Set version to 2.2.1.Final

Token is not refreshed in updateToken

.gitignore

@@ -14,7 +14,6 @@
 nbactions.xml
 nb-configuration.xml
 catalog.xml
-nbproject
 
 # Compiled source #
 ###################
@@ -46,12 +45,3 @@ nbproject
 #########
 target
 
-# Maven shade
-#############
-*dependency-reduced-pom.xml
-
-# nodejs #
-##########
-# KEYCLOAK-5391: We will re-exclude node_modules when node_modules handling is worked out.
-# For now, we keep our js libraries checked into GitHub, so we don't ignore.
-#node_modules

.travis.yml

@@ -1,38 +1,27 @@
 language: java
-dist: precise
 
 cache:
-  cache: false
+  directories:
+    - $HOME/.m2
+
+before_cache:
+  - rm -rf $HOME/.m2/repository/org/keycloak
 
 env:
   global:
     - MAVEN_SKIP_RC=true
-    - MAVEN_OPTS="-Xms512m -Xmx1536m"
-  matrix:
-    - TESTS=unit
-    - TESTS=server-group1
-    - TESTS=server-group2
-    - TESTS=server-group3
-    - TESTS=server-group4
-    - TESTS=old
-    - TESTS=crossdc
+    - MAVEN_OPTS="-Xms512m -Xmx2048m"
 
 jdk:
   - oraclejdk8
 
-install: true
+before_script:
+  - export MAVEN_SKIP_RC=true
 
-before_install:
-  - "export PHANTOMJS_VERSION=2.1.1"
-  - "phantomjs --version"
-  - "export PATH=$PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64/bin:$PATH"
-  - "phantomjs --version"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then rm -rf $PWD/travis_phantomjs; mkdir -p $PWD/travis_phantomjs; fi"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then wget https://github.com/Medium/phantomjs/releases/download/v$PHANTOMJS_VERSION/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -O $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2; fi"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then tar -xvf $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -C $PWD/travis_phantomjs; fi"
-  - "phantomjs --version"
+install: 
+  - travis_wait 30 mvn install -Pdistribution -DskipTests=true -B -V -q
 
-script: 
-  - ./travis-run-tests.sh $TESTS
+script:
+  - mvn test -B
 
 sudo: false

README.md

@@ -9,7 +9,7 @@ For more information about Keycloak visit [Keycloak homepage](http://keycloak.or
 Building
 --------
 
-Ensure you have JDK 8 (or newer), Maven 3.1.1 (or newer) and Git installed
+Ensure you have JDK 8 (or newer), Maven 3.2.1 (or newer) and Git installed
 
     java -version
     mvn -version
@@ -36,27 +36,23 @@ Once completed you will find distribution archives in `distribution`.
 Starting Keycloak
 -----------------
 
-To start Keycloak during development first build as specified above, then run:
+To start Keycloak during development first build as specficied above, then run:
 
-    mvn -f testsuite/utils/pom.xml exec:java -Pkeycloak-server 
+    mvn -f testsuite/integration/pom.xml exec:java -Pkeycloak-server 
 
 
-To start Keycloak from the server distribution first build the distribution it as specified above, then run:
+To start Keycloak from the appliance distribution first build the distribution it as specified above, then run:
 
-    tar xfz distribution/server-dist/target/keycloak-<VERSION>.tar.gz
-    cd keycloak-<VERSION>
+    tar xfz distribution/appliance-dist/target/keycloak-appliance-dist-all-<VERSION>.tar.gz
+    cd keycloak-appliance-dist-all-<VERSION>/keycloak
     bin/standalone.sh
     
 To stop the server press `Ctrl + C`.
 
-Reporting security vulnerabilities
-----------------------------------
-
-If you've found a security vulnerability, please look at the [instructions on how to properly report it](http://www.keycloak.org/security.html)
 
 Help and Documentation
 ----------------------
-* [Documentation](http://www.keycloak.org/documentation.html) - User Guide, Admin REST API and Javadocs
+* [Documentation](http://keycloak.jboss.org/docs) - User Guide, Admin REST API and Javadocs
 * [User Mailing List](https://lists.jboss.org/mailman/listinfo/keycloak-user) - Mailing list to ask for help and general questions about Keycloak
 * [JIRA](https://issues.jboss.org/projects/KEYCLOAK) - Issue tracker for bugs and feature requests
 
@@ -76,4 +72,4 @@ Contributing
 License
 -------
 
-* [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)
+* [Apache License, Version 2.0](https://www.apache.org/licenses/LICENSE-2.0)

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -17,21 +17,26 @@
 
 package org.keycloak.adapters;
 
+import org.apache.http.HttpEntity;
 import org.apache.http.HttpResponse;
 import org.apache.http.client.HttpClient;
+import org.apache.http.client.methods.HttpGet;
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.authentication.ClientCredentialsProvider;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-import org.keycloak.adapters.rotation.PublicKeyLocator;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.enums.RelativeUrlsUsed;
 import org.keycloak.common.enums.SslRequired;
-import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.enums.TokenStore;
 import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.representations.idm.PublishedRealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+import org.keycloak.common.util.KeycloakUriBuilder;
 
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URI;
+import java.security.PublicKey;
 import java.util.Map;
 
 /**
@@ -52,7 +57,7 @@ public class AdapterDeploymentContext {
      * during the application deployment's life cycle.
      *
      * @param deployment A KeycloakConfigResolver, possibly missing the Auth
-     *                   Server URL
+     *                   Server URL and/or Realm Public Key
      */
     public AdapterDeploymentContext(KeycloakDeployment deployment) {
         this.deployment = deployment;
@@ -74,6 +79,7 @@ public class AdapterDeploymentContext {
     /**
      * For single-tenant deployments, it complements KeycloakDeployment
      * by resolving a relative Auth Server's URL based on the current request
+     * and, if needed, will lazily resolve the Realm's Public Key.
      *
      * For multi-tenant deployments, defers the resolution of KeycloakDeployment
      * to the KeycloakConfigResolver .
@@ -92,8 +98,8 @@ public class AdapterDeploymentContext {
         if (deployment.getAuthServerBaseUrl() == null) return deployment;
 
         KeycloakDeployment resolvedDeployment = resolveUrls(deployment, facade);
-        if (resolvedDeployment.getPublicKeyLocator() == null) {
-            throw new RuntimeException("KeycloakDeployment was never initialized through appropriate SPIs");
+        if (resolvedDeployment.getRealmKey() == null) {
+            resolveRealmKey(resolvedDeployment);
         }
         return resolvedDeployment;
     }
@@ -109,6 +115,45 @@ public class AdapterDeploymentContext {
         }
     }
 
+    public void resolveRealmKey(KeycloakDeployment deployment) {
+        if (deployment.getClient() == null) {
+            throw new RuntimeException("KeycloakDeployment was never initialized through appropriate SPIs");
+        }
+        HttpGet get = new HttpGet(deployment.getRealmInfoUrl());
+        try {
+            HttpResponse response = deployment.getClient().execute(get);
+            int status = response.getStatusLine().getStatusCode();
+            if (status != 200) {
+                close(response);
+                throw new RuntimeException("Unable to resolve realm public key remotely, status = " + status);
+            }
+            HttpEntity entity = response.getEntity();
+            if (entity == null) {
+                throw new RuntimeException("Unable to resolve realm public key remotely.  There was no entity.");
+            }
+            InputStream is = entity.getContent();
+            try {
+                ByteArrayOutputStream os = new ByteArrayOutputStream();
+                int c;
+                while ((c = is.read()) != -1) {
+                    os.write(c);
+                }
+                byte[] bytes = os.toByteArray();
+                String json = new String(bytes);
+                PublishedRealmRepresentation rep = JsonSerialization.readValue(json, PublishedRealmRepresentation.class);
+                deployment.setRealmKey(rep.getPublicKey());
+            } finally {
+                try {
+                    is.close();
+                } catch (IOException ignored) {
+
+                }
+            }
+        } catch (IOException e) {
+            throw new RuntimeException("Unable to resolve realm public key remotely", e);
+        }
+    }
+
     /**
      * This delegate is used to store temporary, per-request metadata like request resolved URLs.
      * Ever method is delegated except URL get methods and isConfigured()
@@ -162,11 +207,6 @@ public class AdapterDeploymentContext {
             return (this.unregisterNodeUrl != null) ? this.unregisterNodeUrl : delegate.getUnregisterNodeUrl();
         }
 
-        @Override
-        public String getJwksUrl() {
-            return (this.jwksUrl != null) ? this.jwksUrl : delegate.getJwksUrl();
-        }
-
         @Override
         public String getResourceName() {
             return delegate.getResourceName();
@@ -183,13 +223,13 @@ public class AdapterDeploymentContext {
         }
 
         @Override
-        public void setPublicKeyLocator(PublicKeyLocator publicKeyLocator) {
-            delegate.setPublicKeyLocator(publicKeyLocator);
+        public PublicKey getRealmKey() {
+            return delegate.getRealmKey();
         }
 
         @Override
-        public PublicKeyLocator getPublicKeyLocator() {
-            return delegate.getPublicKeyLocator();
+        public void setRealmKey(PublicKey realmKey) {
+            delegate.setRealmKey(realmKey);
         }
 
         @Override
@@ -206,16 +246,6 @@ public class AdapterDeploymentContext {
         public void setBearerOnly(boolean bearerOnly) {
             delegate.setBearerOnly(bearerOnly);
         }
-        
-        @Override
-        public boolean isAutodetectBearerOnly() {
-            return delegate.isAutodetectBearerOnly();
-        }
-        
-        @Override
-        public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
-            delegate.setAutodetectBearerOnly(autodetectBearerOnly);
-        }
 
         @Override
         public boolean isEnableBasicAuth() {
@@ -287,16 +317,6 @@ public class AdapterDeploymentContext {
             delegate.setSslRequired(sslRequired);
         }
 
-        @Override
-        public int getConfidentialPort() {
-            return delegate.getConfidentialPort();
-        }
-
-        @Override
-        public void setConfidentialPort(int confidentialPort) {
-            delegate.setConfidentialPort(confidentialPort);
-        }
-
         @Override
         public TokenStore getTokenStore() {
             return delegate.getTokenStore();
@@ -362,12 +382,6 @@ public class AdapterDeploymentContext {
             return delegate.getNotBefore();
         }
 
-        @Override
-        public void updateNotBefore(int notBefore) {
-            delegate.setNotBefore(notBefore);
-            getPublicKeyLocator().reset(this);
-        }
-
         @Override
         public void setExposeToken(boolean exposeToken) {
             delegate.setExposeToken(exposeToken);
@@ -452,36 +466,6 @@ public class AdapterDeploymentContext {
         public void setTokenMinimumTimeToLive(final int tokenMinimumTimeToLive) {
             delegate.setTokenMinimumTimeToLive(tokenMinimumTimeToLive);
         }
-
-        @Override
-        public PolicyEnforcer getPolicyEnforcer() {
-            return delegate.getPolicyEnforcer();
-        }
-
-        @Override
-        public void setPolicyEnforcer(PolicyEnforcer policyEnforcer) {
-            delegate.setPolicyEnforcer(policyEnforcer);
-        }
-
-        @Override
-        public void setMinTimeBetweenJwksRequests(int minTimeBetweenJwksRequests) {
-            delegate.setMinTimeBetweenJwksRequests(minTimeBetweenJwksRequests);
-        }
-
-        @Override
-        public int getMinTimeBetweenJwksRequests() {
-            return delegate.getMinTimeBetweenJwksRequests();
-        }
-
-        @Override
-        public int getPublicKeyCacheTtl() {
-            return delegate.getPublicKeyCacheTtl();
-        }
-
-        @Override
-        public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-            delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
-        }
     }
 
     protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterUtils.java

@@ -19,7 +19,9 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
+import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.representations.AccessToken;
+import org.keycloak.common.util.UriUtils;
 
 import java.util.Collections;
 import java.util.Set;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -101,7 +101,6 @@ public class AuthenticatedActionsHandler {
         if (!deployment.isCors()) return false;
         KeycloakSecurityContext securityContext = facade.getSecurityContext();
         String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
-        String exposeHeaders = deployment.getCorsExposedHeaders();
         String requestOrigin = UriUtils.getOrigin(facade.getRequest().getURI());
         log.debugv("Origin: {0} uri: {1}", origin, facade.getRequest().getURI());
         if (securityContext != null && origin != null && !origin.equals(requestOrigin)) {
@@ -125,9 +124,6 @@ public class AuthenticatedActionsHandler {
             facade.getResponse().setStatus(200);
             facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
             facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
-            if (exposeHeaders != null) {
-                facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, exposeHeaders);
-            }
         } else {
             log.debugv("cors validation not needed as we're not a secure session or origin header was null: {0}", facade.getRequest().getURI());
         }
@@ -146,13 +142,9 @@ public class AuthenticatedActionsHandler {
             AuthorizationContext authorizationContext = policyEnforcer.enforce(facade);
             RefreshableKeycloakSecurityContext session = (RefreshableKeycloakSecurityContext) facade.getSecurityContext();
 
-            if (session != null) {
-                session.setAuthorizationContext(authorizationContext);
+            session.setAuthorizationContext(authorizationContext);
 
-                return authorizationContext.isGranted();
-            }
-
-            return true;
+            return  authorizationContext.isGranted();
         } catch (Exception e) {
             throw new RuntimeException("Failed to enforce policy decisions.", e);
         }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BasicAuthRequestAuthenticator.java

@@ -31,10 +31,10 @@ import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.util.Base64;
-import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.constants.ServiceUrlConstants;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.util.JsonSerialization;
+import org.keycloak.common.util.KeycloakUriBuilder;
 
 import java.util.List;
 
@@ -71,10 +71,9 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         AccessTokenResponse atr=null;        
         try {
             String userpw=new String(Base64.decode(tokenString));
-            int seperatorIndex = userpw.indexOf(":");
-            String user = userpw.substring(0, seperatorIndex);
-            String pw = userpw.substring(seperatorIndex + 1);
-            atr = getToken(user, pw);
+            String[] parts=userpw.split(":");
+            
+            atr = getToken(parts[0], parts[1]);
             tokenString = atr.getToken();
         } catch (Exception e) {
             log.debug("Failed to obtain token", e);
@@ -83,8 +82,8 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         }
 
         return authenticateToken(exchange, atr.getToken());
-    } 
- 
+    }
+    
     private AccessTokenResponse getToken(String username, String password) throws Exception {
     	AccessTokenResponse tokenResponse=null;
     	HttpClient client = deployment.getClient();

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BearerTokenRequestAuthenticator.java

@@ -18,13 +18,11 @@
 package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.RSATokenVerifier;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 
 import javax.security.cert.X509Certificate;
@@ -85,18 +83,8 @@ public class BearerTokenRequestAuthenticator {
     }
     
     protected AuthOutcome authenticateToken(HttpFacade exchange, String tokenString) {
-        log.debug("Verifying access_token");
-        if (log.isTraceEnabled()) {
-            try {
-                JWSInput jwsInput = new JWSInput(tokenString);
-                String wireString = jwsInput.getWireString();
-                log.tracef("\taccess_token: %s", wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
-            } catch (JWSInputException e) {
-                log.errorf(e, "Failed to parse access_token: %s", tokenString);
-            }
-        }
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
         } catch (VerificationException e) {
             log.error("Failed to verify token", e);
             challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.INVALID_TOKEN, "invalid_token", e.getMessage());
@@ -136,7 +124,6 @@ public class BearerTokenRequestAuthenticator {
             }
             surrogate = chain[0].getSubjectDN().getName();
         }
-        log.debug("successful authorized");
         return AuthOutcome.AUTHENTICATED;
     }
 
@@ -174,19 +161,10 @@ public class BearerTokenRequestAuthenticator {
 
             @Override
             public boolean challenge(HttpFacade facade) {
-                if (deployment.getPolicyEnforcer() != null) {
-                    deployment.getPolicyEnforcer().enforce(OIDCHttpFacade.class.cast(facade));
-                    return true;
-                }
                 OIDCAuthenticationError error = new OIDCAuthenticationError(reason, description);
                 facade.getRequest().setError(error);
                 facade.getResponse().addHeader("WWW-Authenticate", challenge);
-                if(deployment.isDelegateBearerErrorResponseSending()){
-                    facade.getResponse().setStatus(401);
-                }
-                else {
-                    facade.getResponse().sendError(401);
-                }
+                facade.getResponse().sendError(401);
                 return true;
             }
         };

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/CookieTokenStore.java

@@ -17,17 +17,19 @@
 
 package org.keycloak.adapters;
 
+import java.io.IOException;
+
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.RSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.IDToken;
+import org.keycloak.common.util.KeycloakUriBuilder;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -71,7 +73,7 @@ public class CookieTokenStore {
 
         try {
             // Skip check if token is active now. It's supposed to be done later by the caller
-            AccessToken accessToken = AdapterRSATokenVerifier.verifyToken(accessTokenString, deployment, false, true);
+            AccessToken accessToken = RSATokenVerifier.verifyToken(accessTokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl(), false, true);
             IDToken idToken;
             if (idTokenString != null && idTokenString.length() > 0) {
                 try {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/CorsHeaders.java

@@ -30,5 +30,4 @@ public interface CorsHeaders {
     String ORIGIN = "Origin";
     String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";
     String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";
-    String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpAdapterUtils.java

@@ -1,72 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters;
-
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpResponse;
-import org.apache.http.client.methods.HttpRequestBase;
-import org.keycloak.util.JsonSerialization;
-
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.InputStream;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class HttpAdapterUtils {
-
-
-    public static <T> T sendJsonHttpRequest(KeycloakDeployment deployment, HttpRequestBase httpRequest, Class<T> clazz) throws HttpClientAdapterException {
-        try {
-            HttpResponse response = deployment.getClient().execute(httpRequest);
-            int status = response.getStatusLine().getStatusCode();
-            if (status != 200) {
-                close(response);
-                throw new HttpClientAdapterException("Unexpected status = " + status);
-            }
-            HttpEntity entity = response.getEntity();
-            if (entity == null) {
-                throw new HttpClientAdapterException("There was no entity.");
-            }
-            InputStream is = entity.getContent();
-            try {
-                return JsonSerialization.readValue(is, clazz);
-            } finally {
-                try {
-                    is.close();
-                } catch (IOException ignored) {
-
-                }
-            }
-        } catch (IOException e) {
-            throw new HttpClientAdapterException("IO error", e);
-        }
-    }
-
-
-    private static void close(HttpResponse response) {
-        if (response.getEntity() != null) {
-            try {
-                response.getEntity().getContent().close();
-            } catch (IOException e) {
-
-            }
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpClientAdapterException.java

@@ -1,32 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class HttpClientAdapterException extends Exception {
-
-    public HttpClientAdapterException(String message) {
-        super(message);
-    }
-
-    public HttpClientAdapterException(String message, Throwable t) {
-        super(message, t);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpClientBuilder.java

@@ -38,7 +38,7 @@ import org.apache.http.params.BasicHttpParams;
 import org.apache.http.params.HttpConnectionParams;
 import org.keycloak.common.util.EnvUtil;
 import org.keycloak.common.util.KeystoreUtil;
-import org.keycloak.representations.adapters.config.AdapterHttpClientConfig;
+import org.keycloak.representations.adapters.config.AdapterConfig;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
@@ -57,8 +57,6 @@ import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
-import org.apache.http.client.params.ClientPNames;
-import org.apache.http.client.params.CookiePolicy;
 
 /**
  * Abstraction for creating HttpClients. Allows SSL configuration.
@@ -172,8 +170,8 @@ public class HttpClientBuilder {
         return this;
     }
 
-    public HttpClientBuilder disableCookieCache(boolean disable) {
-        this.disableCookieCache = disable;
+    public HttpClientBuilder disableCookieCache() {
+        this.disableCookieCache = true;
         return this;
     }
 
@@ -291,7 +289,6 @@ public class HttpClientBuilder {
                 cm = new SingleClientConnManager(registry);
             }
             BasicHttpParams params = new BasicHttpParams();
-            params.setParameter(ClientPNames.COOKIE_POLICY, CookiePolicy.BROWSER_COMPATIBILITY);
 
             if (proxyHost != null) {
                 params.setParameter(ConnRoutePNames.DEFAULT_PROXY, proxyHost);
@@ -336,8 +333,8 @@ public class HttpClientBuilder {
         }
     }
 
-    public HttpClient build(AdapterHttpClientConfig adapterConfig) {
-        disableCookieCache(true); // disable cookie cache as we don't want sticky sessions for load balancing
+    public HttpClient build(AdapterConfig adapterConfig) {
+        disableCookieCache(); // disable cookie cache as we don't want sticky sessions for load balancing
 
         String truststorePath = adapterConfig.getTruststore();
         if (truststorePath != null) {
@@ -382,13 +379,13 @@ public class HttpClientBuilder {
     /**
      * Configures a the proxy to use for auth-server requests if provided.
      * <p>
-     * If the given {@link AdapterHttpClientConfig} contains the attribute {@code proxy-url} we use the
+     * If the given {@link AdapterConfig} contains the attribute {@code proxy-url} we use the
      * given URL as a proxy server, otherwise the proxy configuration is ignored.
      * </p>
      *
      * @param adapterConfig
      */
-    private void configureProxyForAuthServerIfProvided(AdapterHttpClientConfig adapterConfig) {
+    private void configureProxyForAuthServerIfProvided(AdapterConfig adapterConfig) {
 
         if (adapterConfig == null || adapterConfig.getProxyUrl() == null || adapterConfig.getProxyUrl().trim().isEmpty()) {
             return;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java

@@ -21,22 +21,20 @@ import org.apache.http.client.HttpClient;
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.authentication.ClientCredentialsProvider;
 import org.keycloak.adapters.authorization.PolicyEnforcer;
-import org.keycloak.adapters.rotation.PublicKeyLocator;
+import org.keycloak.constants.ServiceUrlConstants;
 import org.keycloak.common.enums.RelativeUrlsUsed;
 import org.keycloak.common.enums.SslRequired;
-import org.keycloak.common.util.KeycloakUriBuilder;
-import org.keycloak.constants.ServiceUrlConstants;
 import org.keycloak.enums.TokenStore;
 import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.common.util.KeycloakUriBuilder;
 
 import java.net.URI;
+import java.security.PublicKey;
 import java.util.HashMap;
 import java.util.Map;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
- * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class KeycloakDeployment {
@@ -45,7 +43,7 @@ public class KeycloakDeployment {
 
     protected RelativeUrlsUsed relativeUrls;
     protected String realm;
-    protected PublicKeyLocator publicKeyLocator;
+    protected volatile PublicKey realmKey;
     protected String authServerBaseUrl;
     protected String realmInfoUrl;
     protected KeycloakUriBuilder authUrl;
@@ -54,12 +52,10 @@ public class KeycloakDeployment {
     protected String accountUrl;
     protected String registerNodeUrl;
     protected String unregisterNodeUrl;
-    protected String jwksUrl;
     protected String principalAttribute = "sub";
 
     protected String resourceName;
     protected boolean bearerOnly;
-    protected boolean autodetectBearerOnly;
     protected boolean enableBasicAuth;
     protected boolean publicClient;
     protected Map<String, Object> resourceCredentials = new HashMap<>();
@@ -68,7 +64,6 @@ public class KeycloakDeployment {
 
     protected String scope;
     protected SslRequired sslRequired = SslRequired.ALL;
-    protected int confidentialPort = -1;
     protected TokenStore tokenStore = TokenStore.SESSION;
     protected String stateCookieName = "OAuth_Token_Request_State";
     protected boolean useResourceRoleMappings;
@@ -76,7 +71,6 @@ public class KeycloakDeployment {
     protected int corsMaxAge = -1;
     protected String corsAllowedHeaders;
     protected String corsAllowedMethods;
-    protected String corsExposedHeaders;
     protected boolean exposeToken;
     protected boolean alwaysRefreshToken;
     protected boolean registerNodeAtStartup;
@@ -85,23 +79,13 @@ public class KeycloakDeployment {
 
     protected volatile int notBefore;
     protected int tokenMinimumTimeToLive;
-    protected int minTimeBetweenJwksRequests;
-    protected int publicKeyCacheTtl;
     private PolicyEnforcer policyEnforcer;
 
-    // https://tools.ietf.org/html/rfc7636
-    protected boolean pkce = false;
-    protected boolean ignoreOAuthQueryParameter;
-    
-    protected Map<String, String> redirectRewriteRules;
-
-    protected boolean delegateBearerErrorResponseSending = false;
-
     public KeycloakDeployment() {
     }
 
     public boolean isConfigured() {
-        return getRealm() != null && getPublicKeyLocator() != null && (isBearerOnly() || getAuthServerBaseUrl() != null);
+        return getRealm() != null && getRealmKey() != null && (isBearerOnly() || getAuthServerBaseUrl() != null);
     }
 
     public String getResourceName() {
@@ -116,12 +100,12 @@ public class KeycloakDeployment {
         this.realm = realm;
     }
 
-    public PublicKeyLocator getPublicKeyLocator() {
-        return publicKeyLocator;
+    public PublicKey getRealmKey() {
+        return realmKey;
     }
 
-    public void setPublicKeyLocator(PublicKeyLocator publicKeyLocator) {
-        this.publicKeyLocator = publicKeyLocator;
+    public void setRealmKey(PublicKey realmKey) {
+        this.realmKey = realmKey;
     }
 
     public String getAuthServerBaseUrl() {
@@ -154,8 +138,6 @@ public class KeycloakDeployment {
             log.debug("resolveUrls");
         }
 
-        authServerBaseUrl = authUrlBuilder.build().toString();
-
         String login = authUrlBuilder.clone().path(ServiceUrlConstants.AUTH_PATH).build(getRealm()).toString();
         authUrl = KeycloakUriBuilder.fromUri(login);
         realmInfoUrl = authUrlBuilder.clone().path(ServiceUrlConstants.REALM_INFO_PATH).build(getRealm()).toString();
@@ -165,7 +147,6 @@ public class KeycloakDeployment {
         accountUrl = authUrlBuilder.clone().path(ServiceUrlConstants.ACCOUNT_SERVICE_PATH).build(getRealm()).toString();
         registerNodeUrl = authUrlBuilder.clone().path(ServiceUrlConstants.CLIENTS_MANAGEMENT_REGISTER_NODE_PATH).build(getRealm()).toString();
         unregisterNodeUrl = authUrlBuilder.clone().path(ServiceUrlConstants.CLIENTS_MANAGEMENT_UNREGISTER_NODE_PATH).build(getRealm()).toString();
-        jwksUrl = authUrlBuilder.clone().path(ServiceUrlConstants.JWKS_URL).build(getRealm()).toString();
     }
 
     public RelativeUrlsUsed getRelativeUrls() {
@@ -200,10 +181,6 @@ public class KeycloakDeployment {
         return unregisterNodeUrl;
     }
 
-    public String getJwksUrl() {
-        return jwksUrl;
-    }
-
     public void setResourceName(String resourceName) {
         this.resourceName = resourceName;
     }
@@ -216,14 +193,6 @@ public class KeycloakDeployment {
         this.bearerOnly = bearerOnly;
     }
 
-    public boolean isAutodetectBearerOnly() {
-        return autodetectBearerOnly;
-    }
-
-    public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
-        this.autodetectBearerOnly = autodetectBearerOnly;
-    }
-
     public boolean isEnableBasicAuth() {
         return enableBasicAuth;
     }
@@ -280,14 +249,6 @@ public class KeycloakDeployment {
         this.sslRequired = sslRequired;
     }
 
-    public int getConfidentialPort() {
-        return confidentialPort;
-    }
-
-    public void setConfidentialPort(int confidentialPort) {
-        this.confidentialPort = confidentialPort;
-    }
-
     public TokenStore getTokenStore() {
         return tokenStore;
     }
@@ -344,14 +305,6 @@ public class KeycloakDeployment {
         this.corsAllowedMethods = corsAllowedMethods;
     }
 
-    public String getCorsExposedHeaders() {
-        return corsExposedHeaders;
-    }
-
-    public void setCorsExposedHeaders(String corsExposedHeaders) {
-        this.corsExposedHeaders = corsExposedHeaders;
-    }
-
     public boolean isExposeToken() {
         return exposeToken;
     }
@@ -368,11 +321,6 @@ public class KeycloakDeployment {
         this.notBefore = notBefore;
     }
 
-    public void updateNotBefore(int notBefore) {
-        this.notBefore = notBefore;
-        getPublicKeyLocator().reset(this);
-    }
-
     public boolean isAlwaysRefreshToken() {
         return alwaysRefreshToken;
     }
@@ -421,22 +369,6 @@ public class KeycloakDeployment {
         this.tokenMinimumTimeToLive = tokenMinimumTimeToLive;
     }
 
-    public int getMinTimeBetweenJwksRequests() {
-        return minTimeBetweenJwksRequests;
-    }
-
-    public void setMinTimeBetweenJwksRequests(int minTimeBetweenJwksRequests) {
-        this.minTimeBetweenJwksRequests = minTimeBetweenJwksRequests;
-    }
-
-    public int getPublicKeyCacheTtl() {
-        return publicKeyCacheTtl;
-    }
-
-    public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
-        this.publicKeyCacheTtl = publicKeyCacheTtl;
-    }
-
     public void setPolicyEnforcer(PolicyEnforcer policyEnforcer) {
         this.policyEnforcer = policyEnforcer;
     }
@@ -444,37 +376,4 @@ public class KeycloakDeployment {
     public PolicyEnforcer getPolicyEnforcer() {
         return policyEnforcer;
     }
-
-    // https://tools.ietf.org/html/rfc7636
-    public boolean isPkce() {
-        return pkce;
-    }
-
-    public void setPkce(boolean pkce) {
-        this.pkce = pkce;
-    }
-
-    public void setIgnoreOAuthQueryParameter(boolean ignoreOAuthQueryParameter) {
-        this.ignoreOAuthQueryParameter = ignoreOAuthQueryParameter;
-    }
-
-    public boolean isOAuthQueryParameterEnabled() {
-        return !this.ignoreOAuthQueryParameter;
-    }
-
-    public Map<String, String> getRedirectRewriteRules() {
-        return redirectRewriteRules;
-    }
-
-    public void setRewriteRedirectRules(Map<String, String> redirectRewriteRules) {
-        this.redirectRewriteRules = redirectRewriteRules;
-    }
-
-    public boolean isDelegateBearerErrorResponseSending() {
-        return delegateBearerErrorResponseSending;
-    }
-
-    public void setDelegateBearerErrorResponseSending(boolean delegateBearerErrorResponseSending) {
-        this.delegateBearerErrorResponseSending = delegateBearerErrorResponseSending;
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java

@@ -22,8 +22,6 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.adapters.authorization.PolicyEnforcer;
-import org.keycloak.adapters.rotation.HardcodedPublicKeyLocator;
-import org.keycloak.adapters.rotation.JWKPublicKeyLocator;
 import org.keycloak.common.enums.SslRequired;
 import org.keycloak.common.util.PemUtils;
 import org.keycloak.enums.TokenStore;
@@ -37,8 +35,6 @@ import java.security.PublicKey;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
- * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class KeycloakDeploymentBuilder {
@@ -63,26 +59,16 @@ public class KeycloakDeploymentBuilder {
             PublicKey realmKey;
             try {
                 realmKey = PemUtils.decodePublicKey(realmKeyPem);
-                HardcodedPublicKeyLocator pkLocator = new HardcodedPublicKeyLocator(realmKey);
-                deployment.setPublicKeyLocator(pkLocator);
             } catch (Exception e) {
                 throw new RuntimeException(e);
             }
-        } else {
-            JWKPublicKeyLocator pkLocator = new JWKPublicKeyLocator();
-            deployment.setPublicKeyLocator(pkLocator);
+            deployment.setRealmKey(realmKey);
         }
-
         if (adapterConfig.getSslRequired() != null) {
             deployment.setSslRequired(SslRequired.valueOf(adapterConfig.getSslRequired().toUpperCase()));
         } else {
             deployment.setSslRequired(SslRequired.EXTERNAL);
         }
-
-        if (adapterConfig.getConfidentialPort() != -1) {
-            deployment.setConfidentialPort(adapterConfig.getConfidentialPort());
-        }
-
         if (adapterConfig.getTokenStore() != null) {
             deployment.setTokenStore(TokenStore.valueOf(adapterConfig.getTokenStore().toUpperCase()));
         } else {
@@ -103,25 +89,14 @@ public class KeycloakDeploymentBuilder {
             deployment.setCorsMaxAge(adapterConfig.getCorsMaxAge());
             deployment.setCorsAllowedHeaders(adapterConfig.getCorsAllowedHeaders());
             deployment.setCorsAllowedMethods(adapterConfig.getCorsAllowedMethods());
-            deployment.setCorsExposedHeaders(adapterConfig.getCorsExposedHeaders());
-        }
-
-        // https://tools.ietf.org/html/rfc7636
-        if (adapterConfig.isPkce()) {
-            deployment.setPkce(true);
         }
 
         deployment.setBearerOnly(adapterConfig.isBearerOnly());
-        deployment.setAutodetectBearerOnly(adapterConfig.isAutodetectBearerOnly());
         deployment.setEnableBasicAuth(adapterConfig.isEnableBasicAuth());
         deployment.setAlwaysRefreshToken(adapterConfig.isAlwaysRefreshToken());
         deployment.setRegisterNodeAtStartup(adapterConfig.isRegisterNodeAtStartup());
         deployment.setRegisterNodePeriod(adapterConfig.getRegisterNodePeriod());
         deployment.setTokenMinimumTimeToLive(adapterConfig.getTokenMinimumTimeToLive());
-        deployment.setMinTimeBetweenJwksRequests(adapterConfig.getMinTimeBetweenJwksRequests());
-        deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());
-        deployment.setIgnoreOAuthQueryParameter(adapterConfig.isIgnoreOAuthQueryParameter());
-        deployment.setRewriteRedirectRules(adapterConfig.getRedirectRewriteRules());
 
         if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
             throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");
@@ -130,7 +105,7 @@ public class KeycloakDeploymentBuilder {
             deployment.setClient(new HttpClientBuilder().build(adapterConfig));
         }
         if (adapterConfig.getAuthServerUrl() == null && (!deployment.isBearerOnly() || realmKeyPem == null)) {
-            throw new RuntimeException("You must specify auth-server-url");
+            throw new RuntimeException("You must specify auth-url");
         }
         deployment.setAuthServerBaseUrl(adapterConfig);
         if (adapterConfig.getTurnOffChangeSessionIdOnLogin() != null) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/NodesRegistrationManagement.java

@@ -17,10 +17,6 @@
 
 package org.keycloak.adapters;
 
-import org.jboss.logging.Logger;
-import org.keycloak.common.util.HostUtils;
-import org.keycloak.common.util.Time;
-
 import java.io.IOException;
 import java.util.Collection;
 import java.util.Map;
@@ -28,6 +24,10 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 
+import org.jboss.logging.Logger;
+import org.keycloak.common.util.HostUtils;
+import org.keycloak.common.util.Time;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -19,14 +19,12 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.RSATokenVerifier;
 import org.keycloak.adapters.spi.AdapterSessionStore;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.KeycloakUriBuilder;
-import org.keycloak.common.util.UriUtils;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.enums.TokenStore;
 import org.keycloak.jose.jws.JWSInput;
@@ -34,13 +32,12 @@ import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
+import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.common.util.UriUtils;
 import org.keycloak.util.TokenUtil;
 
 import java.io.IOException;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.Map;
-import java.util.logging.Level;
+import java.util.concurrent.atomic.AtomicLong;
 
 
 /**
@@ -66,7 +63,7 @@ public class OAuthRequestAuthenticator {
         this.reqAuthenticator = requestAuthenticator;
         this.facade = facade;
         this.deployment = deployment;
-        this.sslRedirectPort = deployment.getConfidentialPort() != -1 ? deployment.getConfidentialPort() : sslRedirectPort;
+        this.sslRedirectPort = sslRedirectPort;
         this.tokenStore = tokenStore;
     }
 
@@ -143,7 +140,6 @@ public class OAuthRequestAuthenticator {
     protected String getRedirectUri(String state) {
         String url = getRequestUrl();
         log.debugf("callback uri: %s", url);
-      
         if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
             int port = sslRedirectPort();
             if (port < 0) {
@@ -170,13 +166,10 @@ public class OAuthRequestAuthenticator {
         String maxAge = getQueryParamValue(OAuth2Constants.MAX_AGE);
         url = UriUtils.stripQueryParam(url, OAuth2Constants.MAX_AGE);
 
-        String uiLocales = getQueryParamValue(OAuth2Constants.UI_LOCALES_PARAM);
-        url = UriUtils.stripQueryParam(url, OAuth2Constants.UI_LOCALES_PARAM);
-
         KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, rewrittenRedirectUri(url))
+                .queryParam(OAuth2Constants.REDIRECT_URI, url)
                 .queryParam(OAuth2Constants.STATE, state)
                 .queryParam("login", "true");
         if(loginHint != null && loginHint.length() > 0){
@@ -191,9 +184,6 @@ public class OAuthRequestAuthenticator {
         if (maxAge != null && maxAge.length() > 0) {
             redirectUriBuilder.queryParam(OAuth2Constants.MAX_AGE, maxAge);
         }
-        if (uiLocales != null && uiLocales.length() > 0) {
-            redirectUriBuilder.queryParam(OAuth2Constants.UI_LOCALES_PARAM, uiLocales);
-        }
 
         scope = TokenUtil.attachOIDCScope(scope);
         redirectUriBuilder.queryParam(OAuth2Constants.SCOPE, scope);
@@ -205,13 +195,15 @@ public class OAuthRequestAuthenticator {
         return sslRedirectPort;
     }
 
+    protected static final AtomicLong counter = new AtomicLong();
+
     protected String getStateCode() {
-        return AdapterUtils.generateId();
+        return counter.getAndIncrement() + "/" + AdapterUtils.generateId();
     }
 
     protected AuthChallenge loginRedirect() {
         final String state = getStateCode();
-        final String redirect =  getRedirectUri(state);
+        final String redirect = getRedirectUri(state);
         if (redirect == null) {
             return challenge(403, OIDCAuthenticationError.Reason.NO_REDIRECT_URI, null);
         }
@@ -329,15 +321,14 @@ public class OAuthRequestAuthenticator {
 
         AccessTokenResponse tokenResponse = null;
         strippedOauthParametersRequestUri = stripOauthParametersFromRedirect();
-    
         try {
             // For COOKIE store we don't have httpSessionId and single sign-out won't be available
             String httpSessionId = deployment.getTokenStore() == TokenStore.SESSION ? reqAuthenticator.changeHttpSessionId(true) : null;
-            tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, rewrittenRedirectUri(strippedOauthParametersRequestUri), httpSessionId);
+            tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, strippedOauthParametersRequestUri, httpSessionId);
         } catch (ServerRequest.HttpFailure failure) {
             log.error("failed to turn code into token");
             log.error("status from server: " + failure.getStatus());
-            if (failure.getError() != null) {
+            if (failure.getStatus() == 400 && failure.getError() != null) {
                 log.error("   " + failure.getError());
             }
             return challenge(403, OIDCAuthenticationError.Reason.CODE_TO_TOKEN_FAILURE, null);
@@ -350,16 +341,8 @@ public class OAuthRequestAuthenticator {
         tokenString = tokenResponse.getToken();
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
-
-        log.debug("Verifying tokens");
-        if (log.isTraceEnabled()) {
-            logToken("\taccess_token", tokenString);
-            logToken("\tid_token", idTokenString);
-            logToken("\trefresh_token", refreshToken);
-        }
-
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
             if (idTokenString != null) {
                 try {
                     JWSInput input = new JWSInput(idTokenString);
@@ -374,7 +357,7 @@ public class OAuthRequestAuthenticator {
             return challenge(403, OIDCAuthenticationError.Reason.INVALID_TOKEN, null);
         }
         if (tokenResponse.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(tokenResponse.getNotBeforePolicy());
+            deployment.setNotBefore(tokenResponse.getNotBeforePolicy());
         }
         if (token.getIssuedAt() < deployment.getNotBefore()) {
             log.error("Stale token");
@@ -390,36 +373,9 @@ public class OAuthRequestAuthenticator {
     protected String stripOauthParametersFromRedirect() {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(facade.getRequest().getURI())
                 .replaceQueryParam(OAuth2Constants.CODE, null)
-                .replaceQueryParam(OAuth2Constants.STATE, null)
-                .replaceQueryParam(OAuth2Constants.SESSION_STATE, null);
+                .replaceQueryParam(OAuth2Constants.STATE, null);
         return builder.build().toString();
     }
-    
-    private String rewrittenRedirectUri(String originalUri) {
-        Map<String, String> rewriteRules = deployment.getRedirectRewriteRules();
-            if(rewriteRules != null && !rewriteRules.isEmpty()) {
-            try {
-                URL url = new URL(originalUri);
-                Map.Entry<String, String> rule =  rewriteRules.entrySet().iterator().next();
-                StringBuilder redirectUriBuilder = new StringBuilder(url.getProtocol());
-                redirectUriBuilder.append("://"+ url.getAuthority());
-                redirectUriBuilder.append(url.getPath().replaceFirst(rule.getKey(), rule.getValue()));
-                return redirectUriBuilder.toString();
-            } catch (MalformedURLException ex) {
-                log.error("Not a valid request url");
-                throw new RuntimeException(ex);
-            }
-            }
-        return originalUri;
-    }
 
-    private void logToken(String name, String token) {
-        try {
-            JWSInput jwsInput = new JWSInput(token);
-            String wireString = jwsInput.getWireString();
-            log.tracef("\t%s: %s", name, wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
-        } catch (JWSInputException e) {
-            log.errorf(e, "Failed to parse %s: %s", name, token);
-        }
-    }
+
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/PreAuthActionsHandler.java

@@ -17,32 +17,20 @@
 
 package org.keycloak.adapters;
 
-import java.security.PublicKey;
-
 import org.jboss.logging.Logger;
-import org.keycloak.adapters.authentication.ClientCredentialsProvider;
-import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.spi.UserSessionManagement;
-import org.keycloak.common.util.StreamUtil;
-import org.keycloak.jose.jwk.JSONWebKeySet;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jwk.JWKBuilder;
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.jose.jws.crypto.RSAProvider;
-import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.representations.adapters.action.AdminAction;
 import org.keycloak.representations.adapters.action.LogoutAction;
 import org.keycloak.representations.adapters.action.PushNotBeforeAction;
 import org.keycloak.representations.adapters.action.TestAvailabilityAction;
 import org.keycloak.util.JsonSerialization;
-
-import java.security.PublicKey;
+import org.keycloak.common.util.StreamUtil;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -94,10 +82,6 @@ public class PreAuthActionsHandler {
             if (!resolveDeployment()) return true;
             handleTestAvailable();
             return true;
-        } else if (requestUri.endsWith(AdapterConstants.K_JWKS)) {
-            if (!resolveDeployment()) return true;
-            handleJwksRequest();
-            return true;
         }
         return false;
     }
@@ -155,7 +139,7 @@ public class PreAuthActionsHandler {
             } else {
                 log.debugf("logout of all sessions for application '%s'", action.getResource());
                 if (action.getNotBefore() > deployment.getNotBefore()) {
-                    deployment.updateNotBefore(action.getNotBefore());
+                    deployment.setNotBefore(action.getNotBefore());
                 }
                 userSessionManagement.logoutAll();
             }
@@ -177,7 +161,7 @@ public class PreAuthActionsHandler {
             }
             PushNotBeforeAction action = JsonSerialization.readValue(token.getContent(), PushNotBeforeAction.class);
             if (!validateAction(action)) return;
-            deployment.updateNotBefore(action.getNotBefore());
+            deployment.setNotBefore(action.getNotBefore());
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
@@ -214,8 +198,7 @@ public class PreAuthActionsHandler {
 
         try {
             JWSInput input = new JWSInput(token);
-            PublicKey publicKey = AdapterRSATokenVerifier.getPublicKey(input.getHeader().getKeyId(), deployment);
-            if (RSAProvider.verify(input, publicKey)) {
+            if (RSAProvider.verify(input, deployment.getRealmKey())) {
                 return input;
             }
         } catch (JWSInputException ignore) {
@@ -257,26 +240,4 @@ public class PreAuthActionsHandler {
         }
     }
 
-    protected void handleJwksRequest() {
-        try {
-            JSONWebKeySet jwks = new JSONWebKeySet();
-            ClientCredentialsProvider clientCredentialsProvider = deployment.getClientAuthenticator();
-
-            // For now, just get signature key from JWT provider. We can add more if we support encryption etc.
-            if (clientCredentialsProvider instanceof JWTClientCredentialsProvider) {
-                PublicKey publicKey = ((JWTClientCredentialsProvider) clientCredentialsProvider).getPublicKey();
-                JWK jwk = JWKBuilder.create().rs256(publicKey);
-                jwks.setKeys(new JWK[] { jwk });
-            } else {
-                jwks.setKeys(new JWK[] {});
-            }
-
-            facade.getResponse().setStatus(200);
-            facade.getResponse().setHeader("Content-Type", "application/json");
-            JsonSerialization.writeValueToStream(facade.getResponse().getOutputStream(), jwks);
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/QueryParamterTokenRequestAuthenticator.java

@@ -22,8 +22,6 @@ import org.keycloak.adapters.spi.HttpFacade;
 
 /**
  * @author <a href="mailto:froehlich.ch@gmail.com">Christian Froehlich</a>
- * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
- * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  * @version $Revision: 1 $
  */
 public class QueryParamterTokenRequestAuthenticator extends BearerTokenRequestAuthenticator {
@@ -35,9 +33,6 @@ public class QueryParamterTokenRequestAuthenticator extends BearerTokenRequestAu
     }
 
     public AuthOutcome authenticate(HttpFacade exchange) {
-        if(!deployment.isOAuthQueryParameterEnabled()) {
-            return AuthOutcome.NOT_ATTEMPTED;
-        }
         tokenString = null;
         tokenString = getAccessTokenFromQueryParamter(exchange);
         if (tokenString == null || tokenString.trim().isEmpty()) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RefreshableKeycloakSecurityContext.java

@@ -20,7 +20,7 @@ package org.keycloak.adapters;
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
+import org.keycloak.RSATokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.Time;
 import org.keycloak.representations.AccessToken;
@@ -130,7 +130,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
         String tokenString = response.getToken();
         AccessToken token = null;
         try {
-            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
             log.debug("Token Verification succeeded!");
         } catch (VerificationException e) {
             log.error("failed verification of token");
@@ -144,7 +144,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
         }
 
         if (response.getNotBeforePolicy() > deployment.getNotBefore()) {
-            deployment.updateNotBefore(response.getNotBeforePolicy());
+            deployment.setNotBefore(response.getNotBeforePolicy());
         }
 
         this.token = token;
@@ -155,9 +155,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
             this.refreshToken = response.getRefreshToken();
         }
         this.tokenString = tokenString;
-        if (tokenStore != null) {
-            tokenStore.refreshCallback(this);
-        }
+        tokenStore.refreshCallback(this);
         return true;
     }
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RequestAuthenticator.java

@@ -17,14 +17,11 @@
 
 package org.keycloak.adapters;
 
-import java.util.Collections;
-import java.util.List;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.common.enums.SslRequired;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -119,12 +116,6 @@ public abstract class RequestAuthenticator {
             return AuthOutcome.NOT_ATTEMPTED;
         }
 
-        if (isAutodetectedBearerOnly(facade.getRequest())) {
-            challenge = bearer.getChallenge();
-            log.debug("NOT_ATTEMPTED: Treating as bearer only");
-            return AuthOutcome.NOT_ATTEMPTED;
-        }
-
         if (log.isTraceEnabled()) {
             log.trace("try oauth");
         }
@@ -161,43 +152,12 @@ public abstract class RequestAuthenticator {
 
     protected boolean verifySSL() {
         if (!facade.getRequest().isSecure() && deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr())) {
-            log.warnf("SSL is required to authenticate. Remote address %s is secure: %s, SSL required for: %s .",
-                    facade.getRequest().getRemoteAddr(), facade.getRequest().isSecure(), deployment.getSslRequired().name());
+            log.warn("SSL is required to authenticate");
             return true;
         }
         return false;
     }
 
-    protected boolean isAutodetectedBearerOnly(HttpFacade.Request request) {
-        if (!deployment.isAutodetectBearerOnly()) return false;
-
-        String headerValue = facade.getRequest().getHeader("X-Requested-With");
-        if (headerValue != null && headerValue.equalsIgnoreCase("XMLHttpRequest")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("Faces-Request");
-        if (headerValue != null && headerValue.startsWith("partial/")) {
-            return true;
-        }
-
-        headerValue = facade.getRequest().getHeader("SOAPAction");
-        if (headerValue != null) {
-            return true;
-        }
-
-        List<String> accepts = facade.getRequest().getHeaders("Accept");
-        if (accepts == null) accepts = Collections.emptyList();
-
-        for (String accept : accepts) {
-            if (accept.contains("text/html") || accept.contains("text/*") || accept.contains("*/*")) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
     protected abstract OAuthRequestAuthenticator createOAuthAuthenticator();
 
     protected BearerTokenRequestAuthenticator createBearerTokenAuthenticator() {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/ServerRequest.java

@@ -26,14 +26,12 @@ import org.apache.http.client.methods.HttpPost;
 import org.apache.http.message.BasicNameValuePair;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
-import org.keycloak.common.util.HostUtils;
-import org.keycloak.common.util.KeycloakUriBuilder;
-import org.keycloak.common.util.StreamUtil;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.common.util.HostUtils;
 import org.keycloak.util.JsonSerialization;
-
-import org.jboss.logging.Logger;
+import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.common.util.StreamUtil;
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
@@ -48,8 +46,6 @@ import java.util.List;
  */
 public class ServerRequest {
 
-	private static Logger logger = Logger.getLogger(ServerRequest.class);
-
     public static class HttpFailure extends Exception {
         private int status;
         private String error;
@@ -140,62 +136,6 @@ public class ServerRequest {
         }
     }
 
-    // https://tools.ietf.org/html/rfc7636#section-4
-    public static AccessTokenResponse invokeAccessCodeToToken(KeycloakDeployment deployment, String code, String redirectUri, String sessionId, String codeVerifier) throws IOException, HttpFailure {
-        List<NameValuePair> formparams = new ArrayList<>();
-        redirectUri = stripOauthParametersFromRedirect(redirectUri);
-        formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, "authorization_code"));
-        formparams.add(new BasicNameValuePair(OAuth2Constants.CODE, code));
-        formparams.add(new BasicNameValuePair(OAuth2Constants.REDIRECT_URI, redirectUri));
-        if (sessionId != null) {
-            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_STATE, sessionId));
-            formparams.add(new BasicNameValuePair(AdapterConstants.CLIENT_SESSION_HOST, HostUtils.getHostName()));
-        }
-        // https://tools.ietf.org/html/rfc7636#section-4
-        if (codeVerifier != null) {
-            logger.debugf("add to POST parameters of Token Request, codeVerifier = %s", codeVerifier);
-            formparams.add(new BasicNameValuePair(OAuth2Constants.CODE_VERIFIER, codeVerifier));
-        } else {
-            logger.debug("add to POST parameters of Token Request without codeVerifier");
-        }
-
-        HttpPost post = new HttpPost(deployment.getTokenUrl());
-        ClientCredentialsProviderUtils.setClientCredentials(deployment, post, formparams);
-
-        UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
-        post.setEntity(form);
-        HttpResponse response = deployment.getClient().execute(post);
-        int status = response.getStatusLine().getStatusCode();
-        HttpEntity entity = response.getEntity();
-        if (status != 200) {
-            error(status, entity);
-        }
-        if (entity == null) {
-            throw new HttpFailure(status, null);
-        }
-        InputStream is = entity.getContent();
-        try {
-            ByteArrayOutputStream os = new ByteArrayOutputStream();
-            int c;
-            while ((c = is.read()) != -1) {
-                os.write(c);
-            }
-            byte[] bytes = os.toByteArray();
-            String json = new String(bytes);
-            try {
-                return JsonSerialization.readValue(json, AccessTokenResponse.class);
-            } catch (IOException e) {
-                throw new IOException(json, e);
-            }
-        } finally {
-            try {
-                is.close();
-            } catch (IOException ignored) {
-
-            }
-        }
-    }
-
     public static AccessTokenResponse invokeRefresh(KeycloakDeployment deployment, String refreshToken) throws IOException, HttpFailure {
         List<NameValuePair> formparams = new ArrayList<NameValuePair>();
         formparams.add(new BasicNameValuePair(OAuth2Constants.GRANT_TYPE, OAuth2Constants.REFRESH_TOKEN));

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/ClientCredentialsProvider.java

@@ -17,10 +17,10 @@
 
 package org.keycloak.adapters.authentication;
 
-import org.keycloak.adapters.KeycloakDeployment;
-
 import java.util.Map;
 
+import org.keycloak.adapters.KeycloakDeployment;
+
 /**
  * The simple SPI for authenticating clients/applications . It's used by adapter during all OIDC backchannel requests to Keycloak server
  * (codeToToken exchange, refresh token or backchannel logout) . You can also use it in your application during direct access grants or service account request

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/ClientCredentialsProviderUtils.java

@@ -17,12 +17,6 @@
 
 package org.keycloak.adapters.authentication;
 
-import org.apache.http.NameValuePair;
-import org.apache.http.client.methods.HttpPost;
-import org.apache.http.message.BasicNameValuePair;
-import org.jboss.logging.Logger;
-import org.keycloak.adapters.KeycloakDeployment;
-
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
@@ -30,6 +24,12 @@ import java.util.Map;
 import java.util.ServiceConfigurationError;
 import java.util.ServiceLoader;
 
+import org.apache.http.NameValuePair;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.message.BasicNameValuePair;
+import org.jboss.logging.Logger;
+import org.keycloak.adapters.KeycloakDeployment;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/ClientIdAndSecretCredentialsProvider.java

@@ -17,14 +17,14 @@
 
 package org.keycloak.adapters.authentication;
 
+import java.util.Map;
+
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.representations.idm.CredentialRepresentation;
 import org.keycloak.util.BasicAuthHelper;
 
-import java.util.Map;
-
 /**
  * Traditional OAuth2 authentication of clients based on client_id and client_secret
  *
@@ -32,7 +32,7 @@ import java.util.Map;
  */
 public class ClientIdAndSecretCredentialsProvider implements ClientCredentialsProvider {
 
-    private static Logger logger = Logger.getLogger(ClientIdAndSecretCredentialsProvider.class);
+    private static Logger logger = Logger.getLogger(ClientCredentialsProviderUtils.class);
 
     public static final String PROVIDER_ID = CredentialRepresentation.SECRET;
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/JWTClientCredentialsProvider.java

@@ -17,24 +17,16 @@
 
 package org.keycloak.adapters.authentication;
 
-import java.security.KeyPair;
-import java.security.PublicKey;
+import java.security.PrivateKey;
 import java.util.Map;
 
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.AdapterUtils;
 import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.jose.jwk.JWKBuilder;
 import org.keycloak.jose.jws.JWSBuilder;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.common.util.KeystoreUtil;
 import org.keycloak.common.util.Time;
-import org.keycloak.jose.jws.JWSBuilder;
-import org.keycloak.representations.JsonWebToken;
-
-import java.security.PrivateKey;
-import java.util.Map;
 
 /**
  * Client authentication based on JWT signed by client private key .
@@ -46,9 +38,7 @@ public class JWTClientCredentialsProvider implements ClientCredentialsProvider {
 
     public static final String PROVIDER_ID = "jwt";
 
-    private KeyPair keyPair;
-    private JWK publicKeyJwk;
-
+    private PrivateKey privateKey;
     private int tokenTimeout;
 
     @Override
@@ -56,9 +46,8 @@ public class JWTClientCredentialsProvider implements ClientCredentialsProvider {
         return PROVIDER_ID;
     }
 
-    public void setupKeyPair(KeyPair keyPair) {
-        this.keyPair = keyPair;
-        this.publicKeyJwk = JWKBuilder.create().rs256(keyPair.getPublic());
+    public void setPrivateKey(PrivateKey privateKey) {
+        this.privateKey = privateKey;
     }
 
     public void setTokenTimeout(int tokenTimeout) {
@@ -69,10 +58,6 @@ public class JWTClientCredentialsProvider implements ClientCredentialsProvider {
         return tokenTimeout;
     }
 
-    public PublicKey getPublicKey() {
-        return keyPair.getPublic();
-    }
-
     @Override
     public void init(KeycloakDeployment deployment, Object config) {
         if (config == null || !(config instanceof Map)) {
@@ -103,9 +88,7 @@ public class JWTClientCredentialsProvider implements ClientCredentialsProvider {
         if (clientKeyAlias == null) {
             clientKeyAlias = deployment.getResourceName();
         }
-
-        KeyPair keyPair = KeystoreUtil.loadKeyPairFromKeystore(clientKeystoreFile, clientKeystorePassword, clientKeyPassword, clientKeyAlias, clientKeystoreFormat);
-        setupKeyPair(keyPair);
+        this.privateKey = KeystoreUtil.loadPrivateKeyFromKeystore(clientKeystoreFile, clientKeystorePassword, clientKeyPassword, clientKeyAlias, clientKeystoreFormat);
 
         this.tokenTimeout = asInt(cfg, "token-timeout", 10);
     }
@@ -137,9 +120,8 @@ public class JWTClientCredentialsProvider implements ClientCredentialsProvider {
     public String createSignedRequestToken(String clientId, String realmInfoUrl) {
         JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
         return new JWSBuilder()
-                .kid(publicKeyJwk.getKeyId())
                 .jsonContent(jwt)
-                .rsa256(keyPair.getPrivate());
+                .rsa256(privateKey);
     }
 
     protected JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/JWTClientSecretCredentialsProvider.java

@@ -1,97 +0,0 @@
-package org.keycloak.adapters.authentication;
-
-import java.io.UnsupportedEncodingException;
-import java.util.Map;
-
-import javax.crypto.SecretKey;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.jboss.logging.Logger;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.AdapterUtils;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.util.Time;
-import org.keycloak.jose.jws.JWSBuilder;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.representations.JsonWebToken;
-
-/**
- * Client authentication based on JWT signed by client secret instead of private key .
- * See <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">specs</a> for more details.
- *
- * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
- */
-public class JWTClientSecretCredentialsProvider implements ClientCredentialsProvider {
-    
-	private static final Logger logger = Logger.getLogger(JWTClientSecretCredentialsProvider.class);
-	
-    public static final String PROVIDER_ID = "secret-jwt";
-    
-    private SecretKey clientSecret;
-    
-    @Override
-    public String getId() {
-        return PROVIDER_ID;
-    }
-    
-    @Override
-    public void init(KeycloakDeployment deployment, Object config) {
-        if (config == null || !(config instanceof Map)) {
-            throw new RuntimeException("Configuration of jwt credentials by client secret is missing or incorrect for client '" + deployment.getResourceName() + "'. Check your adapter configuration");
-        }
-        
-        Map<String, Object> cfg = (Map<String, Object>) config;
-        String clientSecretString = (String) cfg.get("secret");
-        if (clientSecretString == null) {
-            throw new RuntimeException("Missing parameter secret-jwt in configuration of jwt for client " + deployment.getResourceName());
-        }
-        setClientSecret(clientSecretString); 
-    }
-    
-    @Override
-    public void setClientCredentials(KeycloakDeployment deployment, Map<String, String> requestHeaders, Map<String, String> formParams) {
-        String signedToken = createSignedRequestToken(deployment.getResourceName(), deployment.getRealmInfoUrl());
-        formParams.put(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT);
-        formParams.put(OAuth2Constants.CLIENT_ASSERTION, signedToken);
-    }
-   
-    public void setClientSecret(String clientSecretString) {
-        // Get client secret and validate signature
-        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
-        // The HMAC (Hash-based Message Authentication Code) is calculated using the octets of the UTF-8 representation of the client_secret as the shared key. 
-        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>
-        // because it must be implemented in every java platform.
-    	try {
-            clientSecret = new SecretKeySpec(clientSecretString.getBytes("UTF-8"), "HmacSHA256");
-        } catch (UnsupportedEncodingException e) {
-            throw new RuntimeException("Failed to create secret key spec due to unsupported encoding.");
-        }
-    }
-    
-    public String createSignedRequestToken(String clientId, String realmInfoUrl) {
-        JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
-        // JOSE header {"alg":"HS256","typ" : "JWT"} no need "kid" due to using only one registered client secret.
-        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>.
-        // because it must be implemented in every java platform.
-        return new JWSBuilder().jsonContent(jwt).hmac256(clientSecret);
-    }
-
-    private JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
-        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
-        // JWT claims is the same as one by private_key_jwt
-        
-        JsonWebToken reqToken = new JsonWebToken();
-        reqToken.id(AdapterUtils.generateId());
-        reqToken.issuer(clientId);
-        reqToken.subject(clientId);
-        reqToken.audience(realmInfoUrl);
-
-        int now = Time.currentTime();
-        reqToken.issuedAt(now);
-        // the same as in KEYCLOAK-2986, JWTClientCredentialsProvider's timeout field
-        reqToken.expiration(now + 10);
-        reqToken.notBefore(now);
-        return reqToken;
-    }
-
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -17,25 +17,27 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
-import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.OIDCHttpFacade;
 import org.keycloak.adapters.spi.HttpFacade.Request;
+import org.keycloak.adapters.spi.HttpFacade.Response;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.ClientAuthorizationContext;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.resource.ProtectedResource;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.MethodConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
 
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -45,7 +47,7 @@ public abstract class AbstractPolicyEnforcer {
     private final PolicyEnforcerConfig enforcerConfig;
     private final PolicyEnforcer policyEnforcer;
 
-    private Map<String, PathConfig> paths;
+    private List<PathConfig> paths;
     private AuthzClient authzClient;
     private PathMatcher pathMatcher;
 
@@ -53,8 +55,8 @@ public abstract class AbstractPolicyEnforcer {
         this.policyEnforcer = policyEnforcer;
         this.enforcerConfig = policyEnforcer.getEnforcerConfig();
         this.authzClient = policyEnforcer.getClient();
-        this.pathMatcher = policyEnforcer.getPathMatcher();
-        this.paths = policyEnforcer.getPaths();
+        this.pathMatcher = new PathMatcher();
+        this.paths = new ArrayList<>(policyEnforcer.getPaths());
     }
 
     public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
@@ -64,72 +66,56 @@ public abstract class AbstractPolicyEnforcer {
             return createEmptyAuthorizationContext(true);
         }
 
+        AccessToken accessToken = httpFacade.getSecurityContext().getToken();
         Request request = httpFacade.getRequest();
-        String path = getPath(request);
+        Response response = httpFacade.getResponse();
+        String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+        String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
         PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
-        KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
 
-        if (securityContext == null) {
-            if (pathConfig != null) {
-                challenge(pathConfig, getRequiredScopes(pathConfig, request), httpFacade);
+        LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
+
+        if (pathConfig == null) {
+            if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
+                return createAuthorizationContext(accessToken);
             }
+
+            LOGGER.debugf("Could not find a configuration for path [%s]", path);
+            response.sendError(403, "Could not find a configuration for path [" + path + "].");
+
             return createEmptyAuthorizationContext(false);
         }
 
-        AccessToken accessToken = securityContext.getToken();
+        PathConfig actualPathConfig = resolvePathConfig(pathConfig, request);
+        Set<String> requiredScopes = getRequiredScopes(actualPathConfig, request);
 
-        if (accessToken != null) {
-            LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
-
-            if (pathConfig == null) {
-                if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
-                    return createAuthorizationContext(accessToken, null);
-                }
-
-                LOGGER.debugf("Could not find a configuration for path [%s]", path);
-
-                if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
-                    return createAuthorizationContext(accessToken, null);
-                }
-
-                handleAccessDenied(httpFacade);
-
-                return createEmptyAuthorizationContext(false);
-            }
-
-            if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                return createEmptyAuthorizationContext(true);
-            }
-
-            MethodConfig methodConfig = getRequiredScopes(pathConfig, request);
-
-            if (isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
-                try {
-                    return createAuthorizationContext(accessToken, pathConfig);
-                } catch (Exception e) {
-                    throw new RuntimeException("Error processing path [" + pathConfig.getPath() + "].", e);
-                }
+        if (isAuthorized(actualPathConfig, requiredScopes, accessToken, httpFacade)) {
+            try {
+                return createAuthorizationContext(accessToken);
+            } catch (Exception e) {
+                throw new RuntimeException("Error processing path [" + actualPathConfig.getPath() + "].", e);
             }
+        }
 
+        if (!challenge(actualPathConfig, requiredScopes, httpFacade)) {
             LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
-
-            if (!challenge(pathConfig, methodConfig, httpFacade)) {
-                LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
-                handleAccessDenied(httpFacade);
-            }
+            response.sendError(403, "Authorization failed.");
         }
 
         return createEmptyAuthorizationContext(false);
     }
 
-    protected abstract boolean challenge(PathConfig pathConfig, MethodConfig methodConfig, OIDCHttpFacade facade);
+    protected abstract boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade);
 
-    protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         Request request = httpFacade.getRequest();
         PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
+        String accessDeniedPath = enforcerConfig.getAccessDeniedPath();
 
-        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
-            return true;
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
         }
 
         AccessToken.Authorization authorization = accessToken.getAuthorization();
@@ -139,18 +125,15 @@ public abstract class AbstractPolicyEnforcer {
         }
 
         List<Permission> permissions = authorization.getPermissions();
-        boolean hasPermission = false;
 
         for (Permission permission : permissions) {
-            if (permission.getResourceId() != null) {
+            if (permission.getResourceSetId() != null) {
                 if (isResourcePermission(actualPathConfig, permission)) {
-                    hasPermission = true;
-
                     if (actualPathConfig.isInstance() && !matchResourcePermission(actualPathConfig, permission)) {
                         continue;
-                    }
 
-                    if (hasResourceScopePermission(methodConfig, permission)) {
+                    }
+                    if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
                         LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, permissions);
                         if (request.getMethod().equalsIgnoreCase("DELETE") && actualPathConfig.isInstance()) {
                             this.paths.remove(actualPathConfig);
@@ -159,60 +142,20 @@ public abstract class AbstractPolicyEnforcer {
                     }
                 }
             } else {
-                if (hasResourceScopePermission(methodConfig, permission)) {
-                    hasPermission = true;
+                if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
                     return true;
                 }
             }
         }
 
-        if (!hasPermission && EnforcementMode.PERMISSIVE.equals(actualPathConfig.getEnforcementMode())) {
-            return true;
-        }
-
-        LOGGER.debugf("Authorization FAILED for path [%s]. Not enough permissions [%s].", actualPathConfig, permissions);
+        LOGGER.debugf("Authorization FAILED for path [%s]. No enough permissions [%s].", actualPathConfig, permissions);
 
         return false;
     }
 
-    protected void handleAccessDenied(OIDCHttpFacade httpFacade) {
-        httpFacade.getResponse().sendError(403);
-    }
-
-    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
-        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
-
-        if (accessDeniedPath != null) {
-            if (request.getURI().contains(accessDeniedPath)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private boolean hasResourceScopePermission(MethodConfig methodConfig, Permission permission) {
-        List<String> requiredScopes = methodConfig.getScopes();
+    private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
         Set<String> allowedScopes = permission.getScopes();
-
-        if (allowedScopes.isEmpty()) {
-            return true;
-        }
-
-        PolicyEnforcerConfig.ScopeEnforcementMode enforcementMode = methodConfig.getScopesEnforcementMode();
-
-        if (PolicyEnforcerConfig.ScopeEnforcementMode.ALL.equals(enforcementMode)) {
-            return allowedScopes.containsAll(requiredScopes);
-        }
-
-        if (PolicyEnforcerConfig.ScopeEnforcementMode.ANY.equals(enforcementMode)) {
-            for (String requiredScope : requiredScopes) {
-                if (allowedScopes.contains(requiredScope)) {
-                    return true;
-                }
-            }
-        }
-
-        return requiredScopes.isEmpty();
+        return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
     }
 
     protected AuthzClient getAuthzClient() {
@@ -228,7 +171,7 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private AuthorizationContext createEmptyAuthorizationContext(final boolean granted) {
-        return new ClientAuthorizationContext(authzClient) {
+        return new AuthorizationContext() {
             @Override
             public boolean hasPermission(String resourceName, String scopeName) {
                 return granted;
@@ -256,30 +199,53 @@ public abstract class AbstractPolicyEnforcer {
         };
     }
 
-    private String getPath(Request request) {
-        return request.getRelativePath();
-    }
+    private PathConfig resolvePathConfig(PathConfig originalConfig, Request request) {
+        if (originalConfig.hasPattern()) {
+            String pathInfo = URI.create(request.getURI()).getPath().substring(1);
+            String path = pathInfo.substring(pathInfo.indexOf('/'), pathInfo.length());
+            ProtectedResource resource = this.authzClient.protection().resource();
+            Set<String> search = resource.findByFilter("uri=" + path);
 
-    private MethodConfig getRequiredScopes(PathConfig pathConfig, Request request) {
-        String method = request.getMethod();
+            if (!search.isEmpty()) {
+                // resource does exist on the server, cache it
+                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
+                PathConfig config = new PathConfig();
 
-        for (MethodConfig methodConfig : pathConfig.getMethods()) {
-            if (methodConfig.getMethod().equals(method)) {
-                return methodConfig;
+                config.setId(targetResource.getId());
+                config.setName(targetResource.getName());
+                config.setType(targetResource.getType());
+                config.setPath(targetResource.getUri());
+                config.setScopes(originalConfig.getScopes());
+                config.setMethods(originalConfig.getMethods());
+                config.setParentConfig(originalConfig);
+
+                this.paths.add(config);
+
+                return config;
             }
         }
 
-        MethodConfig methodConfig = new MethodConfig();
-
-        methodConfig.setMethod(request.getMethod());
-        methodConfig.setScopes(pathConfig.getScopes());
-        methodConfig.setScopesEnforcementMode(PolicyEnforcerConfig.ScopeEnforcementMode.ANY);
-
-        return methodConfig;
+        return originalConfig;
     }
 
-    private AuthorizationContext createAuthorizationContext(AccessToken accessToken, PathConfig pathConfig) {
-        return new ClientAuthorizationContext(accessToken, pathConfig, this.paths, authzClient);
+    private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
+        Set<String> requiredScopes = new HashSet<>();
+
+        requiredScopes.addAll(pathConfig.getScopes());
+
+        String method = request.getMethod();
+
+        for (PolicyEnforcerConfig.MethodConfig methodConfig : pathConfig.getMethods()) {
+            if (methodConfig.getMethod().equals(method)) {
+                requiredScopes.addAll(methodConfig.getScopes());
+            }
+        }
+
+        return requiredScopes;
+    }
+
+    private AuthorizationContext createAuthorizationContext(AccessToken accessToken) {
+        return new AuthorizationContext(accessToken, this.paths);
     }
 
     private boolean isResourcePermission(PathConfig actualPathConfig, Permission permission) {
@@ -295,6 +261,6 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private boolean matchResourcePermission(PathConfig actualPathConfig, Permission permission) {
-        return permission.getResourceId().equals(actualPathConfig.getId());
+        return permission.getResourceSetId().equals(actualPathConfig.getId());
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/BearerTokenPolicyEnforcer.java

@@ -17,17 +17,17 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.HashSet;
-
 import org.jboss.logging.Logger;
 import org.keycloak.adapters.OIDCHttpFacade;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.representation.PermissionRequest;
 import org.keycloak.authorization.client.resource.PermissionResource;
 import org.keycloak.authorization.client.resource.ProtectionResource;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-import org.keycloak.representations.idm.authorization.PermissionRequest;
+
+import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -41,41 +41,40 @@ public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade facade) {
-        HttpFacade.Response response = facade.getResponse();
-        AuthzClient authzClient = getAuthzClient();
-        String ticket = getPermissionTicket(pathConfig, methodConfig, authzClient);
-
-        if (ticket == null) {
-            response.setStatus(403);
-            return true;
-        }
-
-        String realm = authzClient.getConfiguration().getRealm();
-        String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString();
-        response.setStatus(401);
-        StringBuilder wwwAuthenticate = new StringBuilder("UMA realm=\"").append(realm).append("\"").append(",as_uri=\"").append(authorizationServerUri).append("\"");
-
-        if (ticket != null) {
-            wwwAuthenticate.append(",ticket=\"").append(ticket).append("\"");
-        }
-
-        response.setHeader("WWW-Authenticate", wwwAuthenticate.toString());
-        if (LOGGER.isDebugEnabled()) {
-            LOGGER.debug("Sending UMA challenge");
+    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        if (getEnforcerConfig().getUmaProtocolConfig() != null) {
+            challengeUmaAuthentication(pathConfig, requiredScopes, facade);
+        } else {
+            challengeEntitlementAuthentication(facade);
         }
         return true;
     }
 
-    private String getPermissionTicket(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AuthzClient authzClient) {
-        if (getEnforcerConfig().getUserManagedAccess() != null) {
-            ProtectionResource protection = authzClient.protection();
-            PermissionResource permission = protection.permission();
-            PermissionRequest permissionRequest = new PermissionRequest();
-            permissionRequest.setResourceId(pathConfig.getId());
-            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
-            return permission.create(permissionRequest).getTicket();
-        }
-        return null;
+    private void challengeEntitlementAuthentication(OIDCHttpFacade facade) {
+        HttpFacade.Response response = facade.getResponse();
+        AuthzClient authzClient = getAuthzClient();
+        String clientId = authzClient.getConfiguration().getClientId();
+        String  authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/entitlement";
+        response.setStatus(401);
+        response.setHeader("WWW-Authenticate", "KC_ETT realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\"");
+    }
+
+    private void challengeUmaAuthentication(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        HttpFacade.Response response = facade.getResponse();
+        AuthzClient authzClient = getAuthzClient();
+        String ticket = getPermissionTicket(pathConfig, requiredScopes, authzClient);
+        String clientId = authzClient.getConfiguration().getClientId();
+        String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/authorize";
+        response.setStatus(401);
+        response.setHeader("WWW-Authenticate", "UMA realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\",ticket=\"" + ticket + "\"");
+    }
+
+    private String getPermissionTicket(PathConfig pathConfig, Set<String> requiredScopes, AuthzClient authzClient) {
+        ProtectionResource protection = authzClient.protection();
+        PermissionResource permission = protection.permission();
+        PermissionRequest permissionRequest = new PermissionRequest();
+        permissionRequest.setResourceSetId(pathConfig.getId());
+        permissionRequest.setScopes(requiredScopes);
+        return permission.forResource(permissionRequest).getTicket();
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -17,25 +17,27 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.ArrayList;
-import java.util.HashSet;
-
 import org.jboss.logging.Logger;
-import org.keycloak.KeycloakSecurityContext;
+import org.keycloak.RSATokenVerifier;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthorizationDeniedException;
 import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.representation.AuthorizationRequest;
+import org.keycloak.authorization.client.representation.AuthorizationResponse;
+import org.keycloak.authorization.client.representation.EntitlementRequest;
+import org.keycloak.authorization.client.representation.EntitlementResponse;
+import org.keycloak.authorization.client.representation.PermissionRequest;
+import org.keycloak.authorization.client.representation.PermissionResponse;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-import org.keycloak.representations.idm.authorization.AuthorizationRequest;
-import org.keycloak.representations.idm.authorization.AuthorizationResponse;
 import org.keycloak.representations.idm.authorization.Permission;
-import org.keycloak.representations.idm.authorization.PermissionRequest;
-import org.keycloak.representations.idm.authorization.PermissionResponse;
+import org.keycloak.util.JsonSerialization;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -49,52 +51,45 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean isAuthorized(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+        int retry = 2;
         AccessToken original = accessToken;
 
-        if (super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
-            return true;
+        while (retry > 0) {
+            if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+                return true;
+            }
+
+            accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
+
+            if (accessToken == null) {
+                return false;
+            }
+
+            AccessToken.Authorization authorization = original.getAuthorization();
+
+            if (authorization == null) {
+                authorization = new AccessToken.Authorization();
+                authorization.setPermissions(new ArrayList<Permission>());
+            }
+
+            AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
+
+            if (newAuthorization != null) {
+                authorization.getPermissions().addAll(newAuthorization.getPermissions());
+            }
+
+            original.setAuthorization(authorization);
+
+            retry--;
         }
 
-        accessToken = requestAuthorizationToken(pathConfig, methodConfig, httpFacade);
-
-        if (accessToken == null) {
-            return false;
-        }
-
-        AccessToken.Authorization authorization = original.getAuthorization();
-
-        if (authorization == null) {
-            authorization = new AccessToken.Authorization();
-            authorization.setPermissions(new ArrayList<Permission>());
-        }
-
-        AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
-
-        if (newAuthorization != null) {
-            authorization.getPermissions().addAll(newAuthorization.getPermissions());
-        }
-
-        original.setAuthorization(authorization);
-
-        return super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade);
+        return false;
     }
 
     @Override
-    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade facade) {
-        handleAccessDenied(facade);
-        return true;
-    }
-
-    @Override
-    protected void handleAccessDenied(OIDCHttpFacade facade) {
-        KeycloakSecurityContext securityContext = facade.getSecurityContext();
-
-        if (securityContext == null) {
-            return;
-        }
-
-        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
+    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        String accessDeniedPath = getEnforcerConfig().getAccessDeniedPath();
         HttpFacade.Response response = facade.getResponse();
 
         if (accessDeniedPath != null) {
@@ -103,47 +98,51 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         } else {
             response.sendError(403);
         }
+
+        return true;
     }
 
-    private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
+    private AccessToken requestAuthorizationToken(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade httpFacade) {
         try {
-            KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
-            String accessTokenString = securityContext.getTokenString();
+            String accessToken = httpFacade.getSecurityContext().getTokenString();
             AuthzClient authzClient = getAuthzClient();
             KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
-            PermissionRequest permissionRequest = new PermissionRequest();
 
-            permissionRequest.setResourceId(pathConfig.getId());
-            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
+            if (getEnforcerConfig().getUmaProtocolConfig() != null) {
+                LOGGER.debug("Obtaining authorization for  authenticated user.");
+                PermissionRequest permissionRequest = new PermissionRequest();
 
-            AccessToken accessToken = securityContext.getToken();
-            AuthorizationRequest authzRequest;
+                permissionRequest.setResourceSetId(pathConfig.getId());
+                permissionRequest.setScopes(requiredScopes);
 
-            if (getEnforcerConfig().getUserManagedAccess() != null) {
-                PermissionResponse permissionResponse = authzClient.protection().permission().create(permissionRequest);
-                authzRequest = new AuthorizationRequest();
-                authzRequest.setTicket(permissionResponse.getTicket());
+                PermissionResponse permissionResponse = authzClient.protection().permission().forResource(permissionRequest);
+                AuthorizationRequest authzRequest = new AuthorizationRequest(permissionResponse.getTicket());
+                AuthorizationResponse authzResponse = authzClient.authorization(accessToken).authorize(authzRequest);
+
+                if (authzResponse != null) {
+                    return RSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment.getRealmKey(), deployment.getRealmInfoUrl());
+                }
+
+                return null;
             } else {
-                authzRequest = new AuthorizationRequest();
-                if (accessToken.getAuthorization() != null) {
-                    authzRequest.addPermission(pathConfig.getId(), methodConfig.getScopes());
+                LOGGER.debug("Obtaining entitlements for authenticated user.");
+                AccessToken token = httpFacade.getSecurityContext().getToken();
+
+                if (token.getAuthorization() == null) {
+                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).getAll(authzClient.getConfiguration().getClientId());
+                    return RSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment.getRealmKey(), deployment.getRealmInfoUrl());
+                } else {
+                    EntitlementRequest request = new EntitlementRequest();
+                    PermissionRequest permissionRequest = new PermissionRequest();
+                    permissionRequest.setResourceSetId(pathConfig.getId());
+                    permissionRequest.setResourceSetName(pathConfig.getName());
+                    permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
+                    request.addPermission(permissionRequest);
+                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getClientId(), request);
+                    return RSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment.getRealmKey(), deployment.getRealmInfoUrl());
                 }
             }
-
-            if (accessToken.getAuthorization() != null) {
-                authzRequest.setRpt(accessTokenString);
-            }
-
-            LOGGER.debug("Obtaining authorization for authenticated user.");
-            AuthorizationResponse authzResponse = authzClient.authorization(accessTokenString).authorize(authzRequest);
-
-            if (authzResponse != null) {
-                return AdapterRSATokenVerifier.verifyToken(authzResponse.getToken(), deployment);
-            }
-
-            return null;
         } catch (AuthorizationDeniedException e) {
-            LOGGER.debug("Authorization denied", e);
             return null;
         } catch (Exception e) {
             throw new RuntimeException("Unexpected error during authorization request.", e);

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathCache.java

@@ -1,170 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.concurrent.atomic.AtomicBoolean;
-import java.util.concurrent.locks.LockSupport;
-
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class PathCache {
-
-    /**
-     * The load factor.
-     */
-    private static final float DEFAULT_LOAD_FACTOR = 0.75f;
-
-    private final Map<String, CacheEntry> cache;
-
-    private final AtomicBoolean writing = new AtomicBoolean(false);
-
-    private final long maxAge;
-
-    /**
-     * Creates a new instance.
-     *
-     * @param maxEntries the maximum number of entries to keep in the cache
-     */
-    public PathCache(int maxEntries) {
-        this(maxEntries, -1);
-    }
-
-    /**
-     * Creates a new instance.
-     *
-     * @param maxEntries the maximum number of entries to keep in the cache
-     * @param maxAge the time in milliseconds that an entry can stay in the cache. If {@code -1}, entries never expire
-     */
-    public PathCache(final int maxEntries, long maxAge) {
-        cache = new LinkedHashMap<String, CacheEntry>(16, DEFAULT_LOAD_FACTOR, true) {
-            @Override
-            protected boolean removeEldestEntry(Map.Entry eldest) {
-                return cache.size()  > maxEntries;
-            }
-        };
-        this.maxAge = maxAge;
-    }
-
-    public void put(String uri, PathConfig newValue) {
-        try {
-            if (parkForWriteAndCheckInterrupt()) {
-                return;
-            }
-
-            CacheEntry cacheEntry = cache.get(uri);
-
-            if (cacheEntry == null) {
-                cache.put(uri, new CacheEntry(uri, newValue, maxAge));
-            }
-        } finally {
-            writing.lazySet(false);
-        }
-    }
-
-    public PathConfig get(String uri) {
-        if (parkForReadAndCheckInterrupt()) {
-            return null;
-        }
-
-        CacheEntry cached = cache.get(uri);
-
-        if (cached != null) {
-            return removeIfExpired(cached);
-        }
-
-        return null;
-    }
-
-    public void remove(String key) {
-        try {
-            if (parkForWriteAndCheckInterrupt()) {
-                return;
-            }
-
-            cache.remove(key);
-        } finally {
-            writing.lazySet(false);
-        }
-    }
-
-    private PathConfig removeIfExpired(CacheEntry cached) {
-        if (cached == null) {
-            return null;
-        }
-
-        if (cached.isExpired()) {
-            remove(cached.key());
-            return null;
-        }
-
-        return cached.value();
-    }
-
-    private boolean parkForWriteAndCheckInterrupt() {
-        while (!writing.compareAndSet(false, true)) {
-            LockSupport.parkNanos(1L);
-            if (Thread.interrupted()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private boolean parkForReadAndCheckInterrupt() {
-        while (writing.get()) {
-            LockSupport.parkNanos(1L);
-            if (Thread.interrupted()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    private static final class CacheEntry {
-
-        final String key;
-        final PathConfig value;
-        final long expiration;
-
-        CacheEntry(String key, PathConfig value, long maxAge) {
-            this.key = key;
-            this.value = value;
-            if(maxAge == -1) {
-                expiration = -1;
-            } else {
-                expiration = System.currentTimeMillis() + maxAge;
-            }
-        }
-
-        String key() {
-            return key;
-        }
-
-        PathConfig value() {
-            return value;
-        }
-
-        boolean isExpired() {
-            return expiration != -1 ? System.currentTimeMillis() > expiration : false;
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathMatcher.java

@@ -17,228 +17,87 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.representation.ResourceRepresentation;
-import org.keycloak.authorization.client.resource.ProtectedResource;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
+import java.util.List;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
 class PathMatcher {
 
-    private static final char WILDCARD = '*';
-    private final AuthzClient authzClient;
-    // TODO: make this configurable
-    private PathCache cache = new PathCache(100, 30000);
+    private static final String ANY_RESOURCE_PATTERN = "/*";
 
-    public PathMatcher(AuthzClient authzClient) {
-        this.authzClient = authzClient;
-    }
+    PathConfig matches(final String requestedUri, List<PathConfig> paths) {
+        PathConfig actualConfig = null;
 
-    public PathConfig matches(final String targetUri, Map<String, PathConfig> paths) {
-        PathConfig pathConfig = paths.get(targetUri) == null ? cache.get(targetUri) : paths.get(targetUri);
+        for (PathConfig entry : paths) {
+            String protectedUri = entry.getPath();
+            String selectedUri = null;
 
-        if (pathConfig != null) {
-            return pathConfig;
-        }
-
-        PathConfig matchingAnyPath = null;
-        PathConfig matchingAnySuffixPath = null;
-
-        for (PathConfig entry : paths.values()) {
-            String expectedUri = entry.getPath();
-            String matchingUri = null;
-
-            if (exactMatch(expectedUri, targetUri, expectedUri)) {
-                matchingUri = expectedUri;
+            if (protectedUri.equals(ANY_RESOURCE_PATTERN) && actualConfig == null) {
+                selectedUri = protectedUri;
             }
 
-            if (isTemplate(expectedUri)) {
-                String templateUri = buildUriFromTemplate(expectedUri, targetUri);
+            int suffixIndex = protectedUri.indexOf(ANY_RESOURCE_PATTERN + ".");
 
-                if (templateUri != null) {
-                    if (exactMatch(expectedUri, targetUri, templateUri)) {
-                        matchingUri = templateUri;
-                        entry = resolvePathConfig(entry, targetUri);
-                    }
+            if (suffixIndex != -1) {
+                String protectedSuffix = protectedUri.substring(suffixIndex + ANY_RESOURCE_PATTERN.length());
+
+                if (requestedUri.endsWith(protectedSuffix)) {
+                    selectedUri = protectedUri;
                 }
             }
 
-            if (matchingUri != null) {
-                StringBuilder path = new StringBuilder(expectedUri);
-                int patternIndex = path.indexOf("/" + WILDCARD);
+            if (protectedUri.equals(requestedUri)) {
+                selectedUri = protectedUri;
+            }
 
-                if (patternIndex != -1) {
-                    path.delete(patternIndex, path.length());
+            if (protectedUri.endsWith(ANY_RESOURCE_PATTERN)) {
+                String formattedPattern = removeWildCardsFromUri(protectedUri);
+
+                if (!formattedPattern.equals("/") && requestedUri.startsWith(formattedPattern)) {
+                    selectedUri = protectedUri;
                 }
 
-                patternIndex = path.indexOf("{");
-
-                if (patternIndex != -1) {
-                    path.delete(patternIndex, path.length());
+                if (!formattedPattern.equals("/") && formattedPattern.endsWith("/") && formattedPattern.substring(0, formattedPattern.length() - 1).equals(requestedUri)) {
+                    selectedUri = protectedUri;
                 }
+            }
 
-                String pathString = path.toString();
+            int startRegex = protectedUri.indexOf('{');
 
-                if ("".equals(pathString)) {
-                    pathString = "/";
+            if (startRegex != -1) {
+                String prefix = protectedUri.substring(0, startRegex);
+
+                if (requestedUri.startsWith(prefix)) {
+                    selectedUri = protectedUri;
                 }
+            }
 
-                if (matchingUri.equals(targetUri) || pathString.equals(targetUri)) {
-                    cache.put(targetUri, entry);
-                    return entry;
-                }
+            if (selectedUri != null) {
+                selectedUri = protectedUri;
+            }
 
-                if (WILDCARD == expectedUri.charAt(expectedUri.length() - 1)) {
-                    if (matchingAnyPath == null || matchingAnyPath.getPath().length() < matchingUri.length()) {
-                        matchingAnyPath = entry;
-                    }
+            if (selectedUri != null) {
+                if (actualConfig == null) {
+                    actualConfig = entry;
                 } else {
-                    int suffixIndex = expectedUri.indexOf(WILDCARD + ".");
+                    if (actualConfig.equals(ANY_RESOURCE_PATTERN)) {
+                        actualConfig = entry;
+                    }
 
-                    if (suffixIndex != -1) {
-                        String protectedSuffix = expectedUri.substring(suffixIndex + 1);
-
-                        if (targetUri.endsWith(protectedSuffix)) {
-                            matchingAnySuffixPath = entry;
-                        }
+                    if (protectedUri.startsWith(removeWildCardsFromUri(actualConfig.getPath()))) {
+                        actualConfig = entry;
                     }
                 }
             }
         }
 
-        if (matchingAnySuffixPath != null) {
-            cache.put(targetUri, matchingAnySuffixPath);
-            return matchingAnySuffixPath;
-        }
-
-        if (matchingAnyPath != null) {
-            cache.put(targetUri, matchingAnyPath);
-        }
-
-        return matchingAnyPath;
+        return actualConfig;
     }
 
-    private boolean exactMatch(String expectedUri, String targetUri, String value) {
-        if (targetUri.equals(value)) {
-            return value.equals(targetUri);
-        }
-
-        if (endsWithWildcard(expectedUri)) {
-            return targetUri.startsWith(expectedUri.substring(0, expectedUri.length() - 2));
-        }
-
-        String suffix = "/*.";
-        int suffixIndex = expectedUri.indexOf(suffix);
-
-        if (suffixIndex != -1) {
-            return targetUri.endsWith(expectedUri.substring(suffixIndex + suffix.length() - 1));
-        }
-
-        return false;
-    }
-
-    public String buildUriFromTemplate(String expectedUri, String targetUri) {
-        int patternStartIndex = expectedUri.indexOf("{");
-
-        if (patternStartIndex == -1 || patternStartIndex >= targetUri.length()) {
-            return null;
-        }
-
-        if (expectedUri.split("/").length > targetUri.split("/").length) {
-            return null;
-        }
-
-        char[] expectedUriChars = expectedUri.toCharArray();
-        char[] matchingUri = Arrays.copyOfRange(expectedUriChars, 0, patternStartIndex);
-        int matchingUriLastIndex = matchingUri.length;
-        String targetUriParams = targetUri.substring(patternStartIndex);
-
-        if (Arrays.equals(matchingUri, Arrays.copyOf(targetUri.toCharArray(), matchingUri.length))) {
-            matchingUri = Arrays.copyOf(matchingUri, targetUri.length());
-            int paramIndex = 0;
-
-            for (int i = patternStartIndex; i < expectedUriChars.length; i++) {
-                if (matchingUriLastIndex >= matchingUri.length) {
-                    break;
-                }
-
-                char c = expectedUriChars[i];
-
-                if (c == '{' || c == '*') {
-                    String[] params = targetUriParams.split("/");
-
-                    for (int k = paramIndex; k <= (c == '*' ? params.length : paramIndex); k++) {
-                        if (k == params.length) {
-                            break;
-                        }
-
-                        int paramLength = params[k].length();
-
-                        if (matchingUriLastIndex + paramLength > matchingUri.length) {
-                            return null;
-                        }
-
-                        for (int j = 0; j < paramLength; j++) {
-                            matchingUri[matchingUriLastIndex++] = params[k].charAt(j);
-                        }
-
-                        if (c == '*' && matchingUriLastIndex < matchingUri.length) {
-                            matchingUri[matchingUriLastIndex++] = '/';
-                        }
-                    }
-
-                    i = expectedUri.indexOf('}', i);
-                } else {
-                    if (c == '/') {
-                        paramIndex++;
-                    }
-                    matchingUri[matchingUriLastIndex++] = c;
-                }
-            }
-
-            if (matchingUri[matchingUri.length - 1] == '\u0000') {
-                return null;
-            }
-
-            return String.valueOf(matchingUri);
-        }
-
-        return null;
-    }
-
-    public boolean endsWithWildcard(String expectedUri) {
-        return WILDCARD == expectedUri.charAt(expectedUri.length() - 1);
-    }
-
-    private boolean isTemplate(String uri) {
-        return uri.indexOf("{") != -1;
-    }
-
-    private PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
-        if (originalConfig.hasPattern()) {
-            ProtectedResource resource = this.authzClient.protection().resource();
-            List<ResourceRepresentation> search = resource.findByUri(path);
-
-            if (!search.isEmpty()) {
-                // resource does exist on the server, cache it
-                ResourceRepresentation targetResource = search.get(0);
-                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
-
-                config.setScopes(originalConfig.getScopes());
-                config.setMethods(originalConfig.getMethods());
-                config.setParentConfig(originalConfig);
-                config.setEnforcementMode(originalConfig.getEnforcementMode());
-
-                return config;
-            }
-        }
-
-        return originalConfig;
+    private String removeWildCardsFromUri(String protectedUri) {
+        return protectedUri.replaceAll("/[*]", "/");
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PolicyEnforcer.java

@@ -17,23 +17,13 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.authorization.client.Configuration;
+import org.keycloak.authorization.client.representation.RegistrationResponse;
 import org.keycloak.authorization.client.representation.ResourceRepresentation;
 import org.keycloak.authorization.client.representation.ScopeRepresentation;
 import org.keycloak.authorization.client.resource.ProtectedResource;
@@ -42,6 +32,15 @@ import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
 
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -52,29 +51,17 @@ public class PolicyEnforcer {
     private final KeycloakDeployment deployment;
     private final AuthzClient authzClient;
     private final PolicyEnforcerConfig enforcerConfig;
-    private final Map<String, PathConfig> paths;
-    private final PathMatcher pathMatcher;
+    private final List<PathConfig> paths;
 
     public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
         this.deployment = deployment;
         this.enforcerConfig = adapterConfig.getPolicyEnforcerConfig();
-        Configuration configuration = new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient());
-        this.authzClient = AuthzClient.create(configuration, new ClientAuthenticator() {
-            @Override
-            public void configureClientCredentials(Map<String, List<String>> requestParams, Map<String, String> requestHeaders) {
-                Map<String, String> formparams = new HashMap<>();
-                ClientCredentialsProviderUtils.setClientCredentials(PolicyEnforcer.this.deployment, requestHeaders, formparams);
-                for (Entry<String, String> param : formparams.entrySet()) {
-                    requestParams.put(param.getKey(), Arrays.asList(param.getValue()));
-                }
-            }
-        });
-        this.pathMatcher = new PathMatcher(this.authzClient);
+        this.authzClient = AuthzClient.create(new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient()));
         this.paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Initialization complete. Path configurations:");
-            for (PathConfig pathConfig : this.paths.values()) {
+            for (PathConfig pathConfig : this.paths) {
                 LOGGER.debug(pathConfig);
             }
         }
@@ -112,29 +99,16 @@ public class PolicyEnforcer {
         return authzClient;
     }
 
-    public Map<String, PathConfig> getPaths() {
-        return paths;
-    }
-
-    void addPath(PathConfig pathConfig) {
-        paths.put(pathConfig.getPath(), pathConfig);
+    public List<PathConfig> getPaths() {
+        return Collections.unmodifiableList(paths);
     }
 
     KeycloakDeployment getDeployment() {
         return deployment;
     }
 
-    private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        boolean loadPathsFromServer = true;
-
-        for (PathConfig pathConfig : enforcerConfig.getPaths()) {
-            if (!PolicyEnforcerConfig.EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                loadPathsFromServer = false;
-                break;
-            }
-        }
-
-        if (loadPathsFromServer) {
+    private List<PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        if (enforcerConfig.getPaths().isEmpty()) {
             LOGGER.info("No path provided in configuration.");
             return configureAllPathsForResourceServer(protectedResource);
         } else {
@@ -143,38 +117,30 @@ public class PolicyEnforcer {
         }
     }
 
-    private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+    private List<PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
+        List<PathConfig> paths = new ArrayList<>();
 
         for (PathConfig pathConfig : enforcerConfig.getPaths()) {
-            ResourceRepresentation resource;
+            Set<String> search;
             String resourceName = pathConfig.getName();
             String path = pathConfig.getPath();
 
             if (resourceName != null) {
                 LOGGER.debugf("Trying to find resource with name [%s] for path [%s].", resourceName, path);
-                resource = protectedResource.findByName(resourceName);
+                search = protectedResource.findByFilter("name=" + resourceName);
             } else {
                 LOGGER.debugf("Trying to find resource with uri [%s] for path [%s].", path, path);
-                List<ResourceRepresentation> resources = protectedResource.findByUri(path);
-
-                if (resources.size() == 1) {
-                    resource = resources.get(0);
-                } else if (resources.size() > 1) {
-                    throw new RuntimeException("Multiple resources found with the same uri");
-                } else {
-                    resource = null;
-                }
+                search = protectedResource.findByFilter("uri=" + path);
             }
 
-            if (resource == null) {
+            if (search.isEmpty()) {
                 if (enforcerConfig.isCreateResources()) {
                     LOGGER.debugf("Creating resource on server for path [%s].", pathConfig);
-                    ResourceRepresentation representation = new ResourceRepresentation();
+                    ResourceRepresentation resource = new ResourceRepresentation();
 
-                    representation.setName(resourceName);
-                    representation.setType(pathConfig.getType());
-                    representation.setUri(path);
+                    resource.setName(resourceName);
+                    resource.setType(pathConfig.getType());
+                    resource.setUri(path);
 
                     HashSet<ScopeRepresentation> scopes = new HashSet<>();
 
@@ -186,21 +152,21 @@ public class PolicyEnforcer {
                         scopes.add(scope);
                     }
 
-                    representation.setScopes(scopes);
+                    resource.setScopes(scopes);
 
-                    ResourceRepresentation registrationResponse = protectedResource.create(representation);
+                    RegistrationResponse registrationResponse = protectedResource.create(resource);
 
                     pathConfig.setId(registrationResponse.getId());
                 } else {
                     throw new RuntimeException("Could not find matching resource on server with uri [" + path + "] or name [" + resourceName + "]. Make sure you have created a resource on the server that matches with the path configuration.");
                 }
             } else {
-                pathConfig.setId(resource.getId());
+                pathConfig.setId(search.iterator().next());
             }
 
             PathConfig existingPath = null;
 
-            for (PathConfig current : paths.values()) {
+            for (PathConfig current : paths) {
                 if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                     existingPath = current;
                     break;
@@ -208,7 +174,7 @@ public class PolicyEnforcer {
             }
 
             if (existingPath == null) {
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(pathConfig);
             } else {
                 existingPath.getMethods().addAll(pathConfig.getMethods());
                 existingPath.getScopes().addAll(pathConfig.getScopes());
@@ -218,35 +184,28 @@ public class PolicyEnforcer {
         return paths;
     }
 
-    private Map<String, PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
+    private List<PathConfig> configureAllPathsForResourceServer(ProtectedResource protectedResource) {
         LOGGER.info("Querying the server for all resources associated with this application.");
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
+        List<PathConfig> paths = new ArrayList<>();
 
         for (String id : protectedResource.findAll()) {
-            ResourceRepresentation resourceDescription = protectedResource.findById(id);
+            RegistrationResponse response = protectedResource.findById(id);
+            ResourceRepresentation resourceDescription = response.getResourceDescription();
 
             if (resourceDescription.getUri() != null) {
-                PathConfig pathConfig = createPathConfig(resourceDescription);
-                paths.put(pathConfig.getPath(), pathConfig);
+                paths.add(createPathConfig(resourceDescription));
             }
         }
 
         return paths;
     }
 
-    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+    private PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
         PathConfig pathConfig = new PathConfig();
 
         pathConfig.setId(resourceDescription.getId());
         pathConfig.setName(resourceDescription.getName());
-
-        String uri = resourceDescription.getUri();
-
-        if (uri == null || "".equals(uri.trim())) {
-            throw new RuntimeException("Failed to configure paths. Resource [" + resourceDescription.getName() + "] has an invalid or empty URI [" + uri + "].");
-        }
-
-        pathConfig.setPath(uri);
+        pathConfig.setPath(resourceDescription.getUri());
 
         List<String> scopeNames = new ArrayList<>();
 
@@ -259,8 +218,4 @@ public class PolicyEnforcer {
 
         return pathConfig;
     }
-
-    public PathMatcher getPathMatcher() {
-        return pathMatcher;
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/AbstractKeycloakLoginModule.java

@@ -17,17 +17,14 @@
 
 package org.keycloak.adapters.jaas;
 
-import org.jboss.logging.Logger;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.adapters.AdapterUtils;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
-import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.FindFile;
-import org.keycloak.common.util.reflections.Reflections;
-import org.keycloak.representations.AccessToken;
+import java.io.InputStream;
+import java.lang.reflect.Constructor;
+import java.security.Principal;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
 
 import javax.security.auth.Subject;
 import javax.security.auth.callback.Callback;
@@ -38,17 +35,18 @@ import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.LoginException;
 import javax.security.auth.spi.LoginModule;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.lang.reflect.Constructor;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.security.Principal;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
+import org.jboss.logging.Logger;
+import org.keycloak.KeycloakPrincipal;
+import org.keycloak.RSATokenVerifier;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.AdapterUtils;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
+import org.keycloak.common.VerificationException;
+import org.keycloak.common.util.FindFile;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.common.util.reflections.Reflections;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -57,7 +55,7 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     public static final String KEYCLOAK_CONFIG_FILE_OPTION = "keycloak-config-file";
     public static final String ROLE_PRINCIPAL_CLASS_OPTION = "role-principal-class";
-    public static final String PROFILE_RESOURCE = "profile:";
+
     protected Subject subject;
     protected CallbackHandler callbackHandler;
     protected Auth auth;
@@ -88,27 +86,17 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     protected KeycloakDeployment resolveDeployment(String keycloakConfigFile) {
         try {
-            InputStream is = null;
-            if (keycloakConfigFile.startsWith(PROFILE_RESOURCE)) {
-                try {
-                    is = new URL(keycloakConfigFile).openStream();
-                } catch (MalformedURLException mfue) {
-                    throw new RuntimeException(mfue);
-                } catch (IOException ioe) {
-                    throw new RuntimeException(ioe);
-                }
-            } else {
-                is = FindFile.findFile(keycloakConfigFile);
-            }
+            InputStream is = FindFile.findFile(keycloakConfigFile);
             KeycloakDeployment kd = KeycloakDeploymentBuilder.build(is);
+            if (kd.getRealmKey() == null) {
+                new AdapterDeploymentContext().resolveRealmKey(kd);
+            }
             return kd;
-
         } catch (RuntimeException e) {
             getLogger().debug("Unable to find or parse file " + keycloakConfigFile + " due to " + e.getMessage(), e);
             throw e;
         }
     }
-    
 
     @Override
     public boolean login() throws LoginException {
@@ -202,7 +190,7 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
 
     protected Auth bearerAuth(String tokenString) throws VerificationException {
-        AccessToken token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+        AccessToken token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
 
         boolean verifyCaller;
         if (deployment.isUseResourceRoleMappings()) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/DirectAccessGrantsLoginModule.java

@@ -17,6 +17,19 @@
 
 package org.keycloak.adapters.jaas;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.Serializable;
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+import javax.security.auth.Subject;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.login.LoginException;
+
 import org.apache.http.HttpEntity;
 import org.apache.http.HttpResponse;
 import org.apache.http.NameValuePair;
@@ -26,25 +39,13 @@ import org.apache.http.client.methods.HttpPost;
 import org.apache.http.message.BasicNameValuePair;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.constants.ServiceUrlConstants;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
 import org.keycloak.util.JsonSerialization;
-
-import javax.security.auth.Subject;
-import javax.security.auth.callback.CallbackHandler;
-import javax.security.auth.login.LoginException;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.Serializable;
-import java.net.URI;
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
+import org.keycloak.common.util.KeycloakUriBuilder;
 
 /**
  * Login module based on Resource Owner password credentials grant from OAuth2 specs. It's supposed to be used in environments. which

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/AdapterRSATokenVerifier.java

@@ -1,58 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.jboss.logging.Logger;
-import org.keycloak.RSATokenVerifier;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.representations.AccessToken;
-
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AdapterRSATokenVerifier {
-
-    private static final Logger log = Logger.getLogger(AdapterRSATokenVerifier.class);
-
-    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment) throws VerificationException {
-        return verifyToken(tokenString, deployment, true, true);
-    }
-
-
-    public static PublicKey getPublicKey(String kid, KeycloakDeployment deployment) throws VerificationException {
-        PublicKeyLocator pkLocator = deployment.getPublicKeyLocator();
-
-        PublicKey publicKey = pkLocator.getPublicKey(kid, deployment);
-        if (publicKey == null) {
-            log.errorf("Didn't find publicKey for kid: %s", kid);
-            throw new VerificationException("Didn't find publicKey for specified kid");
-        }
-
-        return publicKey;
-    }
-
-    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment, boolean checkActive, boolean checkTokenType) throws VerificationException {
-        RSATokenVerifier verifier = RSATokenVerifier.create(tokenString).realmUrl(deployment.getRealmInfoUrl()).checkActive(checkActive).checkTokenType(checkTokenType);
-        PublicKey publicKey = getPublicKey(verifier.getHeader().getKeyId(), deployment);
-        return verifier.publicKey(publicKey).verify().getToken();
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/HardcodedPublicKeyLocator.java

@@ -1,45 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.jose.jws.JWSInput;
-
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class HardcodedPublicKeyLocator implements PublicKeyLocator {
-
-    private PublicKey publicKey;
-
-    public HardcodedPublicKeyLocator(PublicKey publicKey) {
-        this.publicKey = publicKey;
-    }
-
-    @Override
-    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
-        return publicKey;
-    }
-
-    @Override
-    public void reset(KeycloakDeployment deployment) {
-
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/JWKPublicKeyLocator.java

@@ -1,115 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.apache.http.client.methods.HttpGet;
-import org.jboss.logging.Logger;
-import org.keycloak.adapters.HttpAdapterUtils;
-import org.keycloak.adapters.HttpClientAdapterException;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.util.Time;
-import org.keycloak.jose.jwk.JSONWebKeySet;
-import org.keycloak.jose.jwk.JWK;
-import org.keycloak.util.JWKSUtils;
-
-import java.security.PublicKey;
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-/**
- * When needed, publicKeys are downloaded by sending request to realm's jwks_url
- *
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class JWKPublicKeyLocator implements PublicKeyLocator {
-
-    private static final Logger log = Logger.getLogger(JWKPublicKeyLocator.class);
-
-    private Map<String, PublicKey> currentKeys = new ConcurrentHashMap<>();
-
-    private volatile int lastRequestTime = 0;
-
-    @Override
-    public PublicKey getPublicKey(String kid, KeycloakDeployment deployment) {
-        int minTimeBetweenRequests = deployment.getMinTimeBetweenJwksRequests();
-        int publicKeyCacheTtl = deployment.getPublicKeyCacheTtl();
-        int currentTime = Time.currentTime();
-
-        // Check if key is in cache.
-        PublicKey publicKey = lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
-        if (publicKey != null) {
-            return publicKey;
-        }
-
-        // Check if we are allowed to send request
-        synchronized (this) {
-            currentTime = Time.currentTime();
-            if (currentTime > lastRequestTime + minTimeBetweenRequests) {
-                sendRequest(deployment);
-                lastRequestTime = currentTime;
-            } else {
-                log.debug("Won't send request to realm jwks url. Last request time was " + lastRequestTime);
-            }
-
-            return lookupCachedKey(publicKeyCacheTtl, currentTime, kid);
-        }
-    }
-
-
-    @Override
-    public void reset(KeycloakDeployment deployment) {
-        synchronized (this) {
-            sendRequest(deployment);
-            lastRequestTime = Time.currentTime();
-        }
-    }
-
-
-    private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
-        if (lastRequestTime + publicKeyCacheTtl > currentTime && kid != null) {
-            return currentKeys.get(kid);
-        } else {
-            return null;
-        }
-    }
-
-
-    private void sendRequest(KeycloakDeployment deployment) {
-        if (log.isTraceEnabled()) {
-            log.trace("Going to send request to retrieve new set of realm public keys for client " + deployment.getResourceName());
-        }
-
-        HttpGet getMethod = new HttpGet(deployment.getJwksUrl());
-        try {
-            JSONWebKeySet jwks = HttpAdapterUtils.sendJsonHttpRequest(deployment, getMethod, JSONWebKeySet.class);
-
-            Map<String, PublicKey> publicKeys = JWKSUtils.getKeysForUse(jwks, JWK.Use.SIG);
-
-            if (log.isDebugEnabled()) {
-                log.debug("Realm public keys successfully retrieved for client " +  deployment.getResourceName() + ". New kids: " + publicKeys.keySet().toString());
-            }
-
-            // Update current keys
-            currentKeys.clear();
-            currentKeys.putAll(publicKeys);
-
-        } catch (HttpClientAdapterException e) {
-            log.error("Error when sending request to retrieve realm keys", e);
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/PublicKeyLocator.java

@@ -1,44 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.jose.jws.JWSInput;
-
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public interface PublicKeyLocator {
-
-    /**
-     * @param kid
-     * @param deployment
-     * @return publicKey, which should be used for verify signature on given "input"
-     */
-    PublicKey getPublicKey(String kid, KeycloakDeployment deployment);
-
-    /**
-     * Reset the state of locator (eg. clear the cached keys)
-     *
-     * @param deployment
-     */
-    void reset(KeycloakDeployment deployment);
-
-}

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authentication.ClientCredentialsProvider

@@ -16,5 +16,4 @@
 #
 
 org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider
-org.keycloak.adapters.authentication.JWTClientCredentialsProvider
-org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider
+org.keycloak.adapters.authentication.JWTClientCredentialsProvider

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentBuilderTest.java

@@ -21,22 +21,16 @@ import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
 import org.junit.Test;
 import org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider;
 import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
-import org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider;
-import org.keycloak.adapters.rotation.HardcodedPublicKeyLocator;
-import org.keycloak.adapters.rotation.JWKPublicKeyLocator;
 import org.keycloak.common.enums.RelativeUrlsUsed;
 import org.keycloak.common.enums.SslRequired;
-import org.keycloak.common.util.PemUtils;
 import org.keycloak.enums.TokenStore;
+import org.keycloak.common.util.PemUtils;
 
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
- * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
  */
 public class KeycloakDeploymentBuilderTest {
 
@@ -45,11 +39,7 @@ public class KeycloakDeploymentBuilderTest {
         KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak.json"));
         assertEquals("demo", deployment.getRealm());
         assertEquals("customer-portal", deployment.getResourceName());
-
-        assertTrue(deployment.getPublicKeyLocator() instanceof HardcodedPublicKeyLocator);
-        assertEquals(PemUtils.decodePublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB"),
-                deployment.getPublicKeyLocator().getPublicKey(null, deployment));
-
+        assertEquals(PemUtils.decodePublicKey("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB"), deployment.getRealmKey());
         assertEquals("https://localhost:8443/auth/realms/demo/protocol/openid-connect/auth", deployment.getAuthUrl().build().toString());
         assertEquals(SslRequired.EXTERNAL, deployment.getSslRequired());
         assertTrue(deployment.isUseResourceRoleMappings());
@@ -57,12 +47,10 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(1000, deployment.getCorsMaxAge());
         assertEquals("POST, PUT, DELETE, GET", deployment.getCorsAllowedMethods());
         assertEquals("X-Custom, X-Custom2", deployment.getCorsAllowedHeaders());
-        assertEquals("X-Custom3, X-Custom4", deployment.getCorsExposedHeaders());
         assertTrue(deployment.isBearerOnly());
         assertTrue(deployment.isPublicClient());
         assertTrue(deployment.isEnableBasicAuth());
         assertTrue(deployment.isExposeToken());
-        assertFalse(deployment.isOAuthQueryParameterEnabled());
         assertEquals("234234-234234-234234", deployment.getResourceCredentials().get("secret"));
         assertEquals(ClientIdAndSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
         assertEquals(20, ((ThreadSafeClientConnManager) deployment.getClient().getConnectionManager()).getMaxTotal());
@@ -74,19 +62,12 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(TokenStore.COOKIE, deployment.getTokenStore());
         assertEquals("email", deployment.getPrincipalAttribute());
         assertEquals(10, deployment.getTokenMinimumTimeToLive());
-        assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(120, deployment.getPublicKeyCacheTtl());
-        assertEquals("/api/$1", deployment.getRedirectRewriteRules().get("^/wsmaster/api/(.*)$"));
     }
 
     @Test
     public void loadNoClientCredentials() throws Exception {
         KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak-no-credentials.json"));
         assertEquals(ClientIdAndSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
-
-        assertTrue(deployment.getPublicKeyLocator() instanceof JWKPublicKeyLocator);
-        assertEquals(10, deployment.getMinTimeBetweenJwksRequests());
-        assertEquals(86400, deployment.getPublicKeyCacheTtl());
     }
 
     @Test
@@ -95,9 +76,4 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(JWTClientCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
     }
 
-    @Test
-    public void loadSecretJwtCredentials() throws Exception {
-        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak-secret-jwt.json"));
-        assertEquals(JWTClientSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
-    }
 }

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentTest.java

@@ -1,68 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters;
-
-import org.junit.Test;
-import org.keycloak.representations.adapters.config.AdapterConfig;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
-/**
- * @author <a href="mailto:brad.culley@spartasystems.com">Brad Culley</a>
- * @author <a href="mailto:john.ament@spartasystems.com">John D. Ament</a>
- */
-public class KeycloakDeploymentTest {
-    @Test
-    public void shouldNotEnableOAuthQueryParamWhenIgnoreIsTrue() {
-        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
-        keycloakDeployment.setIgnoreOAuthQueryParameter(true);
-        assertFalse(keycloakDeployment.isOAuthQueryParameterEnabled());
-    }
-
-    @Test
-    public void shouldEnableOAuthQueryParamWhenIgnoreIsFalse() {
-        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
-        keycloakDeployment.setIgnoreOAuthQueryParameter(false);
-        assertTrue(keycloakDeployment.isOAuthQueryParameterEnabled());
-    }
-
-    @Test
-    public void shouldEnableOAuthQueryParamWhenIgnoreNotSet() {
-        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
-
-        assertTrue(keycloakDeployment.isOAuthQueryParameterEnabled());
-    }
-
-    @Test
-    public void stripDefaultPorts() {
-        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
-        keycloakDeployment.setRealm("test");
-        AdapterConfig config = new AdapterConfig();
-        config.setAuthServerUrl("http://localhost:80/auth");
-        keycloakDeployment.setAuthServerBaseUrl(config);
-
-        assertEquals("http://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
-
-        config.setAuthServerUrl("https://localhost:443/auth");
-        keycloakDeployment.setAuthServerBaseUrl(config);
-
-        assertEquals("https://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
-    }
-
-}

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/RefreshableKeycloakSecurityContextTest.java

@@ -1,9 +1,9 @@
 package org.keycloak.adapters;
 
+import static org.junit.Assert.*;
+
 import org.junit.Test;
 import org.keycloak.representations.oidc.TokenMetadataRepresentation;
-
-import static org.junit.Assert.assertFalse;
 /**
  * @author github.com/tubbynl
  *

adapters/oidc/adapter-core/src/test/resources/keycloak-no-credentials.json

@@ -1,6 +1,7 @@
 {
     "realm": "demo",
     "resource": "customer-portal",
+    "realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
     "auth-server-url": "https://localhost:8443/auth",
     "public-client": true,
     "expose-token": true

adapters/oidc/adapter-core/src/test/resources/keycloak-secret-jwt.json

@@ -1,12 +0,0 @@
-{
-    "realm": "demo",
-    "resource": "customer-portal",
-    "realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
-    "auth-server-url": "https://localhost:8443/auth",
-    "ssl-required": "external",
-    "credentials": {
-        "secret-jwt": {
-            "secret": "234234-234234-234234"
-        }
-    }
-}

adapters/oidc/adapter-core/src/test/resources/keycloak.json

@@ -9,7 +9,6 @@
     "cors-max-age": 1000,
     "cors-allowed-methods": "POST, PUT, DELETE, GET",
     "cors-allowed-headers": "X-Custom, X-Custom2",
-    "cors-exposed-headers": "X-Custom3, X-Custom4",
     "bearer-only": true,
     "public-client": true,
     "enable-basic-auth": true,
@@ -30,11 +29,5 @@
     "register-node-period": 1000,
     "token-store": "cookie",
     "principal-attribute": "email",
-    "token-minimum-time-to-live": 10,
-    "min-time-between-jwks-requests": 20,
-    "public-key-cache-ttl": 120,
-    "ignore-oauth-query-parameter": true,
-    "redirect-rewrite-rules" : {
-  	"^/wsmaster/api/(.*)$" : "/api/$1"
-     }
+    "token-minimum-time-to-live": 10
 }

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/AuthenticatedActionsValve.java

@@ -1,13 +0,0 @@
-package org.keycloak.adapters.jbossweb;
-
-import org.apache.catalina.Container;
-import org.apache.catalina.Valve;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
-
-public class AuthenticatedActionsValve extends AbstractAuthenticatedActionsValve {
-
-    public AuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
-        super(deploymentContext, next, container);
-    }
-}

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/KeycloakAuthenticatorValve.java

@@ -17,20 +17,20 @@
 
 package org.keycloak.adapters.jbossweb;
 
-import org.apache.catalina.Container;
 import org.apache.catalina.LifecycleException;
-import org.apache.catalina.Valve;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
 import org.apache.catalina.core.StandardContext;
 import org.apache.catalina.deploy.LoginConfig;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
+import org.apache.catalina.realm.GenericPrincipal;
 import org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve;
 import org.keycloak.adapters.tomcat.GenericPrincipalFactory;
 
+import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+import java.security.Principal;
+import java.util.List;
 
 /**
  * Keycloak authentication valve
@@ -60,6 +60,7 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
         super.start();
     }
 
+
     public void logout(Request request) {
         logoutInternal(request);
     }
@@ -68,9 +69,4 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
     protected GenericPrincipalFactory createPrincipalFactory() {
         return new JBossWebPrincipalFactory();
     }
-
-    @Override
-    protected AbstractAuthenticatedActionsValve createAuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
-        return new AuthenticatedActionsValve(deploymentContext, next, container);
-    }
 }

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -88,6 +88,7 @@
         <dependency>
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
+            <version>3.1.0.GA</version>
         </dependency>
 
         <dependency>
@@ -103,6 +104,7 @@ projects that depend on this project.-->
         <dependency>
             <groupId>org.jboss.msc</groupId>
             <artifactId>jboss-msc</artifactId>
+            <version>1.0.2.GA</version>
         </dependency>
 
         <dependency>

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/KeycloakAdapterConfigDeploymentProcessor.java

@@ -68,9 +68,8 @@ public class KeycloakAdapterConfigDeploymentProcessor implements DeploymentUnitP
 
         boolean hasSubsystemConfig = service.isSecureDeployment(deploymentUnit);
         boolean webRequiresKC = loginConfig != null && "KEYCLOAK".equalsIgnoreCase(loginConfig.getAuthMethod());
-        boolean isConfigured = service.isDeploymentConfigured(deploymentUnit);
 
-        if ((hasSubsystemConfig && isConfigured) || webRequiresKC) {
+        if (hasSubsystemConfig || webRequiresKC) {
             log.debug("Setting up KEYCLOAK auth method for WAR: " + deploymentUnit.getName());
 
             // if secure-deployment configuration exists for web app, we force KEYCLOAK auth method on it

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/KeycloakAdapterConfigService.java

@@ -17,17 +17,17 @@
 
 package org.keycloak.subsystem.as7;
 
-import org.jboss.as.server.deployment.DeploymentUnit;
-import org.jboss.as.web.deployment.WarMetaData;
 import org.jboss.dmr.ModelNode;
 import org.jboss.dmr.Property;
 import org.jboss.logging.Logger;
-import org.jboss.metadata.web.jboss.JBossWebMetaData;
 
 import java.util.HashMap;
 import java.util.Map;
 
 import static org.jboss.as.controller.descriptions.ModelDescriptionConstants.ADDRESS;
+import org.jboss.as.server.deployment.DeploymentUnit;
+import org.jboss.as.web.deployment.WarMetaData;
+import org.jboss.metadata.web.jboss.JBossWebMetaData;
 
 /**
  * This service keeps track of the entire Keycloak management model so as to provide
@@ -158,22 +158,15 @@ public final class KeycloakAdapterConfigService {
     }
 
     public String getRealmName(DeploymentUnit deploymentUnit) {
-        ModelNode deployment = getSecureDeployment(deploymentUnit);
+        String deploymentName = preferredDeploymentName(deploymentUnit);
+        ModelNode deployment = this.secureDeployments.get(deploymentName);
         return deployment.get(RealmDefinition.TAG_NAME).asString();
 
     }
 
-    protected boolean isDeploymentConfigured(DeploymentUnit deploymentUnit) {
-        ModelNode deployment = getSecureDeployment(deploymentUnit);
-        if (! deployment.isDefined()) {
-            return false;
-        }
-        ModelNode resource = deployment.get(SecureDeploymentDefinition.RESOURCE.getName());
-        return resource.isDefined();
-    }
-
     public String getJSON(DeploymentUnit deploymentUnit) {
-        ModelNode deployment = getSecureDeployment(deploymentUnit);
+        String deploymentName = preferredDeploymentName(deploymentUnit);
+        ModelNode deployment = this.secureDeployments.get(deploymentName);
         String realmName = deployment.get(RealmDefinition.TAG_NAME).asString();
         ModelNode realm = this.realms.get(realmName);
 
@@ -202,13 +195,6 @@ public final class KeycloakAdapterConfigService {
         String deploymentName = preferredDeploymentName(deploymentUnit);
         return this.secureDeployments.containsKey(deploymentName);
     }
-
-    private ModelNode getSecureDeployment(DeploymentUnit deploymentUnit) {
-        String deploymentName = preferredDeploymentName(deploymentUnit);
-        return this.secureDeployments.containsKey(deploymentName)
-          ? this.secureDeployments.get(deploymentName)
-          : new ModelNode();
-    }
     
     // KEYCLOAK-3273: prefer module name if available
     private String preferredDeploymentName(DeploymentUnit deploymentUnit) {

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/KeycloakSubsystemAdd.java

@@ -25,6 +25,7 @@ import org.jboss.as.server.AbstractDeploymentChainStep;
 import org.jboss.as.server.DeploymentProcessorTarget;
 import org.jboss.as.server.deployment.Phase;
 import org.jboss.dmr.ModelNode;
+
 import org.jboss.msc.service.ServiceController;
 
 import java.util.List;

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/KeycloakSubsystemParser.java

@@ -86,7 +86,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addRealm)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
 
         list.add(addRealm);
@@ -117,7 +117,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
          * TODO need to check realm-ref first.
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(addSecureDeployment)) {
             //TODO: externalize the message
-            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new XMLStreamException("truststore and truststore-password must be set if ssl-required is not none  and disable-trust-maanger is false.");
         }
          */
 
@@ -157,7 +157,7 @@ class KeycloakSubsystemParser implements XMLStreamConstants, XMLElementReader<Li
             credentialsToAdd.add(addCredential);
         } else {
             for (Map.Entry<String, String> entry : values.entrySet()) {
-                ModelNode addCredential = getCredentialToAdd(parent, name + "." + entry.getKey(), entry.getValue());
+                ModelNode addCredential = getCredentialToAdd(parent, name + "" + entry.getKey(), entry.getValue());
                 credentialsToAdd.add(addCredential);
             }
         }

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/RealmAddHandler.java

@@ -46,7 +46,7 @@ public final class RealmAddHandler extends AbstractAddStepHandler {
 
         if (!SharedAttributeDefinitons.validateTruststoreSetIfRequired(model.clone())) {
             //TODO: externalize message
-            throw new OperationFailedException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-manager is false.");
+            throw new OperationFailedException("truststore and truststore-password must be set if ssl-required is not none and disable-trust-maanger is false.");
         }
     }
 

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/RealmWriteAttributeHandler.java

@@ -23,6 +23,8 @@ import org.jboss.as.controller.OperationContext;
 import org.jboss.as.controller.OperationFailedException;
 import org.jboss.dmr.ModelNode;
 
+import java.util.List;
+
 /**
  * Update an attribute on a realm.
  *

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/SecureDeploymentDefinition.java

@@ -23,7 +23,6 @@ import org.jboss.as.controller.SimpleAttributeDefinitionBuilder;
 import org.jboss.as.controller.SimpleResourceDefinition;
 import org.jboss.as.controller.descriptions.ModelDescriptionConstants;
 import org.jboss.as.controller.operations.common.GenericSubsystemDescribeHandler;
-import org.jboss.as.controller.operations.validation.IntRangeValidator;
 import org.jboss.as.controller.operations.validation.StringLengthValidator;
 import org.jboss.as.controller.registry.ManagementResourceRegistration;
 import org.jboss.as.controller.registry.OperationEntry;
@@ -80,24 +79,6 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
                     .setAllowExpression(true)
                     .setDefaultValue(new ModelNode(false))
                     .build();
-    protected static final SimpleAttributeDefinition TURN_OFF_CHANGE_SESSION =
-            new SimpleAttributeDefinitionBuilder("turn-off-change-session-id-on-login", ModelType.BOOLEAN, true)
-                    .setXmlName("turn-off-change-session-id-on-login")
-                    .setAllowExpression(true)
-                    .setDefaultValue(new ModelNode(false))
-                    .build();
-    protected static final SimpleAttributeDefinition TOKEN_MINIMUM_TIME_TO_LIVE =
-            new SimpleAttributeDefinitionBuilder("token-minimum-time-to-live", ModelType.INT, true)
-                    .setXmlName("token-minimum-time-to-live")
-                    .setValidator(new IntRangeValidator(-1, true))
-                    .setAllowExpression(true)
-                    .build();
-    protected static final SimpleAttributeDefinition MIN_TIME_BETWEEN_JWKS_REQUESTS =
-            new SimpleAttributeDefinitionBuilder("min-time-between-jwks-requests", ModelType.INT, true)
-                    .setXmlName("min-time-between-jwks-requests")
-                    .setValidator(new IntRangeValidator(-1, true))
-                    .setAllowExpression(true)
-                    .build();
 
     protected static final List<SimpleAttributeDefinition> DEPLOYMENT_ONLY_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
@@ -107,9 +88,6 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
         DEPLOYMENT_ONLY_ATTRIBUTES.add(BEARER_ONLY);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(ENABLE_BASIC_AUTH);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(PUBLIC_CLIENT);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(TURN_OFF_CHANGE_SESSION);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(TOKEN_MINIMUM_TIME_TO_LIVE);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(MIN_TIME_BETWEEN_JWKS_REQUESTS);
     }
 
     protected static final List<SimpleAttributeDefinition> ALL_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/org/keycloak/subsystem/as7/LocalDescriptions.properties

@@ -80,8 +80,6 @@ keycloak.secure-deployment.register-node-period=how often to re-register node
 keycloak.secure-deployment.token-store=cookie or session storage for auth session data
 keycloak.secure-deployment.principal-attribute=token attribute to use to set Principal name
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
-keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
-keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
 
 keycloak.secure-deployment.credential=Credential value
 

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/schema/keycloak_1_1.xsd

@@ -105,8 +105,6 @@
             <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
             <xs:element name="enable-basic-auth" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
-            <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -30,18 +30,6 @@
     <artifactId>keycloak-as7-integration-pom</artifactId>
     <packaging>pom</packaging>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.jboss.as</groupId>
-                <artifactId>jboss-as-parent</artifactId>
-                <version>${jboss.as.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <modules>
         <module>as7-adapter-spi</module>
         <module>as7-adapter</module>

adapters/oidc/cli-sso/README.md

@@ -1,9 +0,0 @@
-CLI Single Sign On
-===================================
-
-This java-based utility is meant for providing Keycloak integration to 
-command line applications that are either written in Java or another language.  The
-idea is that the Java app provided by this utility performs a login for a specific
-client, parses responses, and exports an access token as an environment variable
-that can be used by the command line utility you are accessing.
-

adapters/oidc/cli-sso/login.sh

@@ -1,10 +0,0 @@
-#!/bin/sh
-export KC_AUTH_SERVER=http://localhost:8080/auth
-export KC_REALM=master
-export KC_CLIENT=cli
-
-export KC_ACCESS_TOKEN=`java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar login`
-
-
-
-

adapters/oidc/cli-sso/logout.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar logout
-
-unset KC_ACCESS_TOKEN
-
-
-
-

adapters/oidc/cli-sso/pom.xml

@@ -1,84 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <parent>
-        <artifactId>keycloak-parent</artifactId>
-        <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
-        <relativePath>../../../pom.xml</relativePath>
-    </parent>
-    <modelVersion>4.0.0</modelVersion>
-
-    <artifactId>keycloak-cli-sso</artifactId>
-    <name>Keycloak CLI SSO Framework</name>
-    <description/>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-installed-adapter</artifactId>
-        </dependency>
-     </dependencies>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-shade-plugin</artifactId>
-                <version>3.0.0</version>
-                <configuration>
-                    <transformers>
-                        <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-                            <mainClass>org.keycloak.adapters.KeycloakCliSsoMain</mainClass>
-                        </transformer>
-                    </transformers>
-
-                    <filters>
-                        <filter>
-                            <artifact>*:*</artifact>
-                            <excludes>
-                                <exclude>META-INF/*.SF</exclude>
-                                <exclude>META-INF/*.DSA</exclude>
-                                <exclude>META-INF/*.RSA</exclude>
-                            </excludes>
-                        </filter>
-                    </filters>
-                </configuration>
-                <executions>
-                    <execution>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>shade</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
-    </build>
-
-</project>

adapters/oidc/cli-sso/src/main/java/org/keycloak/adapters/KeycloakCliSsoMain.java

@@ -1,45 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters;
-
-import org.keycloak.adapters.installed.KeycloakCliSso;
-import org.keycloak.adapters.installed.KeycloakInstalled;
-import org.keycloak.common.util.Time;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.adapters.config.AdapterConfig;
-import org.keycloak.util.JsonSerialization;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.nio.file.Paths;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KeycloakCliSsoMain extends KeycloakCliSso {
-
-    public static void main(String[] args) throws Exception {
-        new KeycloakCliSsoMain().mainCmd(args);
-    }
-}

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -63,15 +63,6 @@
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.spec.javax.ws.rs</groupId>
-            <artifactId>jboss-jaxrs-api_2.0_spec</artifactId>
-        </dependency>
-
     </dependencies>
 
     <build>

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakCliSso.java

@@ -1,281 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.installed;
-
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.adapters.ServerRequest;
-import org.keycloak.common.util.Time;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.adapters.config.AdapterConfig;
-import org.keycloak.util.JsonSerialization;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.IOException;
-import java.nio.file.Paths;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-/**
- *
- *
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KeycloakCliSso {
-
-    public void mainCmd(String[] args) throws Exception {
-        if (args.length != 1) {
-            printHelp();
-            return;
-        }
-
-        if (args[0].equalsIgnoreCase("login")) {
-            login();
-        } else if (args[0].equalsIgnoreCase("login-manual")) {
-            loginManual();
-        }
-        /*
-        else if (args[0].equalsIgnoreCase("login-cli")) {
-            loginCli();
-        }
-        */
-        else if (args[0].equalsIgnoreCase("token")) {
-            token();
-        } else if (args[0].equalsIgnoreCase("logout")) {
-            logout();
-        } else if (args[0].equalsIgnoreCase("env")) {
-            System.out.println(System.getenv().toString());
-        } else {
-            printHelp();
-        }
-    }
-
-
-    public void printHelp() {
-        System.err.println("Commands:");
-        System.err.println("  login - login with desktop browser if available, otherwise do manual login.  Output is access token.");
-        System.err.println("  login-manual - manual login");
-        //System.err.println("  login-cli - attempt Keycloak proprietary cli protocol.  Otherwise do normal login");
-        System.err.println("  token - print access token if logged in");
-        System.err.println("  logout - logout.");
-        System.exit(1);
-    }
-
-    public AdapterConfig getConfig() {
-        String url = System.getProperty("KEYCLOAK_AUTH_SERVER");
-        if (url == null) {
-            System.err.println("KEYCLOAK_AUTH_SERVER property not set");
-            System.exit(1);
-        }
-        String realm = System.getProperty("KEYCLOAK_REALM");
-        if (realm == null) {
-            System.err.println("KEYCLOAK_REALM property not set");
-            System.exit(1);
-
-        }
-        String client = System.getProperty("KEYCLOAK_CLIENT");
-        if (client == null) {
-            System.err.println("KEYCLOAK_CLIENT property not set");
-            System.exit(1);
-        }
-        String secret = System.getProperty("KEYCLOAK_CLIENT_SECRET");
-
-
-
-        AdapterConfig config = new AdapterConfig();
-        config.setAuthServerUrl(url);
-        config.setRealm(realm);
-        config.setResource(client);
-        config.setSslRequired("external");
-        if (secret != null) {
-            Map<String, Object> creds = new HashMap<>();
-            creds.put("secret", secret);
-            config.setCredentials(creds);
-        } else {
-            config.setPublicClient(true);
-        }
-        return config;
-    }
-
-    public boolean checkToken(boolean outputToken) throws Exception {
-        String token = getTokenResponse();
-        if (token == null) return false;
-
-
-        if (token != null) {
-            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
-            if (m.find()) {
-                String json = m.group(0);
-                try {
-                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
-                        return true;
-                    }
-                    AdapterConfig config = getConfig();
-                    KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-                    installed.refreshToken(tokenResponse.getRefreshToken());
-                    processResponse(installed, outputToken);
-                    return true;
-                } catch (Exception e) {
-                    System.err.println("Error processing existing token");
-                    e.printStackTrace();
-                }
-
-            }
-        }
-        return false;
-
-    }
-
-    private String getTokenResponse() throws IOException {
-        String token = null;
-        File tokenFile = getTokenFilePath();
-        if (tokenFile.exists()) {
-            FileInputStream fis = new FileInputStream(tokenFile);
-            byte[] data = new byte[(int) tokenFile.length()];
-            fis.read(data);
-            fis.close();
-            token = new String(data, "UTF-8");
-        }
-        return token;
-    }
-
-    public void token() throws Exception {
-        String token = getTokenResponse();
-        if (token == null) {
-            System.err.println("There is no token for client");
-            System.exit(1);
-        } else {
-            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
-            if (m.find()) {
-                String json = m.group(0);
-                try {
-                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
-                        System.out.println(tokenResponse.getToken());
-                        return;
-                    } else {
-                        System.err.println("token in response file is expired");
-                        System.exit(1);
-                    }
-                } catch (Exception e) {
-                    System.err.println("Failure processing token response file");
-                    e.printStackTrace();
-                    System.exit(1);
-                }
-            } else {
-                System.err.println("Could not find json within token response file");
-                System.exit(1);
-            }
-        }
-    }
-
-    public void login() throws Exception {
-        if (checkToken(true)) return;
-        AdapterConfig config = getConfig();
-        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-        installed.login();
-        processResponse(installed, true);
-    }
-
-    public void loginCli() throws Exception {
-        if (checkToken(false)) return;
-        AdapterConfig config = getConfig();
-        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-        if (!installed.loginCommandLine()) installed.login();
-        processResponse(installed, false);
-    }
-
-    public String getHome() {
-        String home = System.getenv("HOME");
-        if (home == null) {
-            home = System.getProperty("HOME");
-            if (home == null) {
-                home = Paths.get("").toAbsolutePath().normalize().toString();
-            }
-        }
-        return home;
-    }
-
-    public File getTokenDirectory() {
-        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM")).toFile();
-    }
-
-    public File getTokenFilePath() {
-        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM"), System.getProperty("KEYCLOAK_CLIENT") + ".json").toFile();
-    }
-
-    private void processResponse(KeycloakInstalled installed, boolean outputToken) throws IOException {
-        AccessTokenResponse tokenResponse = installed.getTokenResponse();
-        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
-        tokenResponse.setIdToken(null);
-        String output = JsonSerialization.writeValueAsString(tokenResponse);
-        getTokenDirectory().mkdirs();
-        FileOutputStream fos = new FileOutputStream(getTokenFilePath());
-        fos.write(output.getBytes("UTF-8"));
-        fos.flush();
-        fos.close();
-        if (outputToken) System.out.println(tokenResponse.getToken());
-    }
-
-    public void loginManual() throws Exception {
-        if (checkToken(true)) return;
-        AdapterConfig config = getConfig();
-        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
-        KeycloakInstalled installed = new KeycloakInstalled(deployment);
-        installed.loginManual();
-        processResponse(installed, true);
-    }
-
-    public void logout() throws Exception {
-        String token = getTokenResponse();
-        if (token != null) {
-            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
-            if (m.find()) {
-                String json = m.group(0);
-                try {
-                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                    if (Time.currentTime() > tokenResponse.getExpiresIn()) {
-                        System.err.println("Login is expired");
-                        System.exit(1);
-                    }
-                    AdapterConfig config = getConfig();
-                    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
-                    ServerRequest.invokeLogout(deployment, tokenResponse.getRefreshToken());
-                    for (File fp : getTokenDirectory().listFiles()) fp.delete();
-                    System.out.println("logout complete");
-                } catch (Exception e) {
-                    System.err.println("Failure processing token response file");
-                    e.printStackTrace();
-                    System.exit(1);
-                }
-            } else {
-                System.err.println("Could not find json within token response file");
-                System.exit(1);
-            }
-        } else {
-            System.err.println("Not logged in");
-            System.exit(1);
-        }
-    }
-}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakInstalled.java

@@ -17,27 +17,19 @@
 
 package org.keycloak.adapters.installed;
 
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
+import org.keycloak.RSATokenVerifier;
+import org.keycloak.common.VerificationException;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.ServerRequest;
-import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
-import org.keycloak.common.VerificationException;
-import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
 
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
 import java.awt.*;
 import java.io.BufferedReader;
 import java.io.IOException;
@@ -46,28 +38,19 @@ import java.io.InputStreamReader;
 import java.io.OutputStreamWriter;
 import java.io.PrintStream;
 import java.io.PrintWriter;
-import java.io.PushbackInputStream;
 import java.io.Reader;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.util.Locale;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public class KeycloakInstalled {
 
-    public interface HttpResponseWriter {
-        void success(PrintWriter pw, KeycloakInstalled ki);
-        void failure(PrintWriter pw, KeycloakInstalled ki);
-    }
-
     private static final String KEYCLOAK_JSON = "META-INF/keycloak.json";
 
     private KeycloakDeployment deployment;
@@ -76,21 +59,12 @@ public class KeycloakInstalled {
         LOGGED_MANUAL, LOGGED_DESKTOP
     }
 
-    private AccessTokenResponse tokenResponse;
     private String tokenString;
     private String idTokenString;
     private IDToken idToken;
     private AccessToken token;
     private String refreshToken;
     private Status status;
-    private Locale locale;
-    private HttpResponseWriter loginResponseWriter;
-    private HttpResponseWriter logoutResponseWriter;
-    Pattern callbackPattern = Pattern.compile("callback\\s*=\\s*\"([^\"]+)\"");
-    Pattern paramPattern = Pattern.compile("param=\"([^\"]+)\"\\s+label=\"([^\"]+)\"\\s+mask=(\\S+)");
-    Pattern codePattern = Pattern.compile("code=([^&]+)");
-
-
 
     public KeycloakInstalled() {
         InputStream config = Thread.currentThread().getContextClassLoader().getResourceAsStream(KEYCLOAK_JSON);
@@ -101,92 +75,6 @@ public class KeycloakInstalled {
         deployment = KeycloakDeploymentBuilder.build(config);
     }
 
-    public KeycloakInstalled(KeycloakDeployment deployment) {
-        this.deployment = deployment;
-    }
-
-    private static HttpResponseWriter defaultLoginWriter = new HttpResponseWriter() {
-        @Override
-        public void success(PrintWriter pw, KeycloakInstalled ki) {
-            pw.println("HTTP/1.1 200 OK");
-            pw.println("Content-Type: text/html");
-            pw.println();
-            pw.println("<html><h1>Login completed.</h1><div>");
-            pw.println("This browser will remain logged in until you close it, logout, or the session expires.");
-            pw.println("</div></html>");
-            pw.flush();
-
-        }
-
-        @Override
-        public void failure(PrintWriter pw, KeycloakInstalled ki) {
-            pw.println("HTTP/1.1 200 OK");
-            pw.println("Content-Type: text/html");
-            pw.println();
-            pw.println("<html><h1>Login attempt failed.</h1><div>");
-            pw.println("</div></html>");
-            pw.flush();
-
-        }
-    };
-    private static HttpResponseWriter defaultLogoutWriter = new HttpResponseWriter() {
-        @Override
-        public void success(PrintWriter pw, KeycloakInstalled ki) {
-            pw.println("HTTP/1.1 200 OK");
-            pw.println("Content-Type: text/html");
-            pw.println();
-            pw.println("<html><h1>Logout completed.</h1><div>");
-            pw.println("You may close this browser tab.");
-            pw.println("</div></html>");
-            pw.flush();
-
-        }
-
-        @Override
-        public void failure(PrintWriter pw, KeycloakInstalled ki) {
-            pw.println("HTTP/1.1 200 OK");
-            pw.println("Content-Type: text/html");
-            pw.println();
-            pw.println("<html><h1>Logout failed.</h1><div>");
-            pw.println("You may close this browser tab.");
-            pw.println("</div></html>");
-            pw.flush();
-
-        }
-    };
-
-    public HttpResponseWriter getLoginResponseWriter() {
-        if (loginResponseWriter == null) {
-            return defaultLoginWriter;
-        } else {
-            return loginResponseWriter;
-        }
-    }
-
-    public HttpResponseWriter getLogoutResponseWriter() {
-        if (logoutResponseWriter == null) {
-            return defaultLogoutWriter;
-        } else {
-            return logoutResponseWriter;
-        }
-    }
-
-    public void setLoginResponseWriter(HttpResponseWriter loginResponseWriter) {
-        this.loginResponseWriter = loginResponseWriter;
-    }
-
-    public void setLogoutResponseWriter(HttpResponseWriter logoutResponseWriter) {
-        this.logoutResponseWriter = logoutResponseWriter;
-    }
-
-    public Locale getLocale() {
-        return locale;
-    }
-
-    public void setLocale(Locale locale) {
-        this.locale = locale;
-    }
-
     public void login() throws IOException, ServerRequest.HttpFailure, VerificationException, InterruptedException, OAuthErrorException, URISyntaxException {
         if (isDesktopSupported()) {
             loginDesktop();
@@ -220,22 +108,19 @@ public class KeycloakInstalled {
     }
 
     public void loginDesktop() throws IOException, VerificationException, OAuthErrorException, URISyntaxException, ServerRequest.HttpFailure, InterruptedException {
-        CallbackListener callback = new CallbackListener(getLoginResponseWriter());
+        CallbackListener callback = new CallbackListener();
         callback.start();
 
         String redirectUri = "http://localhost:" + callback.server.getLocalPort();
         String state = UUID.randomUUID().toString();
 
-        KeycloakUriBuilder builder = deployment.getAuthUrl().clone()
+        String authUrl = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
                 .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
                 .queryParam(OAuth2Constants.STATE, state)
-                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID);
-        if (locale != null) {
-            builder.queryParam(OAuth2Constants.UI_LOCALES_PARAM, locale.getLanguage());
-        }
-        String authUrl = builder.build().toString();
+                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
+                .build().toString();
 
         Desktop.getDesktop().browse(new URI(authUrl));
 
@@ -259,7 +144,7 @@ public class KeycloakInstalled {
     }
 
     private void logoutDesktop() throws IOException, URISyntaxException, InterruptedException {
-        CallbackListener callback = new CallbackListener(getLogoutResponseWriter());
+        CallbackListener callback = new CallbackListener();
         callback.start();
 
         String redirectUri = "http://localhost:" + callback.server.getLocalPort();
@@ -282,6 +167,9 @@ public class KeycloakInstalled {
     }
 
     public void loginManual(PrintStream printer, Reader reader) throws IOException, ServerRequest.HttpFailure, VerificationException {
+        CallbackListener callback = new CallbackListener();
+        callback.start();
+
         String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
 
         String authUrl = deployment.getAuthUrl().clone()
@@ -302,86 +190,6 @@ public class KeycloakInstalled {
         status = Status.LOGGED_MANUAL;
     }
 
-    public boolean loginCommandLine() throws IOException, ServerRequest.HttpFailure, VerificationException {
-        String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
-
-        return loginCommandLine(redirectUri);
-    }
-
-
-
-    /**
-     * Experimental proprietary WWW-Authentication challenge protocol.
-     * WWW-Authentication: X-Text-Form-Challenge callback="{url}" param="{param-name}" label="{param-display-label}"
-     *
-     * @param redirectUri
-     * @return
-     * @throws IOException
-     * @throws ServerRequest.HttpFailure
-     * @throws VerificationException
-     */
-    public boolean loginCommandLine(String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
-        String authUrl = deployment.getAuthUrl().clone()
-                .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
-                .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
-                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
-                .build().toString();
-        ResteasyClient client = new ResteasyClientBuilder().disableTrustManager().build();
-        try {
-            Response response = client.target(authUrl).request().get();
-            if (response.getStatus() != 401) {
-                return false;
-            }
-            while (true) {
-                String authenticationHeader = response.getHeaderString(HttpHeaders.WWW_AUTHENTICATE);
-                if (authenticationHeader == null) {
-                    return false;
-                }
-                if (!authenticationHeader.contains("X-Text-Form-Challenge")) {
-                    return false;
-                }
-                if (response.getMediaType() != null) {
-                    String splash = response.readEntity(String.class);
-                    System.console().writer().println(splash);
-                }
-                Matcher m = callbackPattern.matcher(authenticationHeader);
-                if (!m.find()) return false;
-                String callback = m.group(1);
-                //System.err.println("callback: " + callback);
-                m = paramPattern.matcher(authenticationHeader);
-                Form form = new Form();
-                while (m.find()) {
-                    String param = m.group(1);
-                    String label = m.group(2);
-                    String mask = m.group(3).trim();
-                    boolean maskInput = mask.equals("true");
-                    String value = null;
-                    if (maskInput) {
-                        char[] txt = System.console().readPassword(label);
-                        value = new String(txt);
-                    } else {
-                        value = System.console().readLine(label);
-                    }
-                    form.param(param, value);
-                }
-                response = client.target(callback).request().post(Entity.form(form));
-                if (response.getStatus() == 401) continue;
-                if (response.getStatus() != 302) return false;
-                String location = response.getLocation().toString();
-                m = codePattern.matcher(location);
-                if (!m.find()) return false;
-                String code = m.group(1);
-                processCode(code, redirectUri);
-                return true;
-            }
-        } finally {
-            client.close();
-
-        }
-    }
-
-
     public String getTokenString() throws VerificationException, IOException, ServerRequest.HttpFailure {
         return tokenString;
     }
@@ -400,19 +208,12 @@ public class KeycloakInstalled {
         parseAccessToken(tokenResponse);
     }
 
-    public void refreshToken(String refreshToken)  throws IOException, ServerRequest.HttpFailure, VerificationException {
-        AccessTokenResponse tokenResponse = ServerRequest.invokeRefresh(deployment, refreshToken);
-        parseAccessToken(tokenResponse);
-
-    }
-
     private void parseAccessToken(AccessTokenResponse tokenResponse) throws VerificationException {
-        this.tokenResponse = tokenResponse;
         tokenString = tokenResponse.getToken();
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
 
-        token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+        token = RSATokenVerifier.verifyToken(tokenString, deployment.getRealmKey(), deployment.getRealmInfoUrl());
         if (idTokenString != null) {
             try {
                 JWSInput input = new JWSInput(idTokenString);
@@ -439,10 +240,6 @@ public class KeycloakInstalled {
         return refreshToken;
     }
 
-    public AccessTokenResponse getTokenResponse() {
-        return tokenResponse;
-    }
-
     public boolean isDesktopSupported() {
         return Desktop.isDesktopSupported();
     }
@@ -451,8 +248,6 @@ public class KeycloakInstalled {
         return deployment;
     }
 
-
-
     private void processCode(String code, String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, redirectUri, null);
         parseAccessToken(tokenResponse);
@@ -474,87 +269,6 @@ public class KeycloakInstalled {
         return sb.toString();
     }
 
-    public static class MaskingThread extends Thread {
-        private volatile boolean stop;
-        private char echochar = '*';
-
-        public MaskingThread() {
-        }
-
-        /**
-         * Begin masking until asked to stop.
-         */
-        public void run() {
-
-            int priority = Thread.currentThread().getPriority();
-            Thread.currentThread().setPriority(Thread.MAX_PRIORITY);
-
-            try {
-                stop = true;
-                while(stop) {
-                    System.out.print("\010" + echochar);
-                    try {
-                        // attempt masking at this rate
-                        Thread.currentThread().sleep(1);
-                    }catch (InterruptedException iex) {
-                        Thread.currentThread().interrupt();
-                        return;
-                    }
-                }
-            } finally { // restore the original priority
-                Thread.currentThread().setPriority(priority);
-            }
-        }
-
-        /**
-         * Instruct the thread to stop masking.
-         */
-        public void stopMasking() {
-            this.stop = false;
-        }
-    }
-
-    public static String readMasked(Reader reader) {
-        MaskingThread et = new MaskingThread();
-        Thread mask = new Thread(et);
-        mask.start();
-
-        BufferedReader in = new BufferedReader(reader);
-        String password = "";
-
-        try {
-            password = in.readLine();
-        } catch (IOException ioe) {
-            ioe.printStackTrace();
-        }
-        // stop masking
-        et.stopMasking();
-        // return the password entered by the user
-        return password;
-    }
-
-    private String readLine(Reader reader, boolean mask) throws IOException {
-        if (mask) {
-            System.out.print(" ");
-            return readMasked(reader);
-        }
-
-        StringBuilder sb = new StringBuilder();
-
-        char cb[] = new char[1];
-        while (reader.read(cb) != -1) {
-            char c = cb[0];
-            if ((c == '\n') || (c == '\r')) {
-                break;
-            } else {
-                sb.append(c);
-            }
-        }
-
-        return sb.toString();
-    }
-
-
     public class CallbackListener extends Thread {
 
         private ServerSocket server;
@@ -569,19 +283,14 @@ public class KeycloakInstalled {
 
         private String state;
 
-        private Socket socket;
-
-        private HttpResponseWriter writer;
-
-        public CallbackListener(HttpResponseWriter writer) throws IOException {
-            this.writer = writer;
+        public CallbackListener() throws IOException {
             server = new ServerSocket(0);
         }
 
         @Override
         public void run() {
             try {
-                socket = server.accept();
+                Socket socket = server.accept();
 
                 BufferedReader br = new BufferedReader(new InputStreamReader(socket.getInputStream()));
                 String request = br.readLine();
@@ -605,15 +314,10 @@ public class KeycloakInstalled {
                     }
                 }
 
-                OutputStreamWriter out = new OutputStreamWriter(socket.getOutputStream());
-                PrintWriter pw = new PrintWriter(out);
-
-                if (error == null) {
-                    writer.success(pw, KeycloakInstalled.this);
-                } else {
-                    writer.failure(pw, KeycloakInstalled.this);
-                }
+                PrintWriter pw = new PrintWriter(new OutputStreamWriter(socket.getOutputStream()));
+                pw.println("Please close window and return to application");
                 pw.flush();
+
                 socket.close();
             } catch (IOException e) {
                 errorException = e;
@@ -624,8 +328,6 @@ public class KeycloakInstalled {
             } catch (IOException e) {
             }
         }
-
     }
 
-
 }

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsBearerTokenFilterImpl.java

@@ -20,6 +20,8 @@ package org.keycloak.jaxrs;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AdapterUtils;
+import org.keycloak.adapters.spi.AuthChallenge;
+import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.AuthenticatedActionsHandler;
 import org.keycloak.adapters.BasicAuthRequestAuthenticator;
 import org.keycloak.adapters.BearerTokenRequestAuthenticator;
@@ -29,8 +31,6 @@ import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.NodesRegistrationManagement;
 import org.keycloak.adapters.PreAuthActionsHandler;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.spi.AuthChallenge;
-import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.UserSessionManagement;
 import org.keycloak.common.constants.GenericConstants;
 
@@ -40,6 +40,7 @@ import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.container.PreMatching;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.SecurityContext;
+
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -17,20 +17,21 @@
 
 package org.keycloak.jaxrs;
 
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.AuthenticationError;
-import org.keycloak.adapters.spi.LogoutError;
-import org.keycloak.common.util.HostUtils;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.List;
+import java.util.Map;
 
 import javax.security.cert.X509Certificate;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.SecurityContext;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.util.List;
-import java.util.Map;
+
+import org.keycloak.KeycloakSecurityContext;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.AuthenticationError;
+import org.keycloak.adapters.spi.LogoutError;
+import org.keycloak.common.util.HostUtils;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -66,11 +67,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
             return requestContext.getUriInfo().getRequestUri().toString();
         }
 
-        @Override
-        public String getRelativePath() {
-            return requestContext.getUriInfo().getPath();
-        }
-
         @Override
         public boolean isSecure() {
             return securityContext.isSecure();

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/OsgiJaxrsBearerTokenFilterImpl.java

@@ -17,18 +17,19 @@
 
 package org.keycloak.jaxrs;
 
-import org.keycloak.adapters.KeycloakConfigResolver;
-import org.keycloak.common.constants.GenericConstants;
-import org.osgi.framework.BundleContext;
-
-import javax.annotation.Priority;
-import javax.ws.rs.Priorities;
-import javax.ws.rs.container.PreMatching;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
 import java.util.logging.Logger;
 
+import javax.annotation.Priority;
+import javax.ws.rs.Priorities;
+import javax.ws.rs.container.PreMatching;
+
+import org.keycloak.adapters.KeycloakConfigResolver;
+import org.keycloak.common.constants.GenericConstants;
+import org.osgi.framework.BundleContext;
+
 /**
  * Variant of JaxrsBearerTokenFilter, which can be used to properly use resources from current osgi bundle
  *

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/AbstractKeycloakJettyAuthenticator.java

@@ -27,26 +27,28 @@ import org.eclipse.jetty.security.authentication.FormAuthenticator;
 import org.eclipse.jetty.security.authentication.LoginAuthenticator;
 import org.eclipse.jetty.server.Authentication;
 import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.Response;
 import org.eclipse.jetty.server.UserIdentity;
 import org.eclipse.jetty.server.handler.ContextHandler;
+import org.eclipse.jetty.util.URIUtil;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.AdapterUtils;
+import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
+import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
+import org.keycloak.adapters.spi.AuthChallenge;
+import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.AuthenticatedActionsHandler;
+import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.KeycloakConfigResolver;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.NodesRegistrationManagement;
 import org.keycloak.adapters.PreAuthActionsHandler;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
-import org.keycloak.adapters.spi.AuthChallenge;
-import org.keycloak.adapters.spi.AuthOutcome;
-import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.enums.TokenStore;
 import org.keycloak.representations.adapters.config.AdapterConfig;
@@ -59,6 +61,7 @@ import javax.servlet.http.HttpServletResponse;
 import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
+import java.io.IOException;
 import java.io.InputStream;
 import java.util.HashSet;
 import java.util.Set;
@@ -106,8 +109,6 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
 
     public abstract AdapterTokenStore createSessionTokenStore(Request request, KeycloakDeployment resolvedDeployment);
 
-    public abstract JettyUserSessionManagement createSessionManagement(Request request);
-
     public void logoutCurrent(Request request) {
         AdapterDeploymentContext deploymentContext = (AdapterDeploymentContext) request.getAttribute(AdapterDeploymentContext.class.getName());
         KeycloakSecurityContext ksc = (KeycloakSecurityContext) request.getAttribute(KeycloakSecurityContext.class.getName());
@@ -289,7 +290,7 @@ public abstract class AbstractKeycloakJettyAuthenticator extends LoginAuthentica
             log.debug("*** deployment isn't configured return false");
             return Authentication.UNAUTHENTICATED;
         }
-        PreAuthActionsHandler handler = new PreAuthActionsHandler(createSessionManagement(request), deploymentContext, facade);
+        PreAuthActionsHandler handler = new PreAuthActionsHandler(new JettyUserSessionManagement(request.getSessionManager()), deploymentContext, facade);
         if (handler.handleRequest()) {
             return Authentication.SEND_SUCCESS;
         }

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/JettyCookieTokenStore.java

@@ -23,11 +23,11 @@ import org.keycloak.KeycloakPrincipal;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.CookieTokenStore;
+import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OidcKeycloakAccount;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 import org.keycloak.adapters.RequestAuthenticator;
-import org.keycloak.adapters.spi.HttpFacade;
 
 /**
  * Handle storage of token info in cookie. Per-request object.

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/JettyRequestAuthenticator.java

@@ -23,12 +23,12 @@ import org.keycloak.KeycloakPrincipal;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.AdapterUtils;
+import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OAuthRequestAuthenticator;
 import org.keycloak.adapters.OidcKeycloakAccount;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 import org.keycloak.adapters.RequestAuthenticator;
-import org.keycloak.adapters.spi.HttpFacade;
 
 import javax.servlet.http.HttpSession;
 import java.security.Principal;

adapters/oidc/jetty/jetty-core/src/main/java/org/keycloak/adapters/jetty/core/JettySessionTokenStore.java

@@ -21,13 +21,13 @@ import org.eclipse.jetty.server.Request;
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.KeycloakSecurityContext;
+import org.keycloak.adapters.spi.AdapterSessionStore;
 import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.AdapterUtils;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OidcKeycloakAccount;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 import org.keycloak.adapters.RequestAuthenticator;
-import org.keycloak.adapters.spi.AdapterSessionStore;
 
 import javax.servlet.http.HttpSession;
 

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/Jetty81SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty81SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty81SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -20,8 +20,8 @@ package org.keycloak.adapters.jetty;
 import org.eclipse.jetty.security.authentication.FormAuthenticator;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.adapters.spi.AdapterSessionStore;
+import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.common.util.MultivaluedHashMap;
 
 import javax.servlet.http.HttpSession;

adapters/oidc/jetty/jetty8.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -25,7 +25,6 @@ import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -45,11 +44,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty81SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request)?(Request)req: AbstractHttpConnection.getCurrentConnection().getRequest();

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/Jetty91SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty91SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty91SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -21,8 +21,8 @@ import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.security.authentication.FormAuthenticator;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.adapters.spi.AdapterSessionStore;
+import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.common.util.MultivaluedHashMap;
 
 import javax.servlet.http.HttpSession;

adapters/oidc/jetty/jetty9.1/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,7 +27,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -47,11 +46,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty91SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected Request resolveRequest(ServletRequest req) {
         return (req instanceof Request) ? (Request)req : HttpChannel.getCurrentHttpChannel().getRequest();

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/Jetty92SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty92SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty92SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -21,8 +21,8 @@ import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.security.authentication.FormAuthenticator;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.adapters.spi.AdapterSessionStore;
+import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.common.util.MultivaluedHashMap;
 
 import javax.servlet.http.HttpSession;

adapters/oidc/jetty/jetty9.2/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -27,7 +27,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -62,11 +61,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty92SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
+        <version>2.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/Jetty93SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.SessionManager;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty93SessionManager implements JettySessionManager {
-    protected SessionManager sessionManager;
-
-    public Jetty93SessionManager(SessionManager sessionManager) {
-        this.sessionManager = sessionManager;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionManager.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -17,11 +17,12 @@
 
 package org.keycloak.adapters.jetty;
 
+import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.security.authentication.FormAuthenticator;
 import org.eclipse.jetty.server.Request;
 import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.adapters.spi.AdapterSessionStore;
+import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
 import org.keycloak.common.util.MultivaluedHashMap;
 
 import javax.servlet.http.HttpSession;

adapters/oidc/jetty/jetty9.3/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -26,7 +26,6 @@ import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
 import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
 import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
 import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
 
 import javax.servlet.ServletRequest;
 
@@ -61,11 +60,6 @@ public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticat
         return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
     }
 
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty93SessionManager(request.getSessionManager()));
-    }
-
     @Override
     protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
                                                                    KeycloakDeployment deployment, AdapterTokenStore tokenStore) {

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -1,156 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <parent>
-		<artifactId>keycloak-parent</artifactId>
-		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta1</version>
-		<relativePath>../../../../pom.xml</relativePath>
-	</parent>
-	<modelVersion>4.0.0</modelVersion>
-
-	<artifactId>keycloak-jetty94-adapter</artifactId>
-	<name>Keycloak Jetty 9.4.x Integration</name>
-    <properties>
-        <jetty9.version>9.4.2.v20170220</jetty9.version>
-        <keycloak.osgi.export>
-            org.keycloak.adapters.jetty.*
-        </keycloak.osgi.export>
-        <keycloak.osgi.import>
-            org.eclipse.jetty.*;resolution:=optional,
-            javax.servlet.*;version="[3.0,4)";resolution:=optional,
-            org.keycloak.*;version="${project.version}",
-            *;resolution:=optional
-        </keycloak.osgi.import>
-    </properties>
-	<description />
-
-	<dependencies>
-        <dependency>
-            <groupId>org.jboss.logging</groupId>
-            <artifactId>jboss-logging</artifactId>
-            <version>${jboss.logging.version}</version>
-        </dependency>
-		<dependency>
-			<groupId>org.keycloak</groupId>
-			<artifactId>keycloak-core</artifactId>
-		</dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-adapter-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-jetty-core</artifactId>
-        </dependency>
-		<dependency>
-			<groupId>org.apache.httpcomponents</groupId>
-			<artifactId>httpclient</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.bouncycastle</groupId>
-			<artifactId>bcprov-jdk15on</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-		</dependency>
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-server</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-util</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-        <dependency>
-            <groupId>org.eclipse.jetty</groupId>
-            <artifactId>jetty-security</artifactId>
-            <version>${jetty9.version}</version>
-            <scope>provided</scope>
-        </dependency>
-
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-					<source>1.6</source>
-					<target>1.6</target>
-				</configuration>
-			</plugin>
-
-            <!-- Adding OSGI metadata to the JAR without changing the packaging type. -->
-            <plugin>
-                <artifactId>maven-jar-plugin</artifactId>
-                <configuration>
-                    <archive>
-                        <manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
-                    </archive>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.felix</groupId>
-                <artifactId>maven-bundle-plugin</artifactId>
-                <extensions>true</extensions>
-                <executions>
-                    <execution>
-                        <id>bundle-manifest</id>
-                        <phase>process-classes</phase>
-                        <goals>
-                            <goal>manifest</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <instructions>
-                        <Bundle-ClassPath>.</Bundle-ClassPath>
-                        <Bundle-Name>${project.name}</Bundle-Name>
-                        <Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
-                        <Import-Package>${keycloak.osgi.import}</Import-Package>
-                        <Export-Package>${keycloak.osgi.export}</Export-Package>
-                    </instructions>
-                </configuration>
-            </plugin>
-		</plugins>
-	</build>
-
-</project>

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/Jetty94RequestAuthenticator.java

@@ -1,47 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.Request;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
-import org.keycloak.adapters.spi.HttpFacade;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty94RequestAuthenticator extends JettyRequestAuthenticator {
-    public Jetty94RequestAuthenticator(HttpFacade facade, KeycloakDeployment deployment, AdapterTokenStore tokenStore, int sslRedirectPort, Request request) {
-        super(facade, deployment, tokenStore, sslRedirectPort, request);
-    }
-
-    @Override
-    protected String changeHttpSessionId(boolean create) {
-        Request request = this.request;
-        HttpSession session = request.getSession(false);
-        if (session == null) {
-            return request.getSession(true).getId();
-        }
-        if (!deployment.isTurnOffChangeSessionIdOnLogin()) return request.changeSessionId();
-        else return session.getId();
-    }
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/Jetty94SessionManager.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.session.SessionHandler;
-import org.keycloak.adapters.jetty.spi.JettySessionManager;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class Jetty94SessionManager implements JettySessionManager {
-    protected SessionHandler sessionHandler;
-
-    public Jetty94SessionManager(SessionHandler sessionHandler) {
-        this.sessionHandler = sessionHandler;
-    }
-
-    @Override
-    public HttpSession getHttpSession(String id) {
-        return sessionHandler.getHttpSession(id);
-    }
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/JettyAdapterSessionStore.java

@@ -1,111 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.security.authentication.FormAuthenticator;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.util.MultiMap;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.spi.AdapterSessionStore;
-import org.keycloak.common.util.MultivaluedHashMap;
-
-import javax.servlet.http.HttpSession;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class JettyAdapterSessionStore implements AdapterSessionStore {
-    public static final String CACHED_FORM_PARAMETERS = "__CACHED_FORM_PARAMETERS";
-    protected Request myRequest;
-
-    public JettyAdapterSessionStore(Request request) {
-        this.myRequest = request; // for IDE/compilation purposes
-    }
-
-    protected MultiMap<String> extractFormParameters(Request base_request) {
-        MultiMap<String> formParameters = new MultiMap<String>();
-        base_request.extractFormParameters(formParameters);
-        return formParameters;
-    }
-    protected void restoreFormParameters(MultiMap<String> j_post, Request base_request) {
-        base_request.setContentParameters(j_post);
-    }
-
-    public boolean restoreRequest() {
-        HttpSession session = myRequest.getSession(false);
-        if (session == null) return false;
-        synchronized (session) {
-            String j_uri = (String) session.getAttribute(FormAuthenticator.__J_URI);
-            if (j_uri != null) {
-                // check if the request is for the same url as the original and restore
-                // params if it was a post
-                StringBuffer buf = myRequest.getRequestURL();
-                if (myRequest.getQueryString() != null)
-                    buf.append("?").append(myRequest.getQueryString());
-                if (j_uri.equals(buf.toString())) {
-                    String method = (String)session.getAttribute(JettyHttpFacade.__J_METHOD);
-                    myRequest.setMethod(method);
-                    MultivaluedHashMap<String, String> j_post = (MultivaluedHashMap<String, String>) session.getAttribute(CACHED_FORM_PARAMETERS);
-                    if (j_post != null) {
-                        myRequest.setContentType("application/x-www-form-urlencoded");
-                        MultiMap<String> map = new MultiMap<String>();
-                        for (String key : j_post.keySet()) {
-                            for (String val : j_post.getList(key)) {
-                                map.add(key, val);
-                            }
-                        }
-                        restoreFormParameters(map, myRequest);
-                    }
-                    session.removeAttribute(FormAuthenticator.__J_URI);
-                    session.removeAttribute(JettyHttpFacade.__J_METHOD);
-                    session.removeAttribute(FormAuthenticator.__J_POST);
-                }
-                return true;
-            }
-        }
-        return false;
-    }
-
-    public void saveRequest() {
-        // remember the current URI
-        HttpSession session = myRequest.getSession();
-        synchronized (session) {
-            // But only if it is not set already, or we save every uri that leads to a login form redirect
-            if (session.getAttribute(FormAuthenticator.__J_URI) == null) {
-                StringBuffer buf = myRequest.getRequestURL();
-                if (myRequest.getQueryString() != null)
-                    buf.append("?").append(myRequest.getQueryString());
-                session.setAttribute(FormAuthenticator.__J_URI, buf.toString());
-                session.setAttribute(JettyHttpFacade.__J_METHOD, myRequest.getMethod());
-
-                if ("application/x-www-form-urlencoded".equals(myRequest.getContentType()) && "POST".equalsIgnoreCase(myRequest.getMethod())) {
-                    MultiMap<String> formParameters = extractFormParameters(myRequest);
-                    MultivaluedHashMap<String, String> map = new MultivaluedHashMap<String, String>();
-                    for (String key : formParameters.keySet()) {
-                        for (Object value : formParameters.getValues(key)) {
-                            map.add(key, (String) value);
-                        }
-                    }
-                    session.setAttribute(CACHED_FORM_PARAMETERS, map);
-                }
-            }
-        }
-    }
-
-}

adapters/oidc/jetty/jetty9.4/src/main/java/org/keycloak/adapters/jetty/KeycloakJettyAuthenticator.java

@@ -1,75 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.jetty;
-
-import org.eclipse.jetty.server.Authentication;
-import org.eclipse.jetty.server.Request;
-import org.eclipse.jetty.server.UserIdentity;
-import org.keycloak.adapters.AdapterTokenStore;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator;
-import org.keycloak.adapters.jetty.core.JettyRequestAuthenticator;
-import org.keycloak.adapters.jetty.core.JettySessionTokenStore;
-import org.keycloak.adapters.jetty.spi.JettyHttpFacade;
-import org.keycloak.adapters.jetty.spi.JettyUserSessionManagement;
-
-import javax.servlet.ServletRequest;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KeycloakJettyAuthenticator extends AbstractKeycloakJettyAuthenticator {
-
-    public KeycloakJettyAuthenticator() {
-        super();
-    }
-
-
-    @Override
-    protected Request resolveRequest(ServletRequest req) {
-        return Request.getBaseRequest(req);
-    }
-
-    @Override
-    protected Authentication createAuthentication(UserIdentity userIdentity, final Request request) {
-        return new KeycloakAuthentication(getAuthMethod(), userIdentity) {
-            @Override
-            public void logout() {
-                logoutCurrent(request);
-            }
-        };
-    }
-
-    @Override
-    public AdapterTokenStore createSessionTokenStore(Request request, KeycloakDeployment resolvedDeployment) {
-        return new JettySessionTokenStore(request, resolvedDeployment, new JettyAdapterSessionStore(request));
-    }
-
-    @Override
-    public JettyUserSessionManagement createSessionManagement(Request request) {
-        return new JettyUserSessionManagement(new Jetty94SessionManager(request.getSessionHandler()));
-    }
-
-    @Override
-    protected JettyRequestAuthenticator createRequestAuthenticator(Request request, JettyHttpFacade facade,
-                                                                   KeycloakDeployment deployment, AdapterTokenStore tokenStore) {
-        return new Jetty94RequestAuthenticator(facade, deployment, tokenStore, -1, request);
-    }
-
-}