator.java

@@ -34,11 +34,4 @@ public interface PublicKeyLocator {
      */
     PublicKey getPublicKey(String kid, KeycloakDeployment deployment);
 
-    /**
-     * Reset the state of locator (eg. clear the cached keys)
-     *
-     * @param deployment
-     */
-    void reset(KeycloakDeployment deployment);
-
 }

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentBuilderTest.java

@@ -69,7 +69,6 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals("email", deployment.getPrincipalAttribute());
         assertEquals(10, deployment.getTokenMinimumTimeToLive());
         assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(120, deployment.getPublicKeyCacheTtl());
     }
 
     @Test
@@ -79,7 +78,6 @@ public class KeycloakDeploymentBuilderTest {
 
         assertTrue(deployment.getPublicKeyLocator() instanceof JWKPublicKeyLocator);
         assertEquals(10, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(86400, deployment.getPublicKeyCacheTtl());
     }
 
     @Test

adapters/oidc/adapter-core/src/test/resources/keycloak.json

@@ -30,6 +30,5 @@
     "token-store": "cookie",
     "principal-attribute": "email",
     "token-minimum-time-to-live": 10,
-    "min-time-between-jwks-requests": 20,
-    "public-key-cache-ttl": 120
+    "min-time-between-jwks-requests": 20
 }

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -88,6 +88,7 @@
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
+            <version>3.1.0.GA</version>
         </dependency>
 
         <dependency>
@@ -103,6 +104,7 @@ projects that depend on this project.-->
         <dependency>
             <groupId>org.jboss.msc</groupId>
             <artifactId>jboss-msc</artifactId>
+            <version>1.0.2.GA</version>
         </dependency>
 
         <dependency>

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/KeycloakSubsystemParser.java

@@ -86,7 +86,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addRealm)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
 
         list.add(addRealm);
@@ -117,7 +117,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
          * TODO need to check realm-ref first.
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addSecureDeployment)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none  and disable-trust-maanger is false.");
         }
          */
 

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/RealmAddHandler.java

@@ -46,7 +46,7 @@ public final class RealmAddHandler extends AbstractAddStepHandler {
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(model.clone())) {
             //TODO: externalize message
-            throw new OperationFailedException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new OperationFailedException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
     }
 

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -30,18 +30,6 @@
     <artifactId>keycloak-as7-integration-pom</artifactId>
     <packaging>pom</packaging>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.jboss.as</groupId>
-                <artifactId>jboss-as-parent</artifactId>
-                <version>${jboss.as.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <modules>
         <module>as7-adapter-spi</module>
         <module>as7-adapter</module>

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -66,11 +66,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
             return requestContext.getUriInfo().getRequestUri().toString();
         }
 
-        @Override
-        public String getRelativePath() {
-            return requestContext.getUriInfo().getPath();
-        }
-
         @Override
         public boolean isSecure() {
             return securityContext.isSecure();

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/AbstractKeycloakJettyAuthenticator.java

@@ -106,8 +106,6 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
 
     public abstract AdapterTokenStore createSessionTokenStore(Request request, KeycloakDeployment resolvedDeployment);
 
-    public abstract JettyUserSessionManagement createSessionManagement(Request request);
-
     public void logoutCurrent(Request request) {
         AdapterDeploymentContext deploymentContext = (AdapterDeploymentContext) request.getAttribute(AdapterDeploymentContext.class.getName());
         KeycloakSecurityContext ksc = (KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
@@ -289,7 +287,7 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
             log.debug("*** deployment isn't configured return false");
             return Authentication.UNAUTHENTICATED;
         }
-        PreAuthActionsHandler handler = new PreAuthActionsHandler(createSessionManagement(request), deploymentContext, facade);
+        PreAuthActionsHandler handler = new PreAuthActionsHandler(new JettyUserSessionManagement(request.getSessionManager()), deploymentContext, facade);
         if (handler.handleRequest()) {
             return Authentication.SEND_SUCCESS;
         }

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/Jetty81SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty81SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty81SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -25,7 +25,6 @@ import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -45,11 +44,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty81SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request)?(Request)req: AbstractHttpConnection.getCurrentConnection().getRequest();

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/Jetty91SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty91SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty91SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,7 +27,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -47,11 +46,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty91SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request) ? (Request)req : HttpChannel.getCurrentHttpChannel().getRequest();

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/Jetty92SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty92SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty92SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,7 +27,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -62,11 +61,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty92SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/Jetty93SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty93SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty93SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -26,7 +26,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -61,11 +60,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty93SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -1,156 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-jetty94-adapter</artifactId>
-	<name>Keycloak Jetty 9.4.x Integration</name>
-    <properties>
-        <jetty9.version>9.4.2.v20170220</jetty9.version>
-        <keycloak.osgi.export>
-            org.keycloak.adapters.jetty.*
-        </keycloak.osgi.export>
-        <keycloak.osgi.import>
-            org.eclipse.jetty.*;resolution:=optional,
-            javax.servlet.*;version="[3.0,4)";resolution:=optional,
-            org.keycloak.*;version="${project.version}",
-            *;resolution:=optional
-        </keycloak.osgi.import>
-    </properties>
-	<description />
-
-	<dependencies>
-        <dependency>
-            <groupId>org.jboss.logging</groupId>
-            <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
-        </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-adapter-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-jetty-core</artifactId>
-        </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-		</dependency>
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-server</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-util</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-security</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
-            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
-            <plugin>
-                <artifactId>maven-jar-plugin</artifactId>
-                <configuration>
-                    <archive>
-                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
-                    </archive>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.felix</groupId>
-                <artifactId>maven-bundle-plugin</artifactId>
-                <extensions>true</extensions>
-                <executions>
-                    <execution>
-                        <id>bundle-manifest</id>
-                        <phase>process-classes</phase>
-                        <goals>
-                            <goal>manifest</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <instructions>
-                        <Bundle-ClassPath>.</Bundle-ClassPath>
-                        <Bundle-Name>${project.name}</Bundle-Name>
-                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
-                        <Import-Package>${keycloak.osgi.import}</Import-Package>
-                        <Export-Package>${keycloak.osgi.export}</Export-Package>
-                    </instructions>
-                </configuration>
-            </plugin>
-		</plugins>
-	</build>
-
-</project>

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/Jetty94RequestAuthenticator.java

@@ -1,47 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.Request;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
-import org.keycloak.adapters.spi.HttpFacade;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty94RequestAuthenticator extends JettyRequestAuthenticator {
-    public Jetty94RequestAuthenticator(HttpFacade facade, KeycloakDeployment deployment, AdapterTokenStore tokenStore, int sslRedirectPort, Request request) {
-        super(facade, deployment, tokenStore, sslRedirectPort, request);
-    }
-
-    @Override
-    protected String changeHttpSessionId(boolean create) {
-        Request request = this.request;
-        HttpSession session = request.getSession(false);
-        if (session == null) {
-            return request.getSession(true).getId();
-        }
-        if (!deployment.isTurnOffChangeSessionIdOnLogin()) return request.changeSessionId();
-        else return session.getId();
-    }
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/Jetty94SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.session.SessionHandler;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty94SessionManager implements JettySessionManager {
-    protected SessionHandler sessionHandler;
-
-    public Jetty94SessionManager(SessionHandler sessionHandler) {
-        this.sessionHandler = sessionHandler;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionHandler.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -1,111 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.security.authentication.FormAuthenticator;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.spi.AdapterSessionStore;
-import org.keycloak.common.util.MultivaluedHashMap;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class JettyAdapterSessionStore implements AdapterSessionStore {
-    public static final String CACHED_FORM_PARAMETERS = "__CACHED_FORM_PARAMETERS";
-    protected Request myRequest;
-
-    public JettyAdapterSessionStore(Request request) {
-        this.myRequest = request; // for IDE/compilation purposes
-    }
-
-    protected MultiMap<String> extractFormParameters(Request base_request) {
-        MultiMap<String> formParameters = new MultiMap<String>();
-        base_request.extractFormParameters(formParameters);
-        return formParameters;
-    }
-    protected void restoreFormParameters(MultiMap<String> j_post, Request base_request) {
-        base_request.setContentParameters(j_post);
-    }
-
-    public boolean restoreRequest() {
-        HttpSession session = myRequest.getSession(false);
-        if (session == null) return false;
-        synchronized (session) {
-            String j_uri = (String) session.getAttribute(FormAuthenticator.__J_URI);
-            if (j_uri != null) {
-                // check if the request is for the same url as the original and restore
-                // params if it was a post
-                StringBuffer buf = myRequest.getRequestURL();
-                if (myRequest.getQueryString() != null)
-                    buf.append("?").append(myRequest.getQueryString());
-                if (j_uri.equals(buf.toString())) {
-                    String method = (String)session.getAttribute(JettyHttpFacade.__J_METHOD);
-                    myRequest.setMethod(method);
-                    MultivaluedHashMap<String, String> j_post = (MultivaluedHashMap<String, String>) session.getAttribute(CACHED_FORM_PARAMETERS);
-                    if (j_post != null) {
-                        myRequest.setContentType("application/x-www-form-urlencoded");
-                        MultiMap<String> map = new MultiMap<String>();
-                        for (String key : j_post.keySet()) {
-                            for (String val : j_post.getList(key)) {
-                                map.add(key, val);
-                            }
-                        }
-                        restoreFormParameters(map, myRequest);
-                    }
-                    session.removeAttribute(FormAuthenticator.__J_URI);
-                    session.removeAttribute(JettyHttpFacade.__J_METHOD);
-                    session.removeAttribute(FormAuthenticator.__J_POST);
-                }
-                return true;
-            }
-        }
-        return false;
-    }
-
-    public void saveRequest() {
-        // remember the current URI
-        HttpSession session = myRequest.getSession();
-        synchronized (session) {
-            // But only if it is not set already, or we save every uri that leads to a login form redirect
-            if (session.getAttribute(FormAuthenticator.__J_URI) == null) {
-                StringBuffer buf = myRequest.getRequestURL();
-                if (myRequest.getQueryString() != null)
-                    buf.append("?").append(myRequest.getQueryString());
-                session.setAttribute(FormAuthenticator.__J_URI, buf.toString());
-                session.setAttribute(JettyHttpFacade.__J_METHOD, myRequest.getMethod());
-
-                if ("application/x-www-form-urlencoded".equals(myRequest.getContentType()) && "POST".equalsIgnoreCase(myRequest.getMethod())) {
-                    MultiMap<String> formParameters = extractFormParameters(myRequest);
-                    MultivaluedHashMap<String, String> map = new MultivaluedHashMap<String, String>();
-                    for (String key : formParameters.keySet()) {
-                        for (Object value : formParameters.getValues(key)) {
-                            map.add(key, (String) value);
-                        }
-                    }
-                    session.setAttribute(CACHED_FORM_PARAMETERS, map);
-                }
-            }
-        }
-    }
-
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -1,75 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.Authentication;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.server.UserIdentity;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
-import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
-import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
-
-import javax.servlet.ServletRequest;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticator {
-
-    public KeycloakJettyAuthenticator() {
-        super();
-    }
-
-
-    @Override
-    protected Request resolveRequest(ServletRequest req) {
-        return Request.getBaseRequest(req);
-    }
-
-    @Override
-    protected Authentication createAuthentication(UserIdentity userIdentity, final Request request) {
-        return new KeycloakAuthentication(getAuthMethod(), userIdentity) {
-            @Override
-            public void logout() {
-                logoutCurrent(request);
-            }
-        };
-    }
-
-    @Override
-    public AdapterTokenStore createSessionTokenStore(Request request, KeycloakDeployment resolvedDeployment) {
-        return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
-    }
-
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty94SessionManager(request.getSessionHandler()));
-    }
-
-    @Override
-    protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
-                                                                   KeycloakDeployment deployment, AdapterTokenStore tokenStore) {
-        return new Jetty94RequestAuthenticator(facade, deployment, tokenStore, -1, request);
-    }
-
-}

adapters/oidc/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Jetty Integration</name>
@@ -33,22 +33,8 @@
     <modules>
         <module>jetty-core</module>
         <module>jetty8.1</module>
+        <module>jetty9.1</module>
         <module>jetty9.2</module>
         <module>jetty9.3</module>
     </modules>
-
-    <profiles>
-        <profile>
-            <id>community</id>
-            <activation>
-                <property>
-                    <name>!product</name>
-                </property>
-            </activation>
-            <modules>
-                <module>jetty9.1</module>
-                <module>jetty9.4</module>
-            </modules>
-        </profile>
-    </profiles>
 </project>

adapters/oidc/js/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>3.1.1.Final-SNAPSHOT</version>
+		<version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/js/src/main/resources/keycloak-authz.js

@@ -118,11 +118,12 @@
         /**
          * Obtains all entitlements from a Keycloak Server based on a give resourceServerId.
          */
-        this.entitlement = function (resourceSeververId, entitlementRequest     ) {
+        this.entitlement = function (resourceSeververId) {
             this.then = function (onGrant, onDeny, onError) {
                 var request = new XMLHttpRequest();
 
-
+                request.open('GET', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/authz/entitlement/' + resourceSeververId, true);
+                request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token)
 
                 request.onreadystatechange = function () {
                     if (request.readyState == 4) {
@@ -148,19 +149,7 @@
                     }
                 };
 
-                var erJson = null
-
-                if(entitlementRequest) {
-                    request.open('POST', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/authz/entitlement/' + resourceSeververId, true);
-                    request.setRequestHeader("Content-type", "application/json");
-                    erJson = JSON.stringify(entitlementRequest)
-                } else {
-                    request.open('GET', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/authz/entitlement/' + resourceSeververId, true);
-                }
-
-                request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token)
-                request.send(erJson);
-
+                request.send(null);
             };
 
             return this;

adapters/oidc/js/src/main/resources/keycloak.d.ts

@@ -1,101 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-declare module KeycloakModule {
-
-    export interface Promise {
-        success(callback: Function): Promise;
-        error(callback: Function): Promise;
-    }
-
-    export type ResponseModes = "query" | "fragment";
-    export type Flows = "standard" | "implicit" | "hybrid";
-    
-    export interface InitOptions {
-        checkLoginIframe?: boolean;
-        checkLoginIframeInterval?: number;
-        onLoad?: string;
-        adapter?: string;
-        responseMode?: ResponseModes;
-        flow?: Flows;
-        token?: string;
-        refreshToken?: string;
-        idToken?: string;
-        timeSkew?: number;
-    }
-
-    export interface LoginOptions {
-        redirectUri?: string;
-        prompt?: string;
-        maxAge?: number;
-        loginHint?: string;
-        action?: string;
-        locale?: string;
-    }
-
-    export interface RedirectUriOptions {
-        redirectUri?: string;
-    }
-
-    export interface KeycloakClient {
-        init(options?: InitOptions): Promise;
-        login(options?: LoginOptions): Promise;
-        createLoginUrl(options?: LoginOptions): string;
-        logout(options?: RedirectUriOptions): Promise;
-        createLogoutUrl(options?: RedirectUriOptions): string;
-        register(options?: LoginOptions): Promise;
-        createRegisterUrl(options?: RedirectUriOptions): string;
-        accountManagement(): Promise;
-        createAccountUrl(options?: RedirectUriOptions): string;
-        hasRealmRole(role: string): boolean;
-        hasResourceRole(role: string, resource?: string): boolean;
-        loadUserProfile(): Promise;
-        isTokenExpired(minValidity: number): boolean;
-        updateToken(minValidity: number): Promise;
-        clearToken(): any;
-
-        realm: string;
-        clientId: string;
-        authServerUrl: string;
-
-        token: string;
-        tokenParsed: any;
-        refreshToken: string;
-        refreshTokenParsed: any;
-        idToken: string;
-        idTokenParsed: any;
-        realmAccess: any;
-        resourceAccess: any;
-        authenticated: boolean;
-        subject: string;
-        timeSkew: number;
-        responseMode: ResponseModes;
-        flow: Flows;
-        responseType: string;
-
-        onReady: Function;
-        onAuthSuccess: Function;
-        onAuthError: Function;
-        onAuthRefreshSuccess: Function;
-        onAuthRefreshError: Function;
-        onAuthLogout: Function;
-        onTokenExpired: Function;
-    }
-}
-
-declare var Keycloak: {
-    new(config?: any): KeycloakModule.KeycloakClient;
-};

adapters/oidc/js/src/main/resources/keycloak.js

@@ -87,10 +87,6 @@
                     }
                     kc.flow = initOptions.flow;
                 }
-
-                if (initOptions.timeSkew != null) {
-                    kc.timeSkew = initOptions.timeSkew;
-                }
             }
 
             if (!kc.responseMode) {
@@ -157,7 +153,7 @@
                     processCallback(callback, initPromise);
                     return;
                 } else if (initOptions) {
-                    if (initOptions.token && initOptions.refreshToken) {
+                    if (initOptions.token || initOptions.refreshToken) {
                         setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
 
                         if (loginIframe.enable) {
@@ -166,8 +162,12 @@
                                     kc.onAuthSuccess && kc.onAuthSuccess();
                                     initPromise.setSuccess();
                                 }).error(function () {
-                                    setToken(null, null, null);
-                                    initPromise.setSuccess();
+                                    kc.onAuthError && kc.onAuthError();
+                                    if (initOptions.onLoad) {
+                                        onLoad();
+                                    } else {
+                                        initPromise.setError();
+                                    }
                                 });
                             });
                         } else {
@@ -210,18 +210,11 @@
             var nonce = createUUID();
 
             var redirectUri = adapter.redirectUri(options);
-
-            var callbackState = {
-                state: state,
-                nonce: nonce,
-                redirectUri: encodeURIComponent(redirectUri),
-            }
-
             if (options && options.prompt) {
-                callbackState.prompt = options.prompt;
+                redirectUri += (redirectUri.indexOf('?') == -1 ? '?' : '&') + 'prompt=' + options.prompt;
             }
 
-            callbackStorage.add(callbackState);
+            callbackStorage.add({ state: state, nonce: nonce, redirectUri: encodeURIComponent(redirectUri) });
 
             var action = 'auth';
             if (options && options.action == 'register') {
@@ -369,11 +362,6 @@
                 throw 'Not authenticated';
             }
 
-            if (kc.timeSkew == null) {
-                console.info('[KEYCLOAK] Unable to determine if token is expired as timeskew is not set');
-                return true;
-            }
-
             var expiresIn = kc.tokenParsed['exp'] - Math.ceil(new Date().getTime() / 1000) + kc.timeSkew;
             if (minValidity) {
                 expiresIn -= minValidity;
@@ -384,7 +372,7 @@
         kc.updateToken = function(minValidity) {
             var promise = createPromise();
 
-            if (!kc.refreshToken) {
+            if (!kc.tokenParsed || !kc.refreshToken) {
                 promise.setError();
                 return promise.promise;
             }
@@ -393,10 +381,14 @@
 
             var exec = function() {
                 var refreshToken = false;
-                if (minValidity == -1) {
+                if (kc.timeSkew == -1) {
+                    console.info('Skew ' + kc.timeSkew);
+                    refreshToken = true;
+                    console.info('[KEYCLOAK] Refreshing token: time skew not set');
+                } else if (minValidity == -1) {
                     refreshToken = true;
                     console.info('[KEYCLOAK] Refreshing token: forced refresh');
-                } else if (!kc.tokenParsed || kc.isTokenExpired(minValidity)) {
+                } else if (kc.isTokenExpired(minValidity)) {
                     refreshToken = true;
                     console.info('[KEYCLOAK] Refreshing token: token expired');
                 }
@@ -639,6 +631,49 @@
                 kc.tokenTimeoutHandle = null;
             }
 
+            if (token) {
+                kc.token = token;
+                kc.tokenParsed = decodeToken(token);
+                var sessionId = kc.realm + '/' + kc.tokenParsed.sub;
+                if (kc.tokenParsed.session_state) {
+                    sessionId = sessionId + '/' + kc.tokenParsed.session_state;
+                }
+                kc.sessionId = sessionId;
+                kc.authenticated = true;
+                kc.subject = kc.tokenParsed.sub;
+                kc.realmAccess = kc.tokenParsed.realm_access;
+                kc.resourceAccess = kc.tokenParsed.resource_access;
+
+                if (timeLocal) {
+                    kc.timeSkew = Math.floor(timeLocal / 1000) - kc.tokenParsed.iat;
+                    console.info('[KEYCLOAK] Estimated time difference between browser and server is ' + kc.timeSkew + ' seconds');
+                } else {
+                    kc.timeSkew = -1;
+                }
+
+                if (kc.onTokenExpired) {
+                    if (kc.timeSkew == -1) {
+                        kc.onTokenExpired();
+                    } else {
+                        var expiresIn = (kc.tokenParsed['exp'] - (new Date().getTime() / 1000) + kc.timeSkew) * 1000;
+                        if (expiresIn <= 0) {
+                            kc.onTokenExpired();
+                        } else {
+                            kc.tokenTimeoutHandle = setTimeout(kc.onTokenExpired, expiresIn);
+                        }
+                    }
+                }
+
+            } else {
+                delete kc.token;
+                delete kc.tokenParsed;
+                delete kc.subject;
+                delete kc.realmAccess;
+                delete kc.resourceAccess;
+
+                kc.authenticated = false;
+            }
+
             if (refreshToken) {
                 kc.refreshToken = refreshToken;
                 kc.refreshTokenParsed = decodeToken(refreshToken);
@@ -654,42 +689,6 @@
                 delete kc.idToken;
                 delete kc.idTokenParsed;
             }
-
-            if (token) {
-                kc.token = token;
-                kc.tokenParsed = decodeToken(token);
-                kc.sessionId = kc.tokenParsed.session_state;
-                kc.authenticated = true;
-                kc.subject = kc.tokenParsed.sub;
-                kc.realmAccess = kc.tokenParsed.realm_access;
-                kc.resourceAccess = kc.tokenParsed.resource_access;
-
-                if (timeLocal) {
-                    kc.timeSkew = Math.floor(timeLocal / 1000) - kc.tokenParsed.iat;
-                }
-
-                if (kc.timeSkew != null) {
-                    console.info('[KEYCLOAK] Estimated time difference between browser and server is ' + kc.timeSkew + ' seconds');
-
-                    if (kc.onTokenExpired) {
-                        var expiresIn = (kc.tokenParsed['exp'] - (new Date().getTime() / 1000) + kc.timeSkew) * 1000;
-                        console.info('[KEYCLOAK] Token expires in ' + Math.round(expiresIn / 1000) + ' s');
-                        if (expiresIn <= 0) {
-                            kc.onTokenExpired();
-                        } else {
-                            kc.tokenTimeoutHandle = setTimeout(kc.onTokenExpired, expiresIn);
-                        }
-                    }
-                }
-            } else {
-                delete kc.token;
-                delete kc.tokenParsed;
-                delete kc.subject;
-                delete kc.realmAccess;
-                delete kc.resourceAccess;
-
-                kc.authenticated = false;
-            }
         }
 
         function decodeToken(str) {
@@ -748,7 +747,6 @@
             if (oauthState && (oauth.code || oauth.error || oauth.access_token || oauth.id_token)) {
                 oauth.redirectUri = oauthState.redirectUri;
                 oauth.storedNonce = oauthState.nonce;
-                oauth.prompt = oauthState.prompt;
 
                 if (oauth.fragment) {
                     oauth.newUrl += '#' + oauth.fragment;
@@ -832,28 +830,22 @@
             document.body.appendChild(iframe);
 
             var messageCallback = function(event) {
-                if ((event.origin !== loginIframe.iframeOrigin) || (loginIframe.iframe.contentWindow !== event.source)) {
+                if (event.origin !== loginIframe.iframeOrigin) {
                     return;
                 }
 
-                if (!(event.data == 'unchanged' || event.data == 'changed' || event.data == 'error')) {
-                    return;
-                }
-
-
-                if (event.data != 'unchanged') {
+                if (event.data != "unchanged") {
                     kc.clearToken();
                 }
 
-                var callbacks = loginIframe.callbackList.splice(0, loginIframe.callbackList.length);
-
-                for (var i = callbacks.length - 1; i >= 0; --i) {
-                    var promise = callbacks[i];
-                    if (event.data == 'unchanged') {
+                for (var i = loginIframe.callbackList.length - 1; i >= 0; --i) {
+                    var promise = loginIframe.callbackList[i];
+                    if (event.data == "unchanged") {
                         promise.setSuccess();
                     } else {
                         promise.setError();
                     }
+                    loginIframe.callbackList.splice(i, 1);
                 }
             };
 
@@ -1049,7 +1041,7 @@
 
             function clearExpired() {
                 var time = new Date().getTime();
-                for (var i = 0; i < localStorage.length; i++)  {
+                for (var i = 1; i <= localStorage.length; i++)  {
                     var key = localStorage.key(i);
                     if (key && key.indexOf('kc-callback-') == 0) {
                         var value = localStorage.getItem(key);
@@ -1226,9 +1218,12 @@
                         case 'redirect_fragment':
                             oauth.fragment = queryParams[param];
                             break;
+                        case 'prompt':
+                            oauth.prompt = queryParams[param];
+                            break;
                         default:
                             if (responseMode != 'query' || !handleQueryParam(param, queryParams[param], oauth)) {
-                                oauth.newUrl += (oauth.newUrl.indexOf('?') == -1 ? '?' : '&') + param + '=' + encodeURIComponent(queryParams[param]);
+                                oauth.newUrl += (oauth.newUrl.indexOf('?') == -1 ? '?' : '&') + param + '=' + queryParams[param];
                             }
                             break;
                     }

adapters/oidc/js/src/main/resources/login-status-iframe.html

@@ -21,28 +21,25 @@
     var init;
 
     function checkState(clientId, origin, sessionState, callback) {
-        var cookie = getCookie();
-
-        if (!cookie) {
-            callback('changed');
-        } else  if (!init) {
+        if (!init) {
             var req = new XMLHttpRequest();
 
             var url = location.href + "/init";
             url += "?client_id=" + encodeURIComponent(clientId);
             url += "&origin=" + encodeURIComponent(origin);
+            url += "&session_state=" + encodeURIComponent(sessionState);
 
             req.open('GET', url, true);
 
             req.onreadystatechange = function () {
-                if (req.readyState === 4) {
-                    if (req.status === 204) {
+                if (req.readyState == 4) {
+                    if (req.status == 204) {
                         init = {
                             clientId: clientId,
                             origin: origin
                         }
                         callback('unchanged');
-                    } else if (req.status === 404) {
+                    } else if (req.status = 404) {
                         callback('changed');
                     } else {
                         callback('error');
@@ -52,9 +49,9 @@
 
             req.send();
         } else {
-            if (clientId === init.clientId && origin === init.origin) {
-                var c = cookie.split('/');
-                if (sessionState === c[2]) {
+            if (clientId == init.clientId && origin == init.origin) {
+                var cookie = getCookie();
+                if (sessionState == cookie) {
                     callback('unchanged');
                 } else {
                     callback('changed');
@@ -72,7 +69,7 @@
         for(var i=0; i<ca.length; i++)
         {
             var c = ca[i].trim();
-            if (c.indexOf(name)===0) return c.substring(name.length,c.length);
+            if (c.indexOf(name)==0) return c.substring(name.length,c.length);
         }
         return null;
     }
@@ -82,7 +79,7 @@
         var origin = event.origin;
         var data = event.data.split(' ');
         if (data.length != 2) {
-            return;
+            event.source.postMessage('error', origin);
         }
 
         var clientId = data[0];
@@ -96,4 +93,4 @@
     window.addEventListener("message", receiveMessage, false);
 </script>
 </body>
-</html>
+</html>

adapters/oidc/osgi-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/osgi-adapter/src/main/java/org/keycloak/adapters/osgi/BundleBasedKeycloakConfigResolver.java

@@ -1,83 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.osgi;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.URL;
-
-import org.keycloak.adapters.KeycloakConfigResolver;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.osgi.framework.BundleContext;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class BundleBasedKeycloakConfigResolver implements KeycloakConfigResolver {
-
-    private volatile KeycloakDeployment cachedDeployment;
-
-    private BundleContext bundleContext;
-    private String configLocation = "WEB-INF/keycloak.json";
-
-    public BundleContext getBundleContext() {
-        return bundleContext;
-    }
-
-    public void setBundleContext(BundleContext bundleContext) {
-        this.bundleContext = bundleContext;
-    }
-
-    public String getConfigLocation() {
-        return configLocation;
-    }
-
-    public void setConfigLocation(String configLocation) {
-        this.configLocation = configLocation;
-    }
-
-    @Override
-    public KeycloakDeployment resolve(HttpFacade.Request request) {
-        if (cachedDeployment != null) {
-            return cachedDeployment;
-        } else {
-            cachedDeployment = findDeployment(request);
-            return cachedDeployment;
-        }
-    }
-
-    protected KeycloakDeployment findDeployment(HttpFacade.Request request) {
-        if (bundleContext == null) {
-            throw new IllegalStateException("bundleContext must be set for BundleBasedKeycloakConfigResolver!");
-        }
-
-        URL url = bundleContext.getBundle().getResource(configLocation);
-        if (url == null) {
-            throw new IllegalStateException("Failed to find the file " + configLocation + " on classpath.");
-        }
-
-        try {
-            InputStream is = url.openStream();
-            return KeycloakDeploymentBuilder.build(is);
-        } catch (IOException ioe) {
-            throw new IllegalStateException("Error reading file' " + configLocation + "' from bundle classpath.", ioe);
-        }
-    }
-}

adapters/oidc/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>
@@ -41,11 +41,9 @@
         <module>servlet-filter</module>
         <module>servlet-oauth-client</module>
         <module>spring-boot</module>
-        <module>spring-boot-container-bundle</module>
         <module>spring-security</module>
         <module>tomcat</module>
         <module>undertow</module>
         <module>wildfly</module>
-        <module>wildfly-elytron</module>
     </modules>
 </project>

adapters/oidc/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-filter/src/main/java/org/keycloak/adapters/servlet/KeycloakOIDCFilter.java

@@ -53,9 +53,6 @@ import java.util.regex.Pattern;
  * @version $Revision: 1 $
  */
 public class KeycloakOIDCFilter implements Filter {
-
-    public static final String SKIP_PATTERN_PARAM = "keycloak.config.skipPattern";
-
     protected AdapterDeploymentContext deploymentContext;
     protected SessionIdMapper idMapper = new InMemorySessionIdMapper();
     protected NodesRegistrationManagement nodesRegistrationManagement;
@@ -66,7 +63,7 @@ public class KeycloakOIDCFilter implements Filter {
     @Override
     public void init(final FilterConfig filterConfig) throws ServletException {
 
-        String skipPatternDefinition = filterConfig.getInitParameter(SKIP_PATTERN_PARAM);
+        String skipPatternDefinition = filterConfig.getInitParameter("keycloak.config.skipPattern");
         if (skipPatternDefinition != null) {
             skipPattern = Pattern.compile(skipPatternDefinition, Pattern.DOTALL);
         }

adapters/oidc/servlet-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/src/main/java/org/keycloak/servlet/ServletOAuthClient.java

@@ -41,60 +41,12 @@ import java.io.InputStream;
 import java.net.URI;
 import java.util.List;
 
-import org.jboss.logging.Logger;
-import org.keycloak.common.util.Base64Url;
-import java.security.MessageDigest;
-import java.security.SecureRandom;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
 
-	// https://tools.ietf.org/html/rfc7636#section-4
-	private String codeVerifier;
-	private String codeChallenge;
-	private String codeChallengeMethod = OAuth2Constants.PKCE_METHOD_S256;
-	private static Logger logger = Logger.getLogger(ServletOAuthClient.class);
-
-    public static String generateSecret() {
-        return generateSecret(32);
-    }
-
-    public static String generateSecret(int bytes) {
-        byte[] buf = new byte[bytes];
-        new SecureRandom().nextBytes(buf);
-        return Base64Url.encode(buf);
-    }
-
-    private void setCodeVerifier() {
-        codeVerifier = generateSecret();
-        logger.debugf("Generated codeVerifier = %s", codeVerifier);
-        return;
-    }
-
-    private void setCodeChallenge() {
-        try {
-            if (codeChallengeMethod.equals(OAuth2Constants.PKCE_METHOD_S256)) {
-                MessageDigest md = MessageDigest.getInstance("SHA-256");
-                md.update(codeVerifier.getBytes());
-                StringBuilder sb = new StringBuilder();
-                for (byte b : md.digest()) {
-                    String hex = String.format("%02x", b);
-                    sb.append(hex);
-                }
-                codeChallenge = Base64Url.encode(sb.toString().getBytes());
-            } else {
-                codeChallenge = Base64Url.encode(codeVerifier.getBytes());
-            }
-            logger.debugf("Encode codeChallenge = %s, codeChallengeMethod = %s", codeChallenge, codeChallengeMethod);
-        } catch (Exception e) {
-            logger.info("PKCE client side unknown hash algorithm");
-            codeChallenge = Base64Url.encode(codeVerifier.getBytes());
-        }
-    }
-
     /**
      * closes client
      */
@@ -105,15 +57,7 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
     private AccessTokenResponse resolveBearerToken(HttpServletRequest request, String redirectUri, String code) throws IOException, ServerRequest.HttpFailure {
         // Don't send sessionId in oauth clients for now
         KeycloakDeployment resolvedDeployment = resolveDeployment(getDeployment(), request);
-
-        // https://tools.ietf.org/html/rfc7636#section-4
-        if (codeVerifier != null) {
-            logger.debugf("Before sending Token Request, codeVerifier = %s", codeVerifier);
-            return ServerRequest.invokeAccessCodeToToken(resolvedDeployment, code, redirectUri, null, codeVerifier);
-        } else {
-            logger.debug("Before sending Token Request without codeVerifier");
-            return ServerRequest.invokeAccessCodeToToken(resolvedDeployment, code, redirectUri, null);
-        }
+        return ServerRequest.invokeAccessCodeToToken(resolvedDeployment, code, redirectUri, null);
     }
 
     /**
@@ -150,12 +94,6 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
         String authUrl = resolvedDeployment.getAuthUrl().clone().build().toString();
         String scopeParam = TokenUtil.attachOIDCScope(scope);
 
-        // https://tools.ietf.org/html/rfc7636#section-4
-        if (resolvedDeployment.isPkce()) {
-            setCodeVerifier();
-            setCodeChallenge();
-        }
-
         KeycloakUriBuilder uriBuilder =  KeycloakUriBuilder.fromUri(authUrl)
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, getClientId())
@@ -280,11 +218,6 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
                     return servletRequest.getRequestURL().toString();
                 }
 
-                @Override
-                public String getRelativePath() {
-                    return servletRequest.getServletPath();
-                }
-
                 @Override
                 public boolean isSecure() {
                     return servletRequest.isSecure();

adapters/oidc/spring-boot-container-bundle/pom.xml

@@ -1,62 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-    <parent>
-      <artifactId>keycloak-parent</artifactId>
-      <groupId>org.keycloak</groupId>
-      <version>3.1.1.Final-SNAPSHOT</version>
-      <relativePath>../../../pom.xml</relativePath>
-    </parent>
-    <artifactId>spring-boot-container-bundle</artifactId>
-    <packaging>jar</packaging>
-    <dependencies>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-tomcat8-adapter</artifactId>
-            <scope>compile</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-undertow-adapter</artifactId>
-            <scope>compile</scope>
-        </dependency>
-         <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-jetty93-adapter</artifactId>
-            <scope>compile</scope>
-        </dependency>
-    </dependencies>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-shade-plugin</artifactId>
-                <version>2.4.3</version>
-                <executions>
-                    <execution>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>shade</goal>
-                        </goals>
-                        <configuration>
-                            <artifactSet>
-                                <includes>
-                                    <include>org.keycloak:keycloak-tomcat8-adapter</include>
-                                    <include>org.keycloak:keycloak-undertow-adapter</include>
-                                    <include>org.keycloak:keycloak-jetty93-adapter</include>
-                                    <include>org.keycloak:keycloak-tomcat-core-adapter</include>
-                                    <include>org.keycloak:keycloak-tomcat-adapter-spi</include>
-                                    <include>org.keycloak:keycloak-undertow-adapter</include>
-                                    <include>org.keycloak:keycloak-undertow-adapter-spi</include>
-                                    <include>org.keycloak:keycloak-jetty-core</include>
-                                    <include>org.keycloak:keycloak-jetty-adapter-spi</include>
-                                </includes>
-                            </artifactSet>
-                            <createSourcesJar>true</createSourcesJar>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
-    </build>
-</project>

adapters/oidc/spring-boot/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>3.1.1.Final-SNAPSHOT</version>
+    <version>2.3.0.Final</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>
@@ -31,7 +31,7 @@
   <description/>
 
   <properties>
-    <spring-boot.version>1.3.0.RELEASE</spring-boot.version>
+    <spring-boot.version>1.2.1.RELEASE</spring-boot.version>
   </properties>
 
   <dependencies>
@@ -43,67 +43,74 @@
       <groupId>org.keycloak</groupId>
       <artifactId>keycloak-core</artifactId>
     </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>spring-boot-container-bundle</artifactId>
-      <version>${project.version}</version>
-      <optional>true</optional>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-security-adapter</artifactId>
-      <version>${project.version}</version>
-      <scope>compile</scope>
 
+    <dependency>
+      <groupId>org.keycloak</groupId>
+      <artifactId>keycloak-tomcat8-adapter</artifactId>
+      <scope>provided</scope>
     </dependency>
+    <dependency>
+      <groupId>org.keycloak</groupId>
+      <artifactId>keycloak-undertow-adapter</artifactId>
+      <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.keycloak</groupId>
+      <artifactId>keycloak-jetty92-adapter</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-web</artifactId>
       <version>${spring-boot.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>io.undertow</groupId>
-      <artifactId>undertow-servlet</artifactId>
-      <scope>compile</scope>
-      <optional>true</optional>
+      <scope>provided</scope>
     </dependency>
+
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-server</artifactId>
       <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
+      <scope>provided</scope>
     </dependency>
 
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-security</artifactId>
       <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
+      <scope>provided</scope>
     </dependency>
 
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
       <artifactId>jetty-webapp</artifactId>
       <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
+      <scope>provided</scope>
     </dependency>
+
+    <dependency>
+      <groupId>io.undertow</groupId>
+      <artifactId>undertow-servlet</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>io.undertow</groupId>
+      <artifactId>undertow-core</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
+    <dependency>
+      <groupId>org.keycloak</groupId>
+      <artifactId>keycloak-undertow-adapter-spi</artifactId>
+      <scope>provided</scope>
+    </dependency>
+
     <dependency>
       <groupId>junit</groupId>
       <artifactId>junit</artifactId>
       <scope>test</scope>
     </dependency>
-     <dependency>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-configuration-processor</artifactId>
-        <optional>true</optional>
-        <version>${spring-boot.version}</version>
-     </dependency>
   </dependencies>
   <build>
     <plugins>
@@ -111,10 +118,11 @@
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>
         <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
+          <source>1.6</source>
+          <target>1.6</target>
         </configuration>
       </plugin>
     </plugins>
   </build>
+
 </project>

adapters/oidc/spring-boot/src/main/java/org/keycloak/adapters/springboot/KeycloakSpringBootConfiguration.java

@@ -60,7 +60,7 @@ import java.util.Set;
 @Configuration
 @ConditionalOnWebApplication
 @EnableConfigurationProperties(KeycloakSpringBootProperties.class)
-public class KeycloakAutoConfiguration {
+public class KeycloakSpringBootConfiguration {
 
     private KeycloakSpringBootProperties keycloakProperties;
 
@@ -70,7 +70,6 @@ public class KeycloakAutoConfiguration {
         KeycloakSpringBootConfigResolver.setAdapterConfig(keycloakProperties);
     }
 
-
     @Bean
     public EmbeddedServletContainerCustomizer getKeycloakContainerCustomizer() {
         return new EmbeddedServletContainerCustomizer() {
@@ -142,11 +141,11 @@ public class KeycloakAutoConfiguration {
             List<io.undertow.servlet.api.SecurityConstraint> undertowSecurityConstraints = new ArrayList<io.undertow.servlet.api.SecurityConstraint>();
             for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
 
-                io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
-                undertowSecurityConstraint.addRolesAllowed(constraintDefinition.getAuthRoles());
-
                 for (KeycloakSpringBootProperties.SecurityCollection collectionDefinition : constraintDefinition.getSecurityCollections()) {
 
+                    io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
+                    undertowSecurityConstraint.addRolesAllowed(collectionDefinition.getAuthRoles());
+
                     WebResourceCollection webResourceCollection = new WebResourceCollection();
                     webResourceCollection.addHttpMethods(collectionDefinition.getMethods());
                     webResourceCollection.addHttpMethodOmissions(collectionDefinition.getOmittedMethods());
@@ -154,9 +153,8 @@ public class KeycloakAutoConfiguration {
 
                     undertowSecurityConstraint.addWebResourceCollections(webResourceCollection);
 
+                    undertowSecurityConstraints.add(undertowSecurityConstraint);
                 }
-
-                undertowSecurityConstraints.add(undertowSecurityConstraint);
             }
             return undertowSecurityConstraints;
         }
@@ -176,76 +174,48 @@ public class KeycloakAutoConfiguration {
             KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
             keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
 
-            /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
-               on how to map servlet spec to Constraints */
-
             List<ConstraintMapping> jettyConstraintMappings = new ArrayList<ConstraintMapping>();
             for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
 
                 for (KeycloakSpringBootProperties.SecurityCollection securityCollectionDefinition : constraintDefinition
                         .getSecurityCollections()) {
-                    // securityCollection matches servlet spec's web-resource-collection
+
                     Constraint jettyConstraint = new Constraint();
-
-                    if (constraintDefinition.getAuthRoles().size() > 0) {
-                        jettyConstraint.setAuthenticate(true);
-                        jettyConstraint.setRoles(constraintDefinition.getAuthRoles().toArray(new String[0]));
-                    }
-
                     jettyConstraint.setName(securityCollectionDefinition.getName());
+                    jettyConstraint.setAuthenticate(true);
 
-                    // according to the servlet spec each security-constraint has at least one URL pattern
-                    for(String pattern : securityCollectionDefinition.getPatterns()) {
-
-                        /* the following code is asymmetric as Jetty's ConstraintMapping accepts only one allowed HTTP method,
-                           but multiple omitted methods. Therefore we add one ConstraintMapping for each allowed
-                           mapping but only one mapping in the cases of omitted methods or no methods.
-                         */
-
-                        if (securityCollectionDefinition.getMethods().size() > 0) {
-                            // according to the servlet spec we have either methods ...
-                            for(String method : securityCollectionDefinition.getMethods()) {
-                                ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                                jettyConstraintMappings.add(jettyConstraintMapping);
-
-                                jettyConstraintMapping.setConstraint(jettyConstraint);
-                                jettyConstraintMapping.setPathSpec(pattern);
-                                jettyConstraintMapping.setMethod(method);
-                            }
-                        } else if (securityCollectionDefinition.getOmittedMethods().size() > 0){
-                            // ... omitted methods ...
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                            jettyConstraintMapping.setMethodOmissions(
-                                    securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
-                        } else {
-                            // ... or no methods at all
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                        }
-
+                    if (securityCollectionDefinition.getName() != null) {
+                        jettyConstraint.setName(securityCollectionDefinition.getName());
                     }
 
+                    jettyConstraint.setRoles(securityCollectionDefinition.getAuthRoles().toArray(new String[0]));
+
+                    ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                    if (securityCollectionDefinition.getPatterns().size() > 0) {
+                        //First pattern wins
+                        jettyConstraintMapping.setPathSpec(securityCollectionDefinition.getPatterns().get(0));
+                        jettyConstraintMapping.setConstraint(jettyConstraint);
+                    }
+
+                    if (securityCollectionDefinition.getMethods().size() > 0) {
+                        //First method wins
+                        jettyConstraintMapping.setMethod(securityCollectionDefinition.getMethods().get(0));
+                    }
+
+                    jettyConstraintMapping.setMethodOmissions(
+                            securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
+
+                    jettyConstraintMappings.add(jettyConstraintMapping);
                 }
             }
 
             WebAppContext webAppContext = server.getBean(WebAppContext.class);
-            //if not found as registered bean let's try the handler
-            if(webAppContext==null){
-                webAppContext = (WebAppContext) server.getHandler();
-            }
 
             ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
             securityHandler.setConstraintMappings(jettyConstraintMappings);
             securityHandler.setAuthenticator(keycloakJettyAuthenticator);
 
-            webAppContext.setSecurityHandler(securityHandler);
+            webAppContext.setHandler(securityHandler);
         }
     }
 
@@ -265,10 +235,12 @@ public class KeycloakAutoConfiguration {
 
             Set<String> authRoles = new HashSet<String>();
             for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
-                for (String authRole : constraint.getAuthRoles()) {
-                    if (!authRoles.contains(authRole)) {
-                        context.addSecurityRole(authRole);
-                        authRoles.add(authRole);
+                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
+                    for (String authRole : collection.getAuthRoles()) {
+                        if (!authRoles.contains(authRole)) {
+                            context.addSecurityRole(authRole);
+                            authRoles.add(authRole);
+                        }
                     }
                 }
             }
@@ -276,10 +248,6 @@ public class KeycloakAutoConfiguration {
             for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
                 SecurityConstraint tomcatConstraint = new SecurityConstraint();
 
-                for (String authRole : constraint.getAuthRoles()) {
-                    tomcatConstraint.addAuthRole(authRole);
-                }
-
                 for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
                     SecurityCollection tomcatSecCollection = new SecurityCollection();
 
@@ -290,6 +258,10 @@ public class KeycloakAutoConfiguration {
                         tomcatSecCollection.setDescription(collection.getDescription());
                     }
 
+                    for (String authRole : collection.getAuthRoles()) {
+                        tomcatConstraint.addAuthRole(authRole);
+                    }
+
                     for (String pattern : collection.getPatterns()) {
                         tomcatSecCollection.addPattern(pattern);
                     }

adapters/oidc/spring-boot/src/main/java/org/keycloak/adapters/springboot/KeycloakSpringBootProperties.java

@@ -38,25 +38,10 @@ public class KeycloakSpringBootProperties extends AdapterConfig {
         return config;
     }
 
-    /**
-     * To provide Java EE security constraints
-     */
     private List<SecurityConstraint> securityConstraints = new ArrayList<SecurityConstraint>();
 
-    /**
-     * This matches security-constraint of the servlet spec
-     */
-    @ConfigurationProperties()
     public static class SecurityConstraint {
-        /**
-         * A list of security collections
-         */
         private List<SecurityCollection> securityCollections = new ArrayList<SecurityCollection>();
-        private List<String> authRoles = new ArrayList<String>();
-
-        public List<String> getAuthRoles() {
-            return authRoles;
-        }
 
         public List<SecurityCollection> getSecurityCollections() {
             return securityCollections;
@@ -65,39 +50,20 @@ public class KeycloakSpringBootProperties extends AdapterConfig {
         public void setSecurityCollections(List<SecurityCollection> securityCollections) {
             this.securityCollections = securityCollections;
         }
-
-        public void setAuthRoles(List<String> authRoles) {
-            this.authRoles = authRoles;
-        }
-
     }
 
-    /**
-     * This matches web-resource-collection of the servlet spec
-     */
-    @ConfigurationProperties()
     public static class SecurityCollection {
-        /**
-         * The name of your security constraint
-         */
         private String name;
-        /**
-         * The description of your security collection
-         */
         private String description;
-        /**
-         * A list of URL patterns that should match to apply the security collection
-         */
+        private List<String> authRoles = new ArrayList<String>();
         private List<String> patterns = new ArrayList<String>();
-        /**
-         * A list of HTTP methods that applies for this security collection
-         */
         private List<String> methods = new ArrayList<String>();
-        /**
-         * A list of HTTP methods that will be omitted for this security collection
-         */
         private List<String> omittedMethods = new ArrayList<String>();
 
+        public List<String> getAuthRoles() {
+            return authRoles;
+        }
+
         public List<String> getPatterns() {
             return patterns;
         }
@@ -126,6 +92,10 @@ public class KeycloakSpringBootProperties extends AdapterConfig {
             this.description = description;
         }
 
+        public void setAuthRoles(List<String> authRoles) {
+            this.authRoles = authRoles;
+        }
+
         public void setPatterns(List<String> patterns) {
             this.patterns = patterns;
         }

adapters/oidc/spring-boot/src/main/resources/META-INF/spring.factories

@@ -1,2 +1,2 @@
 org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.keycloak.adapters.springboot.KeycloakAutoConfiguration
+org.keycloak.adapters.springboot.KeycloakSpringBootConfiguration

adapters/oidc/spring-security/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -59,14 +59,12 @@
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-config</artifactId>
             <version>${spring-security.version}</version>
-               <optional>true</optional>
             <scope>compile</scope>
         </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-web</artifactId>
             <version>${spring-security.version}</version>
-               <optional>true</optional>
             <scope>compile</scope>
         </dependency>
         <dependency>

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/KeycloakAuthenticationEntryPoint.java

@@ -30,12 +30,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext;
 
 /**
  * Provides a Keycloak {@link AuthenticationEntryPoint authentication entry point}. Uses a
@@ -62,15 +56,12 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
     private final RequestMatcher apiRequestMatcher;
     private String loginUri = DEFAULT_LOGIN_URI;
     private String realm = DEFAULT_REALM;
- 
-    private AdapterDeploymentContext adapterDeploymentContext;
 
     /**
      * Creates a new Keycloak authentication entry point.
      */
-    public KeycloakAuthenticationEntryPoint(AdapterDeploymentContext adapterDeploymentContext) {
+    public KeycloakAuthenticationEntryPoint() {
         this(DEFAULT_API_REQUEST_MATCHER);
-        this.adapterDeploymentContext = adapterDeploymentContext;
     }
 
     /**
@@ -88,8 +79,7 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
     @Override
     public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException
     {
-        HttpFacade facade = new SimpleHttpFacade(request, response);
-        if (apiRequestMatcher.matches(request) || adapterDeploymentContext.resolveDeployment(facade).isBearerOnly()) {
+        if (apiRequestMatcher.matches(request)) {
             commenceUnauthorizedResponse(request, response);
         } else {
             commenceLoginRedirect(request, response);

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/config/KeycloakWebSecurityConfigurerAdapter.java

@@ -71,8 +71,8 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
         return factoryBean.getObject();
     }
 
-    protected AuthenticationEntryPoint authenticationEntryPoint() throws Exception {
-        return new KeycloakAuthenticationEntryPoint(adapterDeploymentContext());
+    protected AuthenticationEntryPoint authenticationEntryPoint() {
+        return new KeycloakAuthenticationEntryPoint();
     }
 
     protected KeycloakAuthenticationProvider keycloakAuthenticationProvider() {

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/facade/WrappedHttpServletRequest.java

@@ -70,11 +70,6 @@ class WrappedHttpServletRequest implements Request {
         return buf.toString();
     }
 
-    @Override
-    public String getRelativePath() {
-        return request.getServletPath();
-    }
-
     @Override
     public boolean isSecure() {
         return request.isSecure();

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakAuthenticatedActionsFilter.java

@@ -1,90 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springsecurity.filter;
-
-import java.io.IOException;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.AuthenticatedActionsHandler;
-import org.keycloak.adapters.NodesRegistrationManagement;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.web.filter.GenericFilterBean;
-
-/**
- * Exposes a Keycloak adapter {@link AuthenticatedActionsHandler} as a Spring Security filter.
- *
- * @author <a href="mailto:srossillo@smartling.com">Scott Rossillo</a>
- * @version $Revision: 1 $
- */
-public class KeycloakAuthenticatedActionsFilter extends GenericFilterBean implements ApplicationContextAware {
-
-    private static final Logger log = LoggerFactory.getLogger(KeycloakAuthenticatedActionsFilter.class);
-
-    private final NodesRegistrationManagement management = new NodesRegistrationManagement();
-    private ApplicationContext applicationContext;
-    private AdapterDeploymentContext deploymentContext;
-
-    
-    public KeycloakAuthenticatedActionsFilter() {
-        super();
-    }
-
-    @Override
-    protected void initFilterBean() throws ServletException {
-        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
-    }
-
-    @Override
-    public void destroy() {
-        log.debug("Unregistering deployment");
-        management.stop();
-    }
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-            throws IOException, ServletException {
-
-        HttpFacade facade = new SimpleHttpFacade((HttpServletRequest)request, (HttpServletResponse)response);
-        AuthenticatedActionsHandler handler = new AuthenticatedActionsHandler(deploymentContext.resolveDeployment(facade), (OIDCHttpFacade)facade);
-        boolean handled = handler.handledRequest();
-        if (handled) {
-            log.debug("Authenticated filter handled request: {}", ((HttpServletRequest) request).getRequestURI());
-        } else {
-            chain.doFilter(request, response);
-        }
-    }
-
-    @Override
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        this.applicationContext = applicationContext;
-    }
-}

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakAuthenticationProcessingFilter.java

@@ -142,7 +142,6 @@ public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticati
         if (AuthOutcome.FAILED.equals(result)) {
             throw new KeycloakAuthenticationException("Auth outcome: " + result);
         }
-       
         else if (AuthOutcome.AUTHENTICATED.equals(result)) {
             Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
             Assert.notNull(authentication, "Authentication SecurityContextHolder was null");

adapters/oidc/spring-security/src/test/java/org/keycloak/adapters/springsecurity/authentication/KeycloakAuthenticationEntryPointTest.java

@@ -26,15 +26,6 @@ import org.springframework.mock.web.MockHttpServletResponse;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.spi.HttpFacade;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.eq;
-import org.mockito.Mock;
-import static org.mockito.Mockito.when;
-import org.mockito.MockitoAnnotations;
-import org.springframework.context.ApplicationContext;
 
 /**
  * Keycloak authentication entry point tests.
@@ -44,24 +35,12 @@ public class KeycloakAuthenticationEntryPointTest {
     private KeycloakAuthenticationEntryPoint authenticationEntryPoint;
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
-    @Mock
-    private ApplicationContext applicationContext;
-   
-    @Mock
-    private AdapterDeploymentContext adapterDeploymentContext;
-    
-    @Mock
-    private KeycloakDeployment keycloakDeployment;
 
     @Before
     public void setUp() throws Exception {
-        MockitoAnnotations.initMocks(this);
-        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint(adapterDeploymentContext);
+        authenticationEntryPoint = new KeycloakAuthenticationEntryPoint();
         request = new MockHttpServletRequest();
         response = new MockHttpServletResponse();
-        when(applicationContext.getBean(eq(AdapterDeploymentContext.class))).thenReturn(adapterDeploymentContext);
-        when(adapterDeploymentContext.resolveDeployment(any(HttpFacade.class))).thenReturn(keycloakDeployment);
-        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
     }
 
     @Test

adapters/oidc/spring-security/src/test/java/org/keycloak/adapters/springsecurity/filter/KeycloakAuthenticationProcessingFilterTest.java

@@ -154,7 +154,6 @@ public class KeycloakAuthenticationProcessingFilterTest {
         when(keycloakDeployment.getResourceName()).thenReturn("resource-name");
         when(keycloakDeployment.getStateCookieName()).thenReturn("kc-cookie");
         when(keycloakDeployment.getSslRequired()).thenReturn(SslRequired.NONE);
-        when(keycloakDeployment.isBearerOnly()).thenReturn(Boolean.FALSE);
         filter.attemptAuthentication(request, response);
 
         verify(response).setStatus(302);

adapters/oidc/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Tomcat Integration</name>
@@ -32,21 +32,8 @@
 
     <modules>
         <module>tomcat-core</module>
+        <module>tomcat6</module>
+        <module>tomcat7</module>
         <module>tomcat8</module>
     </modules>
-
-    <profiles>
-        <profile>
-            <id>community</id>
-            <activation>
-                <property>
-                    <name>!product</name>
-                </property>
-            </activation>
-            <modules>
-                <module>tomcat6</module>
-                <module>tomcat7</module>
-            </modules>
-        </profile>
-    </profiles>
 </project>

adapters/oidc/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>3.1.1.Final-SNAPSHOT</version>
+		<version>2.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -29,6 +29,8 @@
 	<artifactId>keycloak-tomcat-core-adapter</artifactId>
 	<name>Keycloak Tomcat Core Integration</name>
     <properties>
+        <!-- <tomcat.version>8.0.14</tomcat.version> -->
+        <!-- <tomcat.version>7.0.52</tomcat.version> -->
         <tomcat.version>6.0.41</tomcat.version>
     </properties>
 	<description />

adapters/oidc/tomcat/tomcat-core/src/main/java/org/keycloak/adapters/tomcat/AbstractKeycloakAuthenticatorValve.java

@@ -25,7 +25,6 @@ import org.apache.catalina.Manager;
 import org.apache.catalina.authenticator.FormAuthenticator;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
-import org.jboss.logging.Logger;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AdapterTokenStore;
@@ -49,6 +48,8 @@ import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.InputStream;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 
 /**
  * Keycloak authentication valve
@@ -61,7 +62,7 @@ public abstract class AbstractKeycloakAuthenticatorValve extends FormAuthenticat
 
     public static final String TOKEN_STORE_NOTE = "TOKEN_STORE_NOTE";
 
-	private final static Logger log = Logger.getLogger(AbstractKeycloakAuthenticatorValve.class);
+	private final static Logger log = Logger.getLogger(""+AbstractKeycloakAuthenticatorValve.class);
 	protected CatalinaUserSessionManagement userSessionManagement = new CatalinaUserSessionManagement();
     protected AdapterDeploymentContext deploymentContext;
     protected NodesRegistrationManagement nodesRegistrationManagement;
@@ -117,22 +118,22 @@ public abstract class AbstractKeycloakAuthenticatorValve extends FormAuthenticat
             try {
                 KeycloakConfigResolver configResolver = (KeycloakConfigResolver) context.getLoader().getClassLoader().loadClass(configResolverClass).newInstance();
                 deploymentContext = new AdapterDeploymentContext(configResolver);
-                log.debugv("Using {0} to resolve Keycloak configuration on a per-request basis.", configResolverClass);
+                log.log(Level.INFO, "Using {0} to resolve Keycloak configuration on a per-request basis.", configResolverClass);
             } catch (Exception ex) {
-                log.errorv("The specified resolver {0} could NOT be loaded. Keycloak is unconfigured and will deny all requests. Reason: {1}", configResolverClass, ex.getMessage());
+                log.log(Level.FINE, "The specified resolver {0} could NOT be loaded. Keycloak is unconfigured and will deny all requests. Reason: {1}", new Object[]{configResolverClass, ex.getMessage()});
                 deploymentContext = new AdapterDeploymentContext(new KeycloakDeployment());
             }
         } else {
             InputStream configInputStream = getConfigInputStream(context);
             KeycloakDeployment kd;
             if (configInputStream == null) {
-                log.warn("No adapter configuration. Keycloak is unconfigured and will deny all requests.");
+                log.fine("No adapter configuration. Keycloak is unconfigured and will deny all requests.");
                 kd = new KeycloakDeployment();
             } else {
                 kd = KeycloakDeploymentBuilder.build(configInputStream);
             }
             deploymentContext = new AdapterDeploymentContext(kd);
-            log.debug("Keycloak is using a per-deployment configuration.");
+            log.fine("Keycloak is using a per-deployment configuration.");
         }
 
         context.getServletContext().setAttribute(AdapterDeploymentContext.class.getName(), deploymentContext);
@@ -148,7 +149,8 @@ public abstract class AbstractKeycloakAuthenticatorValve extends FormAuthenticat
         if (json == null) {
             return null;
         }
-        log.trace("**** using " + AdapterConstants.AUTH_DATA_PARAM_NAME);
+        log.finest("**** using " + AdapterConstants.AUTH_DATA_PARAM_NAME);
+        log.finest(json);
         return new ByteArrayInputStream(json.getBytes());
     }
 
@@ -157,13 +159,13 @@ public abstract class AbstractKeycloakAuthenticatorValve extends FormAuthenticat
         if (is == null) {
             String path = context.getServletContext().getInitParameter("keycloak.config.file");
             if (path == null) {
-                log.trace("**** using /WEB-INF/keycloak.json");
+                log.finest("**** using /WEB-INF/keycloak.json");
                 is = context.getServletContext().getResourceAsStream("/WEB-INF/keycloak.json");
             } else {
                 try {
                     is = new FileInputStream(path);
                 } catch (FileNotFoundException e) {
-                    log.errorv("NOT FOUND {0}", path);
+                    log.log(Level.SEVERE, "NOT FOUND {0}", path);
                     throw new RuntimeException(e);
                 }
             }
@@ -194,8 +196,6 @@ public abstract class AbstractKeycloakAuthenticatorValve extends FormAuthenticat
         CatalinaHttpFacade facade = new OIDCCatalinaHttpFacade(request, response);
         KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
         if (deployment == null || !deployment.isConfigured()) {
-            //needed for the EAP6/AS7 adapter relying on the tomcat core adapter
-            facade.getResponse().sendError(401);
             return false;
         }
         AdapterTokenStore tokenStore = getTokenStore(request, facade, deployment);

adapters/oidc/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>3.1.1.Final-SNAPSHOT</version>
+		<version>2.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>3.1.1.Final-SNAPSHOT</version>
+		<version>2.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>3.1.1.Final-SNAPSHOT</version>
+		<version>2.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat8/src/main/java/org/keycloak/adapters/tomcat/KeycloakAuthenticatorValve.java

@@ -39,20 +39,9 @@ import java.util.List;
  * @version $Revision: 1 $
  */
 public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorValve {
-    
-    /**
-     * Method called by Tomcat < 8.5.5
-     */
     public boolean authenticate(Request request, HttpServletResponse response) throws IOException {
        return authenticateInternal(request, response, request.getContext().getLoginConfig());
     }
-    
-    /**
-     * Method called by Tomcat >= 8.5.5
-     */
-    protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException {
-       return this.authenticate(request, response);
-    }
 
     @Override
     protected boolean forwardToErrorPageInternal(Request request, HttpServletResponse response, Object loginConfig) throws IOException {

adapters/oidc/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
+        <version>2.3.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/undertow/src/main/java/org/keycloak/adapters/undertow/AbstractUndertowKeycloakAuthMech.java

@@ -92,7 +92,7 @@ public abstract class AbstractUndertowKeycloakAuthMech implements Authentication
                 UndertowHttpFacade facade = createFacade(exchange);
                 KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
                 KeycloakSecurityContext ksc = exchange.getAttachment(OIDCUndertowHttpFacade.KEYCLOAK_SECURITY_CONTEXT_KEY);
-                if (!deployment.isBearerOnly() && ksc != null && ksc instanceof RefreshableKeycloakSecurityContext) {
+                if (ksc != null && ksc instanceof RefreshableKeycloakSecurityContext) {
                     ((RefreshableKeycloakSecurityContext) ksc).logout(deployment);
                 }
                 AdapterTokenStore tokenStore = getTokenStore(exchange, facade, deployment, securityContext);

adapters/oidc/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java

@@ -173,15 +173,10 @@ public class KeycloakServletExtension implements ServletExtension {
             }
         });
 
-        ServletSessionConfig cookieConfig = deploymentInfo.getServletSessionConfig();
-        if (cookieConfig == null) {
-            cookieConfig = new ServletSessionConfig();
-        }
-        if (cookieConfig.getPath() == null) {
-            log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
-            cookieConfig.setPath(deploymentInfo.getContextPath());
-            deploymentInfo.setServletSessionConfig(cookieConfig);
-        }
+        log.debug("Setting jsession cookie path to: " + deploymentInfo.getContextPath());
+        ServletSessionConfig cookieConfig = new ServletSessionConfig();
+        cookieConfig.setPath(deploymentInfo.getContextPath());
+        deploymentInfo.setServletSessionConfig(cookieConfig);
         ChangeSessionId.turnOffChangeSessionIdOnLogin(deploymentInfo);
         deploymentInfo.addListener(new ListenerInfo(UndertowNodesRegistrationManagementWrapper.class, new InstanceFactory<UndertowNodesRegistrationManagementWrapper>() {
 

adapters/oidc/wildfly-elytron/pom.xml

@@ -1,99 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ JBoss, Home of Professional Open Source.
-  ~ Copyright 2016 Red Hat, Inc., and individual contributors
-  ~ as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~     http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <parent>
-        <artifactId>keycloak-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>3.1.1.Final-SNAPSHOT</version>
-        <relativePath>../../../pom.xml</relativePath>
-    </parent>
-    <modelVersion>4.0.0</modelVersion>
-
-    <artifactId>keycloak-wildfly-elytron-oidc-adapter</artifactId>
-    <name>Keycloak Wildfly Elytron OIDC Adapter</name>
-    <description/>
-
-    <properties>
-        <maven.compiler.target>1.8</maven.compiler.target>
-        <maven.compiler.source>1.8</maven.compiler.source>
-    </properties>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.wildfly.common</groupId>
-            <artifactId>wildfly-common</artifactId>
-            <version>1.2.0.Beta1</version>
-        </dependency>
-        <dependency>
-            <groupId>org.wildfly.security</groupId>
-            <artifactId>wildfly-elytron</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.wildfly.security.elytron-web</groupId>
-            <artifactId>undertow-server</artifactId>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.logging</groupId>
-            <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
-            <scope>provided</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-adapter-spi</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-adapter-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpclient</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.spec.javax.servlet</groupId>
-            <artifactId>jboss-servlet-api_3.0_spec</artifactId>
-            <scope>provided</scope>
-        </dependency>
-    </dependencies>
-</project>

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronAccount.java

@@ -1,103 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import org.jboss.logging.Logger;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.OidcKeycloakAccount;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.wildfly.security.auth.server.SecurityIdentity;
-
-import javax.security.auth.callback.CallbackHandler;
-import java.security.Principal;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ElytronAccount implements OidcKeycloakAccount {
-
-    protected static Logger log = Logger.getLogger(ElytronAccount.class);
-
-    private final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal;
-
-    public ElytronAccount(KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal) {
-        this.principal = principal;
-    }
-
-    @Override
-    public RefreshableKeycloakSecurityContext getKeycloakSecurityContext() {
-        return principal.getKeycloakSecurityContext();
-    }
-
-    @Override
-    public Principal getPrincipal() {
-        return principal;
-    }
-
-    @Override
-    public Set<String> getRoles() {
-        Set<String> roles = new HashSet<>();
-
-        return roles;
-    }
-
-    void setCurrentRequestInfo(KeycloakDeployment deployment, AdapterTokenStore tokenStore) {
-        principal.getKeycloakSecurityContext().setCurrentRequestInfo(deployment, tokenStore);
-    }
-
-    public boolean checkActive() {
-        RefreshableKeycloakSecurityContext session = getKeycloakSecurityContext();
-
-        if (session.isActive() && !session.getDeployment().isAlwaysRefreshToken()) {
-            log.debug("session is active");
-            return true;
-        }
-
-        log.debug("session not active");
-
-        return false;
-    }
-
-    boolean tryRefresh(CallbackHandler callbackHandler) {
-        log.debug("Trying to refresh");
-
-        RefreshableKeycloakSecurityContext securityContext = getKeycloakSecurityContext();
-
-        if (securityContext == null) {
-            log.debug("No security context. Aborting refresh.");
-        }
-
-        if (securityContext.refreshExpiredToken(false)) {
-            SecurityIdentity securityIdentity = SecurityIdentityUtil.authorize(callbackHandler, principal);
-
-            if (securityIdentity != null) {
-                log.debug("refresh succeeded");
-                return true;
-            }
-
-            return false;
-        }
-
-        return checkActive();
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronCookieTokenStore.java

@@ -1,164 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import java.security.Principal;
-
-import org.jboss.logging.Logger;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.CookieTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.OidcKeycloakAccount;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.RequestAuthenticator;
-import org.wildfly.security.http.HttpScope;
-import org.wildfly.security.http.Scope;
-
-import javax.security.auth.callback.CallbackHandler;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ElytronCookieTokenStore implements ElytronTokeStore {
-
-    protected static Logger log = Logger.getLogger(ElytronCookieTokenStore.class);
-
-    private final ElytronHttpFacade httpFacade;
-    private final CallbackHandler callbackHandler;
-
-    public ElytronCookieTokenStore(ElytronHttpFacade httpFacade, CallbackHandler callbackHandler) {
-        this.httpFacade = httpFacade;
-        this.callbackHandler = callbackHandler;
-    }
-
-    @Override
-    public void checkCurrentToken() {
-        KeycloakDeployment deployment = httpFacade.getDeployment();
-        KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = CookieTokenStore.getPrincipalFromCookie(deployment, httpFacade, this);
-
-        if (principal == null) {
-            return;
-        }
-
-        RefreshableKeycloakSecurityContext securityContext = principal.getKeycloakSecurityContext();
-
-        if (securityContext.isActive() && !securityContext.getDeployment().isAlwaysRefreshToken()) return;
-
-        // FYI: A refresh requires same scope, so same roles will be set.  Otherwise, refresh will fail and token will
-        // not be updated
-        boolean success = securityContext.refreshExpiredToken(false);
-        if (success && securityContext.isActive()) return;
-
-        saveAccountInfo(new ElytronAccount(principal));
-    }
-
-    @Override
-    public boolean isCached(RequestAuthenticator authenticator) {
-        KeycloakDeployment deployment = httpFacade.getDeployment();
-        KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = CookieTokenStore.getPrincipalFromCookie(deployment, httpFacade, this);
-        if (principal == null) {
-            log.debug("Account was not in cookie or was invalid, returning null");
-            return false;
-        }
-        ElytronAccount account = new ElytronAccount(principal);
-
-        if (!deployment.getRealm().equals(account.getKeycloakSecurityContext().getRealm())) {
-            log.debug("Account in session belongs to a different realm than for this request.");
-            return false;
-        }
-
-        boolean active = account.checkActive();
-
-        if (!active) {
-            active = account.tryRefresh(this.callbackHandler);
-        }
-
-        if (active) {
-            log.debug("Cached account found");
-            restoreRequest();
-            httpFacade.authenticationComplete(account, true);
-            return true;
-        } else {
-            log.debug("Account was not active, removing cookie and returning false");
-            CookieTokenStore.removeCookie(httpFacade);
-            return false;
-        }
-    }
-
-    @Override
-    public void saveAccountInfo(OidcKeycloakAccount account) {
-        RefreshableKeycloakSecurityContext secContext = (RefreshableKeycloakSecurityContext)account.getKeycloakSecurityContext();
-        CookieTokenStore.setTokenCookie(this.httpFacade.getDeployment(), this.httpFacade, secContext);
-        HttpScope exchange = this.httpFacade.getScope(Scope.EXCHANGE);
-
-        exchange.registerForNotification(httpServerScopes -> logout());
-
-        exchange.setAttachment(ElytronAccount.class.getName(), account);
-        exchange.setAttachment(KeycloakSecurityContext.class.getName(), account.getKeycloakSecurityContext());
-
-        restoreRequest();
-    }
-
-    @Override
-    public void logout() {
-        logout(false);
-    }
-
-    @Override
-    public void refreshCallback(RefreshableKeycloakSecurityContext securityContext) {
-        CookieTokenStore.setTokenCookie(this.httpFacade.getDeployment(), httpFacade, securityContext);
-    }
-
-    @Override
-    public void saveRequest() {
-
-    }
-
-    @Override
-    public boolean restoreRequest() {
-        return false;
-    }
-
-    @Override
-    public void logout(boolean glo) {
-        KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = CookieTokenStore.getPrincipalFromCookie(this.httpFacade.getDeployment(), this.httpFacade, this);
-
-        if (principal == null) {
-            return;
-        }
-
-        CookieTokenStore.removeCookie(this.httpFacade);
-
-        if (glo) {
-            KeycloakSecurityContext ksc = (KeycloakSecurityContext) principal.getKeycloakSecurityContext();
-
-            if (ksc == null) {
-                return;
-            }
-
-            KeycloakDeployment deployment = httpFacade.getDeployment();
-
-            if (!deployment.isBearerOnly() && ksc != null && ksc instanceof RefreshableKeycloakSecurityContext) {
-                ((RefreshableKeycloakSecurityContext) ksc).logout(deployment);
-            }
-        }
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java

@@ -1,394 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import org.bouncycastle.asn1.cmp.Challenge;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.spi.AuthChallenge;
-import org.keycloak.adapters.spi.AuthenticationError;
-import org.keycloak.adapters.spi.LogoutError;
-import org.keycloak.enums.TokenStore;
-import org.wildfly.security.auth.server.SecurityIdentity;
-import org.wildfly.security.http.HttpAuthenticationException;
-import org.wildfly.security.http.HttpScope;
-import org.wildfly.security.http.HttpServerCookie;
-import org.wildfly.security.http.HttpServerMechanismsResponder;
-import org.wildfly.security.http.HttpServerRequest;
-import org.wildfly.security.http.HttpServerResponse;
-import org.wildfly.security.http.Scope;
-
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.cert.X509Certificate;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.io.UnsupportedEncodingException;
-import java.net.InetAddress;
-import java.net.InetSocketAddress;
-import java.net.URI;
-import java.net.URLDecoder;
-import java.util.Collection;
-import java.util.List;
-import java.util.function.Consumer;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-class ElytronHttpFacade implements OIDCHttpFacade {
-
-    private final HttpServerRequest request;
-    private final CallbackHandler callbackHandler;
-    private final AdapterTokenStore tokenStore;
-    private final AdapterDeploymentContext deploymentContext;
-    private Consumer<HttpServerResponse> responseConsumer;
-    private ElytronAccount account;
-    private SecurityIdentity securityIdentity;
-    private boolean restored;
-
-    public ElytronHttpFacade(HttpServerRequest request, AdapterDeploymentContext deploymentContext, CallbackHandler handler) {
-        this.request = request;
-        this.deploymentContext = deploymentContext;
-        this.callbackHandler = handler;
-        this.tokenStore = createTokenStore();
-        this.responseConsumer = response -> {};
-    }
-
-    void authenticationComplete(ElytronAccount account, boolean storeToken) {
-        this.securityIdentity = SecurityIdentityUtil.authorize(this.callbackHandler, account.getPrincipal());
-
-        if (securityIdentity != null) {
-            this.account = account;
-            RefreshableKeycloakSecurityContext keycloakSecurityContext = account.getKeycloakSecurityContext();
-            account.setCurrentRequestInfo(keycloakSecurityContext.getDeployment(), this.tokenStore);
-            if (storeToken) {
-                this.tokenStore.saveAccountInfo(account);
-            }
-        }
-    }
-
-    void authenticationComplete() {
-        if (securityIdentity != null) {
-            this.request.authenticationComplete(response -> {
-                if (!restored) {
-                    responseConsumer.accept(response);
-                }
-            }, () -> ((ElytronTokeStore) tokenStore).logout(true));
-        }
-    }
-
-    void authenticationFailed() {
-        this.request.authenticationFailed("Authentication Failed", response -> responseConsumer.accept(response));
-    }
-
-    void noAuthenticationInProgress() {
-        this.request.noAuthenticationInProgress();
-    }
-
-    void noAuthenticationInProgress(AuthChallenge challenge) {
-        if (challenge != null) {
-            challenge.challenge(this);
-        }
-        this.request.noAuthenticationInProgress(response -> responseConsumer.accept(response));
-    }
-
-    void authenticationInProgress() {
-        this.request.authenticationInProgress(response -> responseConsumer.accept(response));
-    }
-
-    HttpScope getScope(Scope scope) {
-        return request.getScope(scope);
-    }
-
-    HttpScope getScope(Scope scope, String id) {
-        return request.getScope(scope, id);
-    }
-
-    Collection<String> getScopeIds(Scope scope) {
-        return request.getScopeIds(scope);
-    }
-
-    AdapterTokenStore getTokenStore() {
-        return this.tokenStore;
-    }
-
-    KeycloakDeployment getDeployment() {
-        return deploymentContext.resolveDeployment(this);
-    }
-
-    private AdapterTokenStore createTokenStore() {
-        KeycloakDeployment deployment = getDeployment();
-
-        if (TokenStore.SESSION.equals(deployment.getTokenStore())) {
-            return new ElytronSessionTokenStore(this, this.callbackHandler);
-        } else {
-            return new ElytronCookieTokenStore(this, this.callbackHandler);
-        }
-    }
-
-    @Override
-    public Request getRequest() {
-        return new Request() {
-            @Override
-            public String getMethod() {
-                return request.getRequestMethod();
-            }
-
-            @Override
-            public String getURI() {
-                try {
-                    return URLDecoder.decode(request.getRequestURI().toString(), "UTF-8");
-                } catch (UnsupportedEncodingException e) {
-                    throw new RuntimeException("Failed to decode request URI", e);
-                }
-            }
-
-            @Override
-            public String getRelativePath() {
-                return request.getRequestPath();
-            }
-
-            @Override
-            public boolean isSecure() {
-                return request.getRequestURI().getScheme().equals("https");
-            }
-
-            @Override
-            public String getFirstParam(String param) {
-                throw new RuntimeException("Not implemented.");
-            }
-
-            @Override
-            public String getQueryParamValue(String param) {
-                URI requestURI = request.getRequestURI();
-                String query = requestURI.getQuery();
-                if (query != null) {
-                    String[] parameters = query.split("&");
-                    for (String parameter : parameters) {
-                        String[] keyValue = parameter.split("=");
-                        if (keyValue[0].equals(param)) {
-                            return keyValue[1];
-                        }
-                    }
-                }
-                return null;
-            }
-
-            @Override
-            public Cookie getCookie(final String cookieName) {
-                List<HttpServerCookie> cookies = request.getCookies();
-
-                if (cookies != null) {
-                    for (HttpServerCookie cookie : cookies) {
-                        if (cookie.getName().equals(cookieName)) {
-                            return new Cookie(cookie.getName(), cookie.getValue(), cookie.getVersion(), cookie.getDomain(), cookie.getPath());
-                        }
-                    }
-                }
-
-                return null;
-            }
-
-            @Override
-            public String getHeader(String name) {
-                return request.getFirstRequestHeaderValue(name);
-            }
-
-            @Override
-            public List<String> getHeaders(String name) {
-                return request.getRequestHeaderValues(name);
-            }
-
-            @Override
-            public InputStream getInputStream() {
-                return request.getInputStream();
-            }
-
-            @Override
-            public String getRemoteAddr() {
-                InetSocketAddress sourceAddress = request.getSourceAddress();
-                if (sourceAddress == null) {
-                    return "";
-                }
-                InetAddress address = sourceAddress.getAddress();
-                if (address == null) {
-                    // this is unresolved, so we just return the host name not exactly spec, but if the name should be
-                    // resolved then a PeerNameResolvingHandler should be used and this is probably better than just
-                    // returning null
-                    return sourceAddress.getHostString();
-                }
-                return address.getHostAddress();
-            }
-
-            @Override
-            public void setError(AuthenticationError error) {
-                request.getScope(Scope.EXCHANGE).setAttachment(AuthenticationError.class.getName(), error);
-            }
-
-            @Override
-            public void setError(LogoutError error) {
-                request.getScope(Scope.EXCHANGE).setAttachment(LogoutError.class.getName(), error);
-            }
-        };
-    }
-
-    @Override
-    public Response getResponse() {
-        return new Response() {
-            @Override
-            public void setStatus(final int status) {
-                responseConsumer = responseConsumer.andThen(response -> response.setStatusCode(status));
-            }
-
-            @Override
-            public void addHeader(final String name, final String value) {
-                responseConsumer = responseConsumer.andThen(response -> response.addResponseHeader(name, value));
-            }
-
-            @Override
-            public void setHeader(String name, String value) {
-                addHeader(name, value);
-            }
-
-            @Override
-            public void resetCookie(final String name, final String path) {
-                responseConsumer = responseConsumer.andThen(response -> setCookie(name, "", path, null, 0, false, false, response));
-            }
-
-            @Override
-            public void setCookie(final String name, final String value, final String path, final String domain, final int maxAge, final boolean secure, final boolean httpOnly) {
-                responseConsumer = responseConsumer.andThen(response -> setCookie(name, value, path, domain, maxAge, secure, httpOnly, response));
-            }
-
-            private void setCookie(final String name, final String value, final String path, final String domain, final int maxAge, final boolean secure, final boolean httpOnly, HttpServerResponse response) {
-                response.setResponseCookie(new HttpServerCookie() {
-                    @Override
-                    public String getName() {
-                        return name;
-                    }
-
-                    @Override
-                    public String getValue() {
-                        return value;
-                    }
-
-                    @Override
-                    public String getDomain() {
-                        return domain;
-                    }
-
-                    @Override
-                    public int getMaxAge() {
-                        return maxAge;
-                    }
-
-                    @Override
-                    public String getPath() {
-                        return path;
-                    }
-
-                    @Override
-                    public boolean isSecure() {
-                        return secure;
-                    }
-
-                    @Override
-                    public int getVersion() {
-                        return 0;
-                    }
-
-                    @Override
-                    public boolean isHttpOnly() {
-                        return httpOnly;
-                    }
-                });
-            }
-
-            @Override
-            public OutputStream getOutputStream() {
-                ByteArrayOutputStream stream = new ByteArrayOutputStream();
-                responseConsumer = responseConsumer.andThen(new Consumer<HttpServerResponse>() {
-                    @Override
-                    public void accept(HttpServerResponse httpServerResponse) {
-                        try {
-                            httpServerResponse.getOutputStream().write(stream.toByteArray());
-                        } catch (IOException e) {
-                            throw new RuntimeException("Failed to write to response output stream", e);
-                        }
-                    }
-                });
-                return stream;
-            }
-
-            @Override
-            public void sendError(int code) {
-                setStatus(code);
-            }
-
-            @Override
-            public void sendError(final int code, final String message) {
-                responseConsumer = responseConsumer.andThen(response -> {
-                    response.setStatusCode(code);
-                    response.addResponseHeader("Content-Type", "text/html");
-                    try {
-                        response.getOutputStream().write(message.getBytes());
-                    } catch (IOException e) {
-                        throw new RuntimeException(e);
-                    }
-                });
-            }
-
-            @Override
-            public void end() {
-
-            }
-        };
-    }
-
-    @Override
-    public X509Certificate[] getCertificateChain() {
-        return new X509Certificate[0];
-    }
-
-    @Override
-    public KeycloakSecurityContext getSecurityContext() {
-        if (account == null) {
-            return null;
-        }
-        return this.account.getKeycloakSecurityContext();
-    }
-
-    public boolean restoreRequest() {
-        restored = this.request.resumeRequest();
-        return restored;
-    }
-
-    public void suspendRequest() {
-        responseConsumer = responseConsumer.andThen(httpServerResponse -> request.suspendRequest());
-    }
-
-    public boolean isAuthorized() {
-        return this.securityIdentity != null;
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronRequestAuthenticator.java

@@ -1,86 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.adapters.BearerTokenRequestAuthenticator;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.OAuthRequestAuthenticator;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.RequestAuthenticator;
-import org.keycloak.adapters.spi.AuthOutcome;
-import org.wildfly.security.http.HttpScope;
-import org.wildfly.security.http.Scope;
-
-import javax.security.auth.callback.CallbackHandler;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ElytronRequestAuthenticator extends RequestAuthenticator {
-
-    public ElytronRequestAuthenticator(CallbackHandler callbackHandler, ElytronHttpFacade facade, KeycloakDeployment deployment, int sslRedirectPort) {
-        super(facade, deployment, facade.getTokenStore(), sslRedirectPort);
-    }
-
-    @Override
-    public AuthOutcome authenticate() {
-        AuthOutcome authenticate = super.authenticate();
-
-        if (AuthOutcome.AUTHENTICATED.equals(authenticate)) {
-            if (!getElytronHttpFacade().isAuthorized()) {
-                return AuthOutcome.FAILED;
-            }
-        }
-
-        return authenticate;
-    }
-
-    @Override
-    protected OAuthRequestAuthenticator createOAuthAuthenticator() {
-        return new OAuthRequestAuthenticator(this, facade, deployment, sslRedirectPort, tokenStore);
-    }
-
-    @Override
-    protected void completeOAuthAuthentication(final KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal) {
-        getElytronHttpFacade().authenticationComplete(new ElytronAccount(principal), true);
-    }
-
-    @Override
-    protected void completeBearerAuthentication(KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal, String method) {
-        getElytronHttpFacade().authenticationComplete(new ElytronAccount(principal), false);
-    }
-
-    @Override
-    protected String changeHttpSessionId(boolean create) {
-        HttpScope session = getElytronHttpFacade().getScope(Scope.SESSION);
-
-        if (create) {
-            if (!session.exists()) {
-                session.create();
-            }
-        }
-
-        return session != null ? session.getID() : null;
-    }
-
-    private ElytronHttpFacade getElytronHttpFacade() {
-        return (ElytronHttpFacade) facade;
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronSessionTokenStore.java

@@ -1,202 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import java.util.function.Consumer;
-
-import javax.security.auth.callback.CallbackHandler;
-
-import org.jboss.logging.Logger;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.AdapterUtils;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.OidcKeycloakAccount;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.RequestAuthenticator;
-import org.wildfly.security.http.HttpScope;
-import org.wildfly.security.http.HttpScopeNotification;
-import org.wildfly.security.http.Scope;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ElytronSessionTokenStore implements ElytronTokeStore {
-
-    private static Logger log = Logger.getLogger(ElytronSessionTokenStore.class);
-
-    private final ElytronHttpFacade httpFacade;
-    private final CallbackHandler callbackHandler;
-
-    public ElytronSessionTokenStore(ElytronHttpFacade httpFacade, CallbackHandler callbackHandler) {
-        this.httpFacade = httpFacade;
-        this.callbackHandler = callbackHandler;
-    }
-
-    @Override
-    public void checkCurrentToken() {
-        HttpScope session = httpFacade.getScope(Scope.SESSION);
-        if (!session.exists()) return;
-        RefreshableKeycloakSecurityContext securityContext = (RefreshableKeycloakSecurityContext) session.getAttachment(KeycloakSecurityContext.class.getName());
-        if (securityContext == null) return;
-
-        // just in case session got serialized
-        if (securityContext.getDeployment() == null) securityContext.setCurrentRequestInfo(httpFacade.getDeployment(), this);
-
-        if (securityContext.isActive() && !securityContext.getDeployment().isAlwaysRefreshToken()) return;
-
-        // FYI: A refresh requires same scope, so same roles will be set.  Otherwise, refresh will fail and token will
-        // not be updated
-        boolean success = securityContext.refreshExpiredToken(false);
-        if (success && securityContext.isActive()) return;
-
-        // Refresh failed, so user is already logged out from keycloak. Cleanup and expire our session
-        session.setAttachment(KeycloakSecurityContext.class.getName(), null);
-        session.invalidate();
-    }
-
-    @Override
-    public boolean isCached(RequestAuthenticator authenticator) {
-        HttpScope session = this.httpFacade.getScope(Scope.SESSION);
-
-        if (session == null) {
-            log.debug("session was null, returning null");
-            return false;
-        }
-
-        ElytronAccount account;
-
-        try {
-            account = (ElytronAccount) session.getAttachment(ElytronAccount.class.getName());
-        } catch (IllegalStateException e) {
-            log.debug("session was invalidated.  Return false.");
-            return false;
-        }
-        if (account == null) {
-            log.debug("Account was not in session, returning null");
-            return false;
-        }
-
-        KeycloakDeployment deployment = httpFacade.getDeployment();
-
-        if (!deployment.getRealm().equals(account.getKeycloakSecurityContext().getRealm())) {
-            log.debug("Account in session belongs to a different realm than for this request.");
-            return false;
-        }
-
-        boolean active = account.checkActive();
-
-        if (!active) {
-            active = account.tryRefresh(this.callbackHandler);
-        }
-
-        if (active) {
-            log.debug("Cached account found");
-            restoreRequest();
-            httpFacade.authenticationComplete(account, true);
-            return true;
-        } else {
-            log.debug("Refresh failed. Account was not active. Returning null and invalidating Http session");
-            try {
-                session.setAttachment(KeycloakSecurityContext.class.getName(), null);
-                session.setAttachment(ElytronAccount.class.getName(), null);
-                session.invalidate();
-            } catch (Exception e) {
-                log.debug("Failed to invalidate session, might already be invalidated");
-            }
-            return false;
-        }
-    }
-
-    @Override
-    public void saveAccountInfo(OidcKeycloakAccount account) {
-        HttpScope session = this.httpFacade.getScope(Scope.SESSION);
-
-        if (!session.exists()) {
-            session.create();
-        }
-
-        session.setAttachment(ElytronAccount.class.getName(), account);
-        session.setAttachment(KeycloakSecurityContext.class.getName(), account.getKeycloakSecurityContext());
-
-        session.registerForNotification(httpScopeNotification -> {
-            if (!httpScopeNotification.isOfType(HttpScopeNotification.SessionNotificationType.UNDEPLOY)) {
-                logout();
-            }
-        });
-
-        HttpScope scope = this.httpFacade.getScope(Scope.EXCHANGE);
-
-        scope.setAttachment(KeycloakSecurityContext.class.getName(), account.getKeycloakSecurityContext());
-    }
-
-    @Override
-    public void logout() {
-        logout(false);
-    }
-
-    @Override
-    public void refreshCallback(RefreshableKeycloakSecurityContext securityContext) {
-        KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal = new KeycloakPrincipal<RefreshableKeycloakSecurityContext>(AdapterUtils.getPrincipalName(this.httpFacade.getDeployment(), securityContext.getToken()), securityContext);
-        saveAccountInfo(new ElytronAccount(principal));
-    }
-
-    @Override
-    public void saveRequest() {
-        this.httpFacade.suspendRequest();
-    }
-
-    @Override
-    public boolean restoreRequest() {
-        return this.httpFacade.restoreRequest();
-    }
-
-    @Override
-    public void logout(boolean glo) {
-        HttpScope session = this.httpFacade.getScope(Scope.SESSION);
-
-        if (!session.exists()) {
-            return;
-        }
-
-        try {
-            if (glo) {
-                KeycloakSecurityContext ksc = (KeycloakSecurityContext) session.getAttachment(KeycloakSecurityContext.class.getName());
-
-                if (ksc == null) {
-                    return;
-                }
-
-                KeycloakDeployment deployment = httpFacade.getDeployment();
-
-                if (!deployment.isBearerOnly() && ksc != null && ksc instanceof RefreshableKeycloakSecurityContext) {
-                    ((RefreshableKeycloakSecurityContext) ksc).logout(deployment);
-                }
-            }
-
-            session.setAttachment(KeycloakSecurityContext.class.getName(), null);
-            session.setAttachment(ElytronAccount.class.getName(), null);
-            session.invalidate();
-        } catch (IllegalStateException ise) {
-            // Session may be already logged-out in case that app has adminUrl
-            log.debugf("Session %s logged-out already", session.getID());
-        }
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronTokeStore.java

@@ -1,26 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.elytron;
-
-import org.keycloak.adapters.AdapterTokenStore;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface ElytronTokeStore extends AdapterTokenStore {
-    void logout(boolean glo);
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakConfigurationServletListener.java

@@ -1,109 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.KeycloakConfigResolver;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.constants.AdapterConstants;
-
-import javax.servlet.ServletContext;
-import javax.servlet.ServletContextEvent;
-import javax.servlet.ServletContextListener;
-import java.io.ByteArrayInputStream;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.InputStream;
-
-/**
- * <p>A {@link ServletContextListener} that parses the keycloak adapter configuration and set the same configuration
- * as a {@link ServletContext} attribute in order to provide to {@link KeycloakHttpServerAuthenticationMechanism} a way
- * to obtain the configuration when processing requests.
- *
- * <p>This listener should be automatically registered to a deployment using the subsystem.
- *
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakConfigurationServletListener implements ServletContextListener {
-    @Override
-    public void contextInitialized(ServletContextEvent sce) {
-        ServletContext servletContext = sce.getServletContext();
-        String configResolverClass = servletContext.getInitParameter("keycloak.config.resolver");
-        KeycloakConfigResolver configResolver;
-        AdapterDeploymentContext deploymentContext;
-
-        if (configResolverClass != null) {
-            try {
-                configResolver = (KeycloakConfigResolver) servletContext.getClassLoader().loadClass(configResolverClass).newInstance();
-                deploymentContext = new AdapterDeploymentContext(configResolver);
-            } catch (Exception ex) {
-                deploymentContext = new AdapterDeploymentContext(new KeycloakDeployment());
-            }
-        } else {
-            InputStream is = getConfigInputStream(servletContext);
-
-            KeycloakDeployment deployment;
-
-            if (is == null) {
-                deployment = new KeycloakDeployment();
-            } else {
-                deployment = KeycloakDeploymentBuilder.build(is);
-            }
-
-            deploymentContext = new AdapterDeploymentContext(deployment);
-        }
-
-        servletContext.setAttribute(AdapterDeploymentContext.class.getName(), deploymentContext);
-    }
-
-    @Override
-    public void contextDestroyed(ServletContextEvent sce) {
-
-    }
-
-    private InputStream getConfigInputStream(ServletContext servletContext) {
-        InputStream is = getJSONFromServletContext(servletContext);
-
-        if (is == null) {
-            String path = servletContext.getInitParameter("keycloak.config.file");
-
-            if (path == null) {
-                is = servletContext.getResourceAsStream("/WEB-INF/keycloak.json");
-            } else {
-                try {
-                    is = new FileInputStream(path);
-                } catch (FileNotFoundException e) {
-                    throw new RuntimeException(e);
-                }
-            }
-        }
-        return is;
-    }
-
-    private InputStream getJSONFromServletContext(ServletContext servletContext) {
-        String json = servletContext.getInitParameter(AdapterConstants.AUTH_DATA_PARAM_NAME);
-
-        if (json == null) {
-            return null;
-        }
-
-        return new ByteArrayInputStream(json.getBytes());
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanism.java

@@ -1,168 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-
-import javax.security.auth.callback.CallbackHandler;
-
-import org.jboss.logging.Logger;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.AuthenticatedActionsHandler;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.NodesRegistrationManagement;
-import org.keycloak.adapters.PreAuthActionsHandler;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.RequestAuthenticator;
-import org.keycloak.adapters.spi.AuthChallenge;
-import org.keycloak.adapters.spi.AuthOutcome;
-import org.keycloak.adapters.spi.UserSessionManagement;
-import org.wildfly.security.http.HttpAuthenticationException;
-import org.wildfly.security.http.HttpScope;
-import org.wildfly.security.http.HttpServerAuthenticationMechanism;
-import org.wildfly.security.http.HttpServerRequest;
-import org.wildfly.security.http.Scope;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-class KeycloakHttpServerAuthenticationMechanism implements HttpServerAuthenticationMechanism {
-
-    static Logger LOGGER = Logger.getLogger(KeycloakHttpServerAuthenticationMechanismFactory.class);
-    static final String NAME = "KEYCLOAK";
-
-    private final Map<String, ?> properties;
-    private final CallbackHandler callbackHandler;
-    private final AdapterDeploymentContext deploymentContext;
-
-    public KeycloakHttpServerAuthenticationMechanism(Map<String, ?> properties, CallbackHandler callbackHandler, AdapterDeploymentContext deploymentContext) {
-        this.properties = properties;
-        this.callbackHandler = callbackHandler;
-        this.deploymentContext = deploymentContext;
-    }
-
-    @Override
-    public String getMechanismName() {
-        return NAME;
-    }
-
-    @Override
-    public void evaluateRequest(HttpServerRequest request) throws HttpAuthenticationException {
-        LOGGER.debugf("Evaluating request for path [%s]", request.getRequestURI());
-        AdapterDeploymentContext deploymentContext = getDeploymentContext(request);
-
-        if (deploymentContext == null) {
-            LOGGER.debugf("Ignoring request for path [%s] from mechanism [%s]. No deployment context found.", request.getRequestURI());
-            request.noAuthenticationInProgress();
-            return;
-        }
-
-        ElytronHttpFacade httpFacade = new ElytronHttpFacade(request, deploymentContext, callbackHandler);
-        KeycloakDeployment deployment = httpFacade.getDeployment();
-
-        if (!deployment.isConfigured()) {
-            request.noAuthenticationInProgress();
-            return;
-        }
-
-        RequestAuthenticator authenticator = createRequestAuthenticator(request, httpFacade, deployment);
-
-        httpFacade.getTokenStore().checkCurrentToken();
-
-        if (preActions(httpFacade, deploymentContext)) {
-            LOGGER.debugf("Pre-actions has aborted the evaluation of [%s]", request.getRequestURI());
-            httpFacade.authenticationInProgress();
-            return;
-        }
-
-        AuthOutcome outcome = authenticator.authenticate();
-
-        if (AuthOutcome.AUTHENTICATED.equals(outcome)) {
-            if (new AuthenticatedActionsHandler(deployment, httpFacade).handledRequest()) {
-                httpFacade.authenticationInProgress();
-            } else {
-                httpFacade.authenticationComplete();
-            }
-            return;
-        }
-
-        AuthChallenge challenge = authenticator.getChallenge();
-
-        if (challenge != null) {
-            httpFacade.noAuthenticationInProgress(challenge);
-            return;
-        }
-
-        if (AuthOutcome.FAILED.equals(outcome)) {
-            httpFacade.getResponse().setStatus(403);
-            httpFacade.authenticationFailed();
-            return;
-        }
-
-        httpFacade.noAuthenticationInProgress();
-    }
-
-    private ElytronRequestAuthenticator createRequestAuthenticator(HttpServerRequest request, ElytronHttpFacade httpFacade, KeycloakDeployment deployment) {
-        return new ElytronRequestAuthenticator(this.callbackHandler, httpFacade, deployment, getConfidentialPort(request));
-    }
-
-    private AdapterDeploymentContext getDeploymentContext(HttpServerRequest request) {
-        if (this.deploymentContext == null) {
-            return (AdapterDeploymentContext) request.getScope(Scope.APPLICATION).getAttachment(AdapterDeploymentContext.class.getName());
-        }
-
-        return this.deploymentContext;
-    }
-
-    private boolean preActions(ElytronHttpFacade httpFacade, AdapterDeploymentContext deploymentContext) {
-        NodesRegistrationManagement nodesRegistrationManagement = new NodesRegistrationManagement();
-
-        nodesRegistrationManagement.tryRegister(httpFacade.getDeployment());
-
-        PreAuthActionsHandler preActions = new PreAuthActionsHandler(new UserSessionManagement() {
-            @Override
-            public void logoutAll() {
-                Collection<String> sessions = httpFacade.getScopeIds(Scope.SESSION);
-                logoutHttpSessions(new ArrayList<>(sessions));
-            }
-
-            @Override
-            public void logoutHttpSessions(List<String> ids) {
-                for (String id : ids) {
-                    HttpScope session = httpFacade.getScope(Scope.SESSION, id);
-
-                    if (session != null) {
-                        session.invalidate();
-                    }
-                }
-
-            }
-        }, deploymentContext, httpFacade);
-
-        return preActions.handleRequest();
-    }
-
-    // TODO: obtain confidential port from Elytron
-    private int getConfidentialPort(HttpServerRequest request) {
-        return 8443;
-    }
-}

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/KeycloakHttpServerAuthenticationMechanismFactory.java

@@ -1,67 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2016 Red Hat, Inc., and individual contributors
- * as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.elytron;
-
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.wildfly.security.http.HttpAuthenticationException;
-import org.wildfly.security.http.HttpServerAuthenticationMechanism;
-import org.wildfly.security.http.HttpServerAuthenticationMechanismFactory;
-
-import javax.security.auth.callback.CallbackHandler;
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakHttpServerAuthenticationMechanismFactory implements HttpServerAuthenticationMechanismFactory {
-
-    private final AdapterDeploymentContext deploymentContext;
-
-    /**
-     * <p>Creates a new instance.
-     *
-     * <p>A default constructor is necessary in order to allow this factory to be loaded via {@link java.util.ServiceLoader}.
-     */
-    public KeycloakHttpServerAuthenticationMechanismFactory() {
-        this(null);
-    }
-
-    public KeycloakHttpServerAuthenticationMechanismFactory(AdapterDeploymentContext deploymentContext) {
-        this.deploymentContext = deploymentContext;
-    }
-
-    @Override
-    public String[] getMechanismNames(Map<String, ?> properties) {
-        return new String[] {KeycloakHttpServerAuthenticationMechanism.NAME};
-    }
-
-    @Override
-    public HttpServerAuthenticationMechanism createAuthenticationMechanism(String mechanismName, Map<String, ?> properties, CallbackHandler callbackHandler) throws HttpAuthenticationException {
-        Map<String, Object> mechanismProperties = new HashMap();
-
-        mechanismProperties.putAll(properties);
-
-        if (KeycloakHttpServerAuthenticationMechanism.NAME.equals(mechanismName)) {
-            return new KeycloakHttpServerAuthenticationMechanism(properties, callbackHandler, this.deploymentContext);
-        }
-
-        return null;
-    }
-}