Set version to 3.3.0.CR2

KEYCLOAK-3473 : add new flag to determine if error response must be sent or not

.travis.yml

@@ -15,23 +15,12 @@ env:
     - TESTS=server-group3
     - TESTS=server-group4
     - TESTS=old
-    - TESTS=crossdc
 
 jdk:
   - oraclejdk8
 
 install: true
 
-before_install:
-  - "export PHANTOMJS_VERSION=2.1.1"
-  - "phantomjs --version"
-  - "export PATH=$PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64/bin:$PATH"
-  - "phantomjs --version"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then rm -rf $PWD/travis_phantomjs; mkdir -p $PWD/travis_phantomjs; fi"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then wget https://github.com/Medium/phantomjs/releases/download/v$PHANTOMJS_VERSION/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -O $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2; fi"
-  - "if [ $(phantomjs --version) != '$PHANTOMJS_VERSION' ]; then tar -xvf $PWD/travis_phantomjs/phantomjs-$PHANTOMJS_VERSION-linux-x86_64.tar.bz2 -C $PWD/travis_phantomjs; fi"
-  - "phantomjs --version"
-
 script: 
   - ./travis-run-tests.sh $TESTS
 

README.md

@@ -38,7 +38,7 @@ Starting Keycloak
 
 To start Keycloak during development first build as specified above, then run:
 
-    mvn -f testsuite/utils/pom.xml exec:java -Pkeycloak-server 
+    mvn -f testsuite/integration/pom.xml exec:java -Pkeycloak-server 
 
 
 To start Keycloak from the server distribution first build the distribution it as specified above, then run:
@@ -49,10 +49,6 @@ To start Keycloak from the server distribution first build the distribution it a
     
 To stop the server press `Ctrl + C`.
 
-Reporting security vulnerabilities
-----------------------------------
-
-If you've found a security vulnerability, please look at the [instructions on how to properly report it](http://www.keycloak.org/security.html)
 
 Help and Documentation
 ----------------------

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -206,16 +206,6 @@ public class AdapterDeploymentContext {
         public void setBearerOnly(boolean bearerOnly) {
             delegate.setBearerOnly(bearerOnly);
         }
-        
-        @Override
-        public boolean isAutodetectBearerOnly() {
-            return delegate.isAutodetectBearerOnly();
-        }
-        
-        @Override
-        public void setAutodetectBearerOnly(boolean autodetectBearerOnly) {
-            delegate.setAutodetectBearerOnly(autodetectBearerOnly);
-        }
 
         @Override
         public boolean isEnableBasicAuth() {
@@ -287,16 +277,6 @@ public class AdapterDeploymentContext {
             delegate.setSslRequired(sslRequired);
         }
 
-        @Override
-        public int getConfidentialPort() {
-            return delegate.getConfidentialPort();
-        }
-
-        @Override
-        public void setConfidentialPort(int confidentialPort) {
-            delegate.setConfidentialPort(confidentialPort);
-        }
-
         @Override
         public TokenStore getTokenStore() {
             return delegate.getTokenStore();

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -102,14 +102,6 @@ public class AuthenticatedActionsHandler {
         KeycloakSecurityContext securityContext = facade.getSecurityContext();
         String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
         String exposeHeaders = deployment.getCorsExposedHeaders();
-
-        if (deployment.getPolicyEnforcer() != null) {
-            if (exposeHeaders != null) {
-                exposeHeaders += ",";
-            }
-            exposeHeaders += "WWW-Authenticate";
-        }
-
         String requestOrigin = UriUtils.getOrigin(facade.getRequest().getURI());
         log.debugv("Origin: {0} uri: {1}", origin, facade.getRequest().getURI());
         if (securityContext != null && origin != null && !origin.equals(requestOrigin)) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BasicAuthRequestAuthenticator.java

@@ -71,10 +71,9 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         AccessTokenResponse atr=null;        
         try {
             String userpw=new String(Base64.decode(tokenString));
-            int seperatorIndex = userpw.indexOf(":");
-            String user = userpw.substring(0, seperatorIndex);
-            String pw = userpw.substring(seperatorIndex + 1);
-            atr = getToken(user, pw);
+            String[] parts=userpw.split(":");
+            
+            atr = getToken(parts[0], parts[1]);
             tokenString = atr.getToken();
         } catch (Exception e) {
             log.debug("Failed to obtain token", e);
@@ -83,8 +82,8 @@ public class BasicAuthRequestAuthenticator extends BearerTokenRequestAuthenticat
         }
 
         return authenticateToken(exchange, atr.getToken());
-    } 
- 
+    }
+    
     private AccessTokenResponse getToken(String username, String password) throws Exception {
     	AccessTokenResponse tokenResponse=null;
     	HttpClient client = deployment.getClient();

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BearerTokenRequestAuthenticator.java

@@ -23,8 +23,6 @@ import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 
 import javax.security.cert.X509Certificate;
@@ -85,16 +83,6 @@ public class BearerTokenRequestAuthenticator {
     }
     
     protected AuthOutcome authenticateToken(HttpFacade exchange, String tokenString) {
-        log.debug("Verifying access_token");
-        if (log.isTraceEnabled()) {
-            try {
-                JWSInput jwsInput = new JWSInput(tokenString);
-                String wireString = jwsInput.getWireString();
-                log.tracef("\taccess_token: %s", wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
-            } catch (JWSInputException e) {
-                log.errorf(e, "Failed to parse access_token: %s", tokenString);
-            }
-        }
         try {
             token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
         } catch (VerificationException e) {
@@ -136,7 +124,6 @@ public class BearerTokenRequestAuthenticator {
             }
             surrogate = chain[0].getSubjectDN().getName();
         }
-        log.debug("successful authorized");
         return AuthOutcome.AUTHENTICATED;
     }
 
@@ -174,10 +161,6 @@ public class BearerTokenRequestAuthenticator {
 
             @Override
             public boolean challenge(HttpFacade facade) {
-                if (deployment.getPolicyEnforcer() != null) {
-                    deployment.getPolicyEnforcer().enforce(OIDCHttpFacade.class.cast(facade));
-                    return true;
-                }
                 OIDCAuthenticationError error = new OIDCAuthenticationError(reason, description);
                 facade.getRequest().setError(error);
                 facade.getResponse().addHeader("WWW-Authenticate", challenge);

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/HttpClientBuilder.java

@@ -57,8 +57,6 @@ import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
-import org.apache.http.client.params.ClientPNames;
-import org.apache.http.client.params.CookiePolicy;
 
 /**
  * Abstraction for creating HttpClients. Allows SSL configuration.
@@ -291,7 +289,6 @@ public class HttpClientBuilder {
                 cm = new SingleClientConnManager(registry);
             }
             BasicHttpParams params = new BasicHttpParams();
-            params.setParameter(ClientPNames.COOKIE_POLICY, CookiePolicy.BROWSER_COMPATIBILITY);
 
             if (proxyHost != null) {
                 params.setParameter(ConnRoutePNames.DEFAULT_PROXY, proxyHost);

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java

@@ -68,7 +68,6 @@ public class KeycloakDeployment {
 
     protected String scope;
     protected SslRequired sslRequired = SslRequired.ALL;
-    protected int confidentialPort = -1;
     protected TokenStore tokenStore = TokenStore.SESSION;
     protected String stateCookieName = "OAuth_Token_Request_State";
     protected boolean useResourceRoleMappings;
@@ -154,8 +153,6 @@ public class KeycloakDeployment {
             log.debug("resolveUrls");
         }
 
-        authServerBaseUrl = authUrlBuilder.build().toString();
-
         String login = authUrlBuilder.clone().path(ServiceUrlConstants.AUTH_PATH).build(getRealm()).toString();
         authUrl = KeycloakUriBuilder.fromUri(login);
         realmInfoUrl = authUrlBuilder.clone().path(ServiceUrlConstants.REALM_INFO_PATH).build(getRealm()).toString();
@@ -280,14 +277,6 @@ public class KeycloakDeployment {
         this.sslRequired = sslRequired;
     }
 
-    public int getConfidentialPort() {
-        return confidentialPort;
-    }
-
-    public void setConfidentialPort(int confidentialPort) {
-        this.confidentialPort = confidentialPort;
-    }
-
     public TokenStore getTokenStore() {
         return tokenStore;
     }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java

@@ -78,11 +78,6 @@ public class KeycloakDeploymentBuilder {
         } else {
             deployment.setSslRequired(SslRequired.EXTERNAL);
         }
-
-        if (adapterConfig.getConfidentialPort() != -1) {
-            deployment.setConfidentialPort(adapterConfig.getConfidentialPort());
-        }
-
         if (adapterConfig.getTokenStore() != null) {
             deployment.setTokenStore(TokenStore.valueOf(adapterConfig.getTokenStore().toUpperCase()));
         } else {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -66,7 +66,7 @@ public class OAuthRequestAuthenticator {
         this.reqAuthenticator = requestAuthenticator;
         this.facade = facade;
         this.deployment = deployment;
-        this.sslRedirectPort = deployment.getConfidentialPort() != -1 ? deployment.getConfidentialPort() : sslRedirectPort;
+        this.sslRedirectPort = sslRedirectPort;
         this.tokenStore = tokenStore;
     }
 
@@ -170,9 +170,6 @@ public class OAuthRequestAuthenticator {
         String maxAge = getQueryParamValue(OAuth2Constants.MAX_AGE);
         url = UriUtils.stripQueryParam(url, OAuth2Constants.MAX_AGE);
 
-        String uiLocales = getQueryParamValue(OAuth2Constants.UI_LOCALES_PARAM);
-        url = UriUtils.stripQueryParam(url, OAuth2Constants.UI_LOCALES_PARAM);
-
         KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
@@ -191,9 +188,6 @@ public class OAuthRequestAuthenticator {
         if (maxAge != null && maxAge.length() > 0) {
             redirectUriBuilder.queryParam(OAuth2Constants.MAX_AGE, maxAge);
         }
-        if (uiLocales != null && uiLocales.length() > 0) {
-            redirectUriBuilder.queryParam(OAuth2Constants.UI_LOCALES_PARAM, uiLocales);
-        }
 
         scope = TokenUtil.attachOIDCScope(scope);
         redirectUriBuilder.queryParam(OAuth2Constants.SCOPE, scope);
@@ -337,7 +331,7 @@ public class OAuthRequestAuthenticator {
         } catch (ServerRequest.HttpFailure failure) {
             log.error("failed to turn code into token");
             log.error("status from server: " + failure.getStatus());
-            if (failure.getError() != null) {
+            if (failure.getStatus() == 400 && failure.getError() != null) {
                 log.error("   " + failure.getError());
             }
             return challenge(403, OIDCAuthenticationError.Reason.CODE_TO_TOKEN_FAILURE, null);
@@ -350,14 +344,6 @@ public class OAuthRequestAuthenticator {
         tokenString = tokenResponse.getToken();
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
-
-        log.debug("Verifying tokens");
-        if (log.isTraceEnabled()) {
-            logToken("\taccess_token", tokenString);
-            logToken("\tid_token", idTokenString);
-            logToken("\trefresh_token", refreshToken);
-        }
-
         try {
             token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
             if (idTokenString != null) {
@@ -390,8 +376,7 @@ public class OAuthRequestAuthenticator {
     protected String stripOauthParametersFromRedirect() {
         KeycloakUriBuilder builder = KeycloakUriBuilder.fromUri(facade.getRequest().getURI())
                 .replaceQueryParam(OAuth2Constants.CODE, null)
-                .replaceQueryParam(OAuth2Constants.STATE, null)
-                .replaceQueryParam(OAuth2Constants.SESSION_STATE, null);
+                .replaceQueryParam(OAuth2Constants.STATE, null);
         return builder.build().toString();
     }
     
@@ -413,13 +398,4 @@ public class OAuthRequestAuthenticator {
         return originalUri;
     }
 
-    private void logToken(String name, String token) {
-        try {
-            JWSInput jwsInput = new JWSInput(token);
-            String wireString = jwsInput.getWireString();
-            log.tracef("\t%s: %s", name, wireString.substring(0, wireString.lastIndexOf(".")) + ".signature");
-        } catch (JWSInputException e) {
-            log.errorf(e, "Failed to parse %s: %s", name, token);
-        }
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/ClientIdAndSecretCredentialsProvider.java

@@ -32,7 +32,7 @@ import java.util.Map;
  */
 public class ClientIdAndSecretCredentialsProvider implements ClientCredentialsProvider {
 
-    private static Logger logger = Logger.getLogger(ClientIdAndSecretCredentialsProvider.class);
+    private static Logger logger = Logger.getLogger(ClientCredentialsProviderUtils.class);
 
     public static final String PROVIDER_ID = CredentialRepresentation.SECRET;
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authentication/JWTClientSecretCredentialsProvider.java

@@ -1,97 +0,0 @@
-package org.keycloak.adapters.authentication;
-
-import java.io.UnsupportedEncodingException;
-import java.util.Map;
-
-import javax.crypto.SecretKey;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.jboss.logging.Logger;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.AdapterUtils;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.util.Time;
-import org.keycloak.jose.jws.JWSBuilder;
-import org.keycloak.jose.jws.JWSInput;
-import org.keycloak.representations.JsonWebToken;
-
-/**
- * Client authentication based on JWT signed by client secret instead of private key .
- * See <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">specs</a> for more details.
- *
- * @author <a href="mailto:takashi.norimatsu.ws@hitachi.com">Takashi Norimatsu</a>
- */
-public class JWTClientSecretCredentialsProvider implements ClientCredentialsProvider {
-    
-	private static final Logger logger = Logger.getLogger(JWTClientSecretCredentialsProvider.class);
-	
-    public static final String PROVIDER_ID = "secret-jwt";
-    
-    private SecretKey clientSecret;
-    
-    @Override
-    public String getId() {
-        return PROVIDER_ID;
-    }
-    
-    @Override
-    public void init(KeycloakDeployment deployment, Object config) {
-        if (config == null || !(config instanceof Map)) {
-            throw new RuntimeException("Configuration of jwt credentials by client secret is missing or incorrect for client '" + deployment.getResourceName() + "'. Check your adapter configuration");
-        }
-        
-        Map<String, Object> cfg = (Map<String, Object>) config;
-        String clientSecretString = (String) cfg.get("secret");
-        if (clientSecretString == null) {
-            throw new RuntimeException("Missing parameter secret-jwt in configuration of jwt for client " + deployment.getResourceName());
-        }
-        setClientSecret(clientSecretString); 
-    }
-    
-    @Override
-    public void setClientCredentials(KeycloakDeployment deployment, Map<String, String> requestHeaders, Map<String, String> formParams) {
-        String signedToken = createSignedRequestToken(deployment.getResourceName(), deployment.getRealmInfoUrl());
-        formParams.put(OAuth2Constants.CLIENT_ASSERTION_TYPE, OAuth2Constants.CLIENT_ASSERTION_TYPE_JWT);
-        formParams.put(OAuth2Constants.CLIENT_ASSERTION, signedToken);
-    }
-   
-    public void setClientSecret(String clientSecretString) {
-        // Get client secret and validate signature
-        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
-        // The HMAC (Hash-based Message Authentication Code) is calculated using the octets of the UTF-8 representation of the client_secret as the shared key. 
-        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>
-        // because it must be implemented in every java platform.
-    	try {
-            clientSecret = new SecretKeySpec(clientSecretString.getBytes("UTF-8"), "HmacSHA256");
-        } catch (UnsupportedEncodingException e) {
-            throw new RuntimeException("Failed to create secret key spec due to unsupported encoding.");
-        }
-    }
-    
-    public String createSignedRequestToken(String clientId, String realmInfoUrl) {
-        JsonWebToken jwt = createRequestToken(clientId, realmInfoUrl);
-        // JOSE header {"alg":"HS256","typ" : "JWT"} no need "kid" due to using only one registered client secret.
-        // Use "HmacSHA256" consulting <a href="https://docs.oracle.com/javase/jp/8/docs/api/javax/crypto/Mac.html">java8 api</a>.
-        // because it must be implemented in every java platform.
-        return new JWSBuilder().jsonContent(jwt).hmac256(clientSecret);
-    }
-
-    private JsonWebToken createRequestToken(String clientId, String realmInfoUrl) {
-        // According to <a href="http://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication">OIDC's client authentication spec</a>,
-        // JWT claims is the same as one by private_key_jwt
-        
-        JsonWebToken reqToken = new JsonWebToken();
-        reqToken.id(AdapterUtils.generateId());
-        reqToken.issuer(clientId);
-        reqToken.subject(clientId);
-        reqToken.audience(realmInfoUrl);
-
-        int now = Time.currentTime();
-        reqToken.issuedAt(now);
-        // the same as in KEYCLOAK-2986, JWTClientCredentialsProvider's timeout field
-        reqToken.expiration(now + 10);
-        reqToken.notBefore(now);
-        return reqToken;
-    }
-
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -18,10 +18,9 @@
 package org.keycloak.adapters.authorization;
 
 import java.util.Collections;
-import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.Set;
 
 import org.jboss.logging.Logger;
@@ -32,12 +31,9 @@ import org.keycloak.adapters.spi.HttpFacade.Request;
 import org.keycloak.authorization.client.AuthzClient;
 import org.keycloak.authorization.client.ClientAuthorizationContext;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.AccessToken.Authorization;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.MethodConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.ScopeEnforcementMode;
 import org.keycloak.representations.idm.authorization.Permission;
 
 /**
@@ -46,110 +42,103 @@ import org.keycloak.representations.idm.authorization.Permission;
 public abstract class AbstractPolicyEnforcer {
 
     private static Logger LOGGER = Logger.getLogger(AbstractPolicyEnforcer.class);
-    private static final String HTTP_METHOD_DELETE = "DELETE";
-
+    private final PolicyEnforcerConfig enforcerConfig;
     private final PolicyEnforcer policyEnforcer;
 
-    protected AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
+    private Map<String, PathConfig> paths;
+    private AuthzClient authzClient;
+    private PathMatcher pathMatcher;
+
+    public AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
         this.policyEnforcer = policyEnforcer;
+        this.enforcerConfig = policyEnforcer.getEnforcerConfig();
+        this.authzClient = policyEnforcer.getClient();
+        this.pathMatcher = policyEnforcer.getPathMatcher();
+        this.paths = policyEnforcer.getPaths();
     }
 
     public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
-        EnforcementMode enforcementMode = getEnforcerConfig().getEnforcementMode();
+        EnforcementMode enforcementMode = this.enforcerConfig.getEnforcementMode();
 
         if (EnforcementMode.DISABLED.equals(enforcementMode)) {
             return createEmptyAuthorizationContext(true);
         }
 
-        Request request = httpFacade.getRequest();
-        PathConfig pathConfig = getPathConfig(request);
         KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
 
-        if (securityContext == null) {
-            if (pathConfig != null) {
-                challenge(pathConfig, getRequiredScopes(pathConfig, request), httpFacade);
-            }
-            return createEmptyAuthorizationContext(false);
-        }
+        if (securityContext != null) {
+            AccessToken accessToken = securityContext.getToken();
 
-        AccessToken accessToken = securityContext.getToken();
+            if (accessToken != null) {
+                Request request = httpFacade.getRequest();
+                String path = getPath(request);
+                PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
 
-        if (accessToken != null) {
-            if (LOGGER.isDebugEnabled()) {
                 LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
-            }
 
-            if (pathConfig == null) {
-                if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
-                    return createAuthorizationContext(accessToken, null);
+                if (pathConfig == null) {
+                    if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
+                        return createAuthorizationContext(accessToken, null);
+                    }
+
+                    LOGGER.debugf("Could not find a configuration for path [%s]", path);
+
+                    if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
+                        return createAuthorizationContext(accessToken, null);
+                    }
+
+                    handleAccessDenied(httpFacade);
+
+                    return createEmptyAuthorizationContext(false);
                 }
 
-                if (LOGGER.isDebugEnabled()) {
-                    LOGGER.debugf("Could not find a configuration for path [%s]", getPath(request));
+                if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
+                    return createEmptyAuthorizationContext(true);
                 }
 
-                if (isDefaultAccessDeniedUri(request)) {
-                    return createAuthorizationContext(accessToken, null);
+                Set<String> requiredScopes = getRequiredScopes(pathConfig, request);
+
+                if (isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
+                    try {
+                        return createAuthorizationContext(accessToken, pathConfig);
+                    } catch (Exception e) {
+                        throw new RuntimeException("Error processing path [" + pathConfig.getPath() + "].", e);
+                    }
                 }
 
-                handleAccessDenied(httpFacade);
-
-                return createEmptyAuthorizationContext(false);
-            }
-
-            if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                return createAuthorizationContext(accessToken, pathConfig);
-            }
-
-            MethodConfig methodConfig = getRequiredScopes(pathConfig, request);
-
-            if (isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
-                try {
-                    return createAuthorizationContext(accessToken, pathConfig);
-                } catch (Exception e) {
-                    throw new RuntimeException("Error processing path [" + pathConfig.getPath() + "].", e);
-                }
-            }
-
-            if (methodConfig != null && ScopeEnforcementMode.DISABLED.equals(methodConfig.getScopesEnforcementMode())) {
-                return createEmptyAuthorizationContext(true);
-            }
-
-            if (LOGGER.isDebugEnabled()) {
                 LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
-            }
 
-            if (!challenge(pathConfig, methodConfig, httpFacade)) {
-                if (LOGGER.isDebugEnabled()) {
+                if (!challenge(pathConfig, requiredScopes, httpFacade)) {
                     LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
+                    handleAccessDenied(httpFacade);
                 }
-                handleAccessDenied(httpFacade);
             }
         }
 
         return createEmptyAuthorizationContext(false);
     }
 
-    protected abstract boolean challenge(PathConfig pathConfig, MethodConfig methodConfig, OIDCHttpFacade facade);
+    protected abstract boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade);
 
-    protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig actualPathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         Request request = httpFacade.getRequest();
+        PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
 
-        if (isDefaultAccessDeniedUri(request)) {
+        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
             return true;
         }
 
-        Authorization authorization = accessToken.getAuthorization();
+        AccessToken.Authorization authorization = accessToken.getAuthorization();
 
         if (authorization == null) {
             return false;
         }
 
+        List<Permission> permissions = authorization.getPermissions();
         boolean hasPermission = false;
-        List<Permission> grantedPermissions = authorization.getPermissions();
 
-        for (Permission permission : grantedPermissions) {
-            if (permission.getResourceId() != null) {
+        for (Permission permission : permissions) {
+            if (permission.getResourceSetId() != null) {
                 if (isResourcePermission(actualPathConfig, permission)) {
                     hasPermission = true;
 
@@ -157,19 +146,16 @@ public abstract class AbstractPolicyEnforcer {
                         continue;
                     }
 
-                    if (hasResourceScopePermission(methodConfig, permission)) {
-                        if (LOGGER.isDebugEnabled()) {
-                            LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, grantedPermissions);
+                    if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
+                        LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, permissions);
+                        if (request.getMethod().equalsIgnoreCase("DELETE") && actualPathConfig.isInstance()) {
+                            this.paths.remove(actualPathConfig);
                         }
-                        if (HTTP_METHOD_DELETE.equalsIgnoreCase(request.getMethod()) && actualPathConfig.isInstance()) {
-                            policyEnforcer.getPathMatcher().removeFromCache(getPath(request));
-                        }
-
-                        return hasValidClaims(actualPathConfig, httpFacade, authorization);
+                        return true;
                     }
                 }
             } else {
-                if (hasResourceScopePermission(methodConfig, permission)) {
+                if (hasResourceScopePermission(requiredScopes, permission, actualPathConfig)) {
                     hasPermission = true;
                     return true;
                 }
@@ -180,96 +166,45 @@ public abstract class AbstractPolicyEnforcer {
             return true;
         }
 
-        if (LOGGER.isDebugEnabled()) {
-            LOGGER.debugf("Authorization FAILED for path [%s]. Not enough permissions [%s].", actualPathConfig, grantedPermissions);
-        }
+        LOGGER.debugf("Authorization FAILED for path [%s]. No enough permissions [%s].", actualPathConfig, permissions);
 
         return false;
     }
 
-    private boolean hasValidClaims(PathConfig actualPathConfig, OIDCHttpFacade httpFacade, Authorization authorization) {
-        Map<String, Map<String, Object>> claimInformationPointConfig = actualPathConfig.getClaimInformationPointConfig();
-
-        if (claimInformationPointConfig != null) {
-            Map<String, List<String>> claims = new HashMap<>();
-
-            for (Entry<String, Map<String, Object>> entry : claimInformationPointConfig.entrySet()) {
-                ClaimInformationPointProviderFactory factory = policyEnforcer.getClaimInformationPointProviderFactories().get(entry.getKey());
-
-                if (factory == null) {
-                    throw new RuntimeException("Could not find claim information provider with name [" + entry.getKey() + "]");
-                }
-
-                claims.putAll(factory.create(entry.getValue()).resolve(httpFacade));
-            }
-
-            Map<String, List<String>> grantedClaims = authorization.getClaims();
-
-            if (grantedClaims != null) {
-                if (claims.isEmpty()) {
-                    return false;
-                }
-                for (Entry<String, List<String>> entry : grantedClaims.entrySet()) {
-                    List<String> requestClaims = claims.get(entry.getKey());
-
-                    if (requestClaims == null || requestClaims.isEmpty() || !entry.getValue().containsAll(requestClaims)) {
-                        return false;
-                    }
-                }
-            }
-        }
-
-        return true;
-    }
-
     protected void handleAccessDenied(OIDCHttpFacade httpFacade) {
         httpFacade.getResponse().sendError(403);
     }
 
+    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
+        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
+
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private boolean hasResourceScopePermission(Set<String> requiredScopes, Permission permission, PathConfig actualPathConfig) {
+        Set<String> allowedScopes = permission.getScopes();
+        return (allowedScopes.containsAll(requiredScopes) || allowedScopes.isEmpty());
+    }
+
     protected AuthzClient getAuthzClient() {
-        return policyEnforcer.getClient();
+        return this.authzClient;
     }
 
     protected PolicyEnforcerConfig getEnforcerConfig() {
-        return policyEnforcer.getEnforcerConfig();
+        return enforcerConfig;
     }
 
     protected PolicyEnforcer getPolicyEnforcer() {
         return policyEnforcer;
     }
 
-    private boolean isDefaultAccessDeniedUri(Request request) {
-        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
-        return accessDeniedPath != null && request.getURI().contains(accessDeniedPath);
-    }
-
-    private boolean hasResourceScopePermission(MethodConfig methodConfig, Permission permission) {
-        List<String> requiredScopes = methodConfig.getScopes();
-        Set<String> allowedScopes = permission.getScopes();
-
-        if (allowedScopes.isEmpty()) {
-            return true;
-        }
-
-        PolicyEnforcerConfig.ScopeEnforcementMode enforcementMode = methodConfig.getScopesEnforcementMode();
-
-        if (PolicyEnforcerConfig.ScopeEnforcementMode.ALL.equals(enforcementMode)) {
-            return allowedScopes.containsAll(requiredScopes);
-        }
-
-        if (PolicyEnforcerConfig.ScopeEnforcementMode.ANY.equals(enforcementMode)) {
-            for (String requiredScope : requiredScopes) {
-                if (allowedScopes.contains(requiredScope)) {
-                    return true;
-                }
-            }
-        }
-
-        return requiredScopes.isEmpty();
-    }
-
     private AuthorizationContext createEmptyAuthorizationContext(final boolean granted) {
-        return new ClientAuthorizationContext(getAuthzClient()) {
+        return new ClientAuthorizationContext(authzClient) {
             @Override
             public boolean hasPermission(String resourceName, String scopeName) {
                 return granted;
@@ -301,26 +236,24 @@ public abstract class AbstractPolicyEnforcer {
         return request.getRelativePath();
     }
 
-    private MethodConfig getRequiredScopes(PathConfig pathConfig, Request request) {
+    private Set<String> getRequiredScopes(PathConfig pathConfig, Request request) {
+        Set<String> requiredScopes = new HashSet<>();
+
+        requiredScopes.addAll(pathConfig.getScopes());
+
         String method = request.getMethod();
 
-        for (MethodConfig methodConfig : pathConfig.getMethods()) {
+        for (PolicyEnforcerConfig.MethodConfig methodConfig : pathConfig.getMethods()) {
             if (methodConfig.getMethod().equals(method)) {
-                return methodConfig;
+                requiredScopes.addAll(methodConfig.getScopes());
             }
         }
 
-        MethodConfig methodConfig = new MethodConfig();
-
-        methodConfig.setMethod(request.getMethod());
-        methodConfig.setScopes(pathConfig.getScopes());
-        methodConfig.setScopesEnforcementMode(PolicyEnforcerConfig.ScopeEnforcementMode.ANY);
-
-        return methodConfig;
+        return requiredScopes;
     }
 
     private AuthorizationContext createAuthorizationContext(AccessToken accessToken, PathConfig pathConfig) {
-        return new ClientAuthorizationContext(accessToken, pathConfig, getAuthzClient());
+        return new ClientAuthorizationContext(accessToken, pathConfig, this.paths, authzClient);
     }
 
     private boolean isResourcePermission(PathConfig actualPathConfig, Permission permission) {
@@ -336,10 +269,6 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private boolean matchResourcePermission(PathConfig actualPathConfig, Permission permission) {
-        return permission.getResourceId().equals(actualPathConfig.getId());
-    }
-
-    private PathConfig getPathConfig(Request request) {
-        return isDefaultAccessDeniedUri(request) ? null : policyEnforcer.getPathMatcher().matches(getPath(request));
+        return permission.getResourceSetId().equals(actualPathConfig.getId());
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/BearerTokenPolicyEnforcer.java

@@ -0,0 +1,85 @@
+/*
+ *  Copyright 2016 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package org.keycloak.adapters.authorization;
+
+import java.util.Set;
+
+import org.jboss.logging.Logger;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.representation.PermissionRequest;
+import org.keycloak.authorization.client.resource.PermissionResource;
+import org.keycloak.authorization.client.resource.ProtectionResource;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
+
+    private static Logger LOGGER = Logger.getLogger(BearerTokenPolicyEnforcer.class);
+
+    public BearerTokenPolicyEnforcer(PolicyEnforcer enforcer) {
+        super(enforcer);
+    }
+
+    @Override
+    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        if (getEnforcerConfig().getUserManagedAccess() != null) {
+            challengeUmaAuthentication(pathConfig, requiredScopes, facade);
+        } else {
+            challengeEntitlementAuthentication(facade);
+        }
+        return true;
+    }
+
+    private void challengeEntitlementAuthentication(OIDCHttpFacade facade) {
+        HttpFacade.Response response = facade.getResponse();
+        AuthzClient authzClient = getAuthzClient();
+        String clientId = authzClient.getConfiguration().getResource();
+        String  authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/entitlement";
+        response.setStatus(401);
+        response.setHeader("WWW-Authenticate", "KC_ETT realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\"");
+        if (LOGGER.isDebugEnabled()) {
+            LOGGER.debug("Sending Entitlement challenge");
+        }
+    }
+
+    private void challengeUmaAuthentication(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        HttpFacade.Response response = facade.getResponse();
+        AuthzClient authzClient = getAuthzClient();
+        String ticket = getPermissionTicket(pathConfig, requiredScopes, authzClient);
+        String clientId = authzClient.getConfiguration().getResource();
+        String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString() + "/authz/authorize";
+        response.setStatus(401);
+        response.setHeader("WWW-Authenticate", "UMA realm=\"" + clientId + "\",as_uri=\"" + authorizationServerUri + "\",ticket=\"" + ticket + "\"");
+        if (LOGGER.isDebugEnabled()) {
+            LOGGER.debug("Sending UMA challenge");
+        }
+    }
+
+    private String getPermissionTicket(PathConfig pathConfig, Set<String> requiredScopes, AuthzClient authzClient) {
+        ProtectionResource protection = authzClient.protection();
+        PermissionResource permission = protection.permission();
+        PermissionRequest permissionRequest = new PermissionRequest();
+        permissionRequest.setResourceSetId(pathConfig.getId());
+        permissionRequest.setScopes(requiredScopes);
+        return permission.forResource(permissionRequest).getTicket();
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/ClaimInformationPointProvider.java

@@ -1,30 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization;
-
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface ClaimInformationPointProvider {
-
-    Map<String, List<String>> resolve(HttpFacade httpFacade);
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -18,31 +18,25 @@
 package org.keycloak.adapters.authorization;
 
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
+import java.util.Set;
 
 import org.jboss.logging.Logger;
-import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
 import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthorizationDeniedException;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.resource.PermissionResource;
-import org.keycloak.authorization.client.resource.ProtectionResource;
-import org.keycloak.common.util.Base64;
+import org.keycloak.authorization.client.representation.AuthorizationRequest;
+import org.keycloak.authorization.client.representation.AuthorizationResponse;
+import org.keycloak.authorization.client.representation.EntitlementRequest;
+import org.keycloak.authorization.client.representation.EntitlementResponse;
+import org.keycloak.authorization.client.representation.PermissionRequest;
+import org.keycloak.authorization.client.representation.PermissionResponse;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-import org.keycloak.representations.idm.authorization.AuthorizationRequest;
-import org.keycloak.representations.idm.authorization.AuthorizationResponse;
 import org.keycloak.representations.idm.authorization.Permission;
-import org.keycloak.representations.idm.authorization.PermissionRequest;
-import org.keycloak.util.JsonSerialization;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -56,14 +50,14 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean isAuthorized(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
+    protected boolean isAuthorized(PathConfig pathConfig, Set<String> requiredScopes, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         AccessToken original = accessToken;
 
-        if (super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
+        if (super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade)) {
             return true;
         }
 
-        accessToken = requestAuthorizationToken(pathConfig, methodConfig, httpFacade);
+        accessToken = requestAuthorizationToken(pathConfig, requiredScopes, httpFacade);
 
         if (accessToken == null) {
             return false;
@@ -79,69 +73,22 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
 
         if (newAuthorization != null) {
-            List<Permission> grantedPermissions = authorization.getPermissions();
-            List<Permission> newPermissions = newAuthorization.getPermissions();
-
-            for (Permission newPermission : newPermissions) {
-                if (!grantedPermissions.contains(newPermission)) {
-                    grantedPermissions.add(newPermission);
-                }
-            }
-
-            Map<String, List<String>> newClaims = newAuthorization.getClaims();
-
-            if (newClaims != null) {
-                Map<String, List<String>> claims = authorization.getClaims();
-
-                if (claims == null) {
-                    claims = new HashMap<>();
-                    authorization.setClaims(claims);
-                }
-
-                claims.putAll(newClaims);
-            }
+            authorization.getPermissions().addAll(newAuthorization.getPermissions());
         }
 
         original.setAuthorization(authorization);
 
-        return super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade);
+        return super.isAuthorized(pathConfig, requiredScopes, accessToken, httpFacade);
     }
 
     @Override
-    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
-        if (isBearerAuthorization(httpFacade)) {
-            HttpFacade.Response response = httpFacade.getResponse();
-            AuthzClient authzClient = getAuthzClient();
-            String ticket = getPermissionTicket(pathConfig, methodConfig, authzClient, httpFacade);
-
-            if (ticket != null) {
-                response.setStatus(401);
-                response.setHeader("WWW-Authenticate", new StringBuilder("UMA realm=\"").append(authzClient.getConfiguration().getRealm()).append("\"").append(",as_uri=\"")
-                        .append(authzClient.getServerConfiguration().getIssuer()).append("\"").append(",ticket=\"").append(ticket).append("\"").toString());
-            } else {
-                response.setStatus(403);
-            }
-
-            if (LOGGER.isDebugEnabled()) {
-                LOGGER.debug("Sending challenge");
-            }
-
-            return true;
-        }
-
-        handleAccessDenied(httpFacade);
-
+    protected boolean challenge(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade facade) {
+        handleAccessDenied(facade);
         return true;
     }
 
     @Override
     protected void handleAccessDenied(OIDCHttpFacade facade) {
-        KeycloakSecurityContext securityContext = facade.getSecurityContext();
-
-        if (securityContext == null) {
-            return;
-        }
-
         String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
         HttpFacade.Response response = facade.getResponse();
 
@@ -153,103 +100,52 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         }
     }
 
-    private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
-        if (getPolicyEnforcer().getDeployment().isBearerOnly() || (isBearerAuthorization(httpFacade) && getEnforcerConfig().getUserManagedAccess() != null)) {
-            return null;
-        }
-
+    private AccessToken requestAuthorizationToken(PathConfig pathConfig, Set<String> requiredScopes, OIDCHttpFacade httpFacade) {
         try {
-            KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
-            String accessTokenString = securityContext.getTokenString();
+            String accessToken = httpFacade.getSecurityContext().getTokenString();
+            AuthzClient authzClient = getAuthzClient();
             KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
-            AccessToken accessToken = securityContext.getToken();
-            AuthorizationRequest authzRequest = new AuthorizationRequest();
 
             if (getEnforcerConfig().getUserManagedAccess() != null) {
-                String ticket = getPermissionTicket(pathConfig, methodConfig, getAuthzClient(), httpFacade);
-                authzRequest.setTicket(ticket);
+                LOGGER.debug("Obtaining authorization for authenticated user.");
+                PermissionRequest permissionRequest = new PermissionRequest();
+
+                permissionRequest.setResourceSetId(pathConfig.getId());
+                permissionRequest.setScopes(requiredScopes);
+
+                PermissionResponse permissionResponse = authzClient.protection().permission().forResource(permissionRequest);
+                AuthorizationRequest authzRequest = new AuthorizationRequest(permissionResponse.getTicket());
+                AuthorizationResponse authzResponse = authzClient.authorization(accessToken).authorize(authzRequest);
+
+                if (authzResponse != null) {
+                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
+                }
+
+                return null;
             } else {
-                if (accessToken.getAuthorization() != null) {
-                    authzRequest.addPermission(pathConfig.getId(), methodConfig.getScopes());
-                }
+                LOGGER.debug("Obtaining entitlements for authenticated user.");
+                AccessToken token = httpFacade.getSecurityContext().getToken();
 
-                Map<String, List<String>> claims = getClaims(pathConfig, httpFacade);
-
-                if (!claims.isEmpty()) {
-                    authzRequest.setClaimTokenFormat("urn:ietf:params:oauth:token-type:jwt");
-                    authzRequest.setClaimToken(Base64.encodeBytes(JsonSerialization.writeValueAsBytes(claims)));
+                if (token.getAuthorization() == null) {
+                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).getAll(authzClient.getConfiguration().getResource());
+                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
+                } else {
+                    EntitlementRequest request = new EntitlementRequest();
+                    PermissionRequest permissionRequest = new PermissionRequest();
+                    permissionRequest.setResourceSetId(pathConfig.getId());
+                    permissionRequest.setResourceSetName(pathConfig.getName());
+                    permissionRequest.setScopes(new HashSet<>(pathConfig.getScopes()));
+                    LOGGER.debugf("Sending entitlements request: resource_set_id [%s], resource_set_name [%s], scopes [%s].", permissionRequest.getResourceSetId(), permissionRequest.getResourceSetName(), permissionRequest.getScopes());
+                    request.addPermission(permissionRequest);
+                    EntitlementResponse authzResponse = authzClient.entitlement(accessToken).get(authzClient.getConfiguration().getResource(), request);
+                    return AdapterRSATokenVerifier.verifyToken(authzResponse.getRpt(), deployment);
                 }
             }
-
-            if (accessToken.getAuthorization() != null) {
-                authzRequest.setRpt(accessTokenString);
-            }
-
-            LOGGER.debug("Obtaining authorization for authenticated user.");
-            AuthorizationResponse authzResponse = getAuthzClient().authorization(accessTokenString).authorize(authzRequest);
-
-            if (authzResponse != null) {
-                return AdapterRSATokenVerifier.verifyToken(authzResponse.getToken(), deployment);
-            }
-        } catch (AuthorizationDeniedException ignore) {
-            LOGGER.debug("Authorization denied", ignore);
+        } catch (AuthorizationDeniedException e) {
+            LOGGER.debug("Authorization denied", e);
+            return null;
         } catch (Exception e) {
             throw new RuntimeException("Unexpected error during authorization request.", e);
         }
-
-        return null;
-    }
-
-    private String getPermissionTicket(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AuthzClient authzClient, HttpFacade httpFacade) {
-        if (getEnforcerConfig().getUserManagedAccess() != null) {
-            ProtectionResource protection = authzClient.protection();
-            PermissionResource permission = protection.permission();
-            PermissionRequest permissionRequest = new PermissionRequest();
-
-            permissionRequest.setResourceId(pathConfig.getId());
-            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
-
-            Map<String, List<String>> claims = getClaims(pathConfig, httpFacade);
-
-            if (!claims.isEmpty()) {
-                permissionRequest.setClaims(claims);
-            }
-
-            return permission.create(permissionRequest).getTicket();
-        }
-
-        return null;
-    }
-
-    private Map<String, List<String>> getClaims(PathConfig pathConfig, HttpFacade httpFacade) {
-        Map<String, List<String>> claims = new HashMap<>();
-        Map<String, Map<String, Object>> claimInformationPointConfig = pathConfig.getClaimInformationPointConfig();
-
-        if (claimInformationPointConfig != null) {
-            for (Entry<String, Map<String, Object>> claimDef : claimInformationPointConfig.entrySet()) {
-                ClaimInformationPointProviderFactory factory = getPolicyEnforcer().getClaimInformationPointProviderFactories().get(claimDef.getKey());
-
-                if (factory != null) {
-                    claims.putAll(factory.create(claimDef.getValue()).resolve(httpFacade));
-                }
-            }
-        }
-        return claims;
-    }
-
-    private boolean isBearerAuthorization(OIDCHttpFacade httpFacade) {
-        List<String> authHeaders = httpFacade.getRequest().getHeaders("Authorization");
-        if (authHeaders == null || authHeaders.size() == 0) {
-            return false;
-        }
-
-        for (String authHeader : authHeaders) {
-            String[] split = authHeader.trim().split("\\s+");
-            if (split == null || split.length != 2) continue;
-            if (!split[0].equalsIgnoreCase("Bearer")) continue;
-            return true;
-        }
-
-        return false;
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathCache.java

@@ -24,8 +24,6 @@ import java.util.concurrent.locks.LockSupport;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
 /**
- * A simple LRU cache implementation supporting expiration and maximum number of entries.
- *
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
 public class PathCache {
@@ -40,7 +38,15 @@ public class PathCache {
     private final AtomicBoolean writing = new AtomicBoolean(false);
 
     private final long maxAge;
-    private final boolean enabled;
+
+    /**
+     * Creates a new instance.
+     *
+     * @param maxEntries the maximum number of entries to keep in the cache
+     */
+    public PathCache(int maxEntries) {
+        this(maxEntries, -1);
+    }
 
     /**
      * Creates a new instance.
@@ -56,14 +62,9 @@ public class PathCache {
             }
         };
         this.maxAge = maxAge;
-        this.enabled = maxAge > 0;
     }
 
     public void put(String uri, PathConfig newValue) {
-        if (!enabled) {
-            return;
-        }
-
         try {
             if (parkForWriteAndCheckInterrupt()) {
                 return;
@@ -79,10 +80,6 @@ public class PathCache {
         }
     }
 
-    public boolean containsKey(String uri) {
-        return cache.containsKey(uri);
-    }
-
     public PathConfig get(String uri) {
         if (parkForReadAndCheckInterrupt()) {
             return null;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathMatcher.java

@@ -1,44 +1,57 @@
 /*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
+ *  Copyright 2016 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
  *
- * http://www.apache.org/licenses/LICENSE-2.0
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
  */
-package org.keycloak.common.util;
+package org.keycloak.adapters.authorization;
 
 import java.util.Arrays;
-import java.util.Collection;
+import java.util.Map;
+import java.util.Set;
+
+import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.resource.ProtectedResource;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public abstract class PathMatcher<P> {
+class PathMatcher {
 
     private static final char WILDCARD = '*';
+    private final AuthzClient authzClient;
+    // TODO: make this configurable
+    private PathCache cache = new PathCache(100, 30000);
 
-    public P matches(final String targetUri) {
-        int patternCount = 0;
-        P matchingPath = null;
-        P matchingAnyPath = null;
-        P matchingAnySuffixPath = null;
+    public PathMatcher(AuthzClient authzClient) {
+        this.authzClient = authzClient;
+    }
 
-        for (P entry : getPaths()) {
-            String expectedUri = getPath(entry);
+    public PathConfig matches(final String targetUri, Map<String, PathConfig> paths) {
+        PathConfig pathConfig = paths.get(targetUri) == null ? cache.get(targetUri) : paths.get(targetUri);
 
-            if (expectedUri == null) {
-                continue;
-            }
+        if (pathConfig != null) {
+            return pathConfig;
+        }
 
+        PathConfig matchingAnyPath = null;
+        PathConfig matchingAnySuffixPath = null;
+
+        for (PathConfig entry : paths.values()) {
+            String expectedUri = entry.getPath();
             String matchingUri = null;
 
             if (exactMatch(expectedUri, targetUri, expectedUri)) {
@@ -49,17 +62,9 @@ public abstract class PathMatcher<P> {
                 String templateUri = buildUriFromTemplate(expectedUri, targetUri);
 
                 if (templateUri != null) {
-                    int length = expectedUri.split("\\/").length;
-
-                    if (exactMatch(expectedUri, targetUri, templateUri) && (patternCount == 0 || length > patternCount)) {
+                    if (exactMatch(expectedUri, targetUri, templateUri)) {
                         matchingUri = templateUri;
-                        P resolved = resolvePathConfig(entry, targetUri);
-
-                        if (resolved != null) {
-                            entry = resolved;
-                        }
-
-                        patternCount = length;
+                        entry = resolvePathConfig(entry, targetUri);
                     }
                 }
             }
@@ -85,17 +90,12 @@ public abstract class PathMatcher<P> {
                 }
 
                 if (matchingUri.equals(targetUri) || pathString.equals(targetUri)) {
-                    if (patternCount == 0) {
-                        return entry;
-                    } else {
-                        matchingPath = entry;
-                    }
+                    cache.put(targetUri, entry);
+                    return entry;
                 }
 
                 if (WILDCARD == expectedUri.charAt(expectedUri.length() - 1)) {
-                    if (matchingAnyPath == null || getPath(matchingAnyPath).length() < matchingUri.length()) {
-                        matchingAnyPath = entry;
-                    }
+                    matchingAnyPath = entry;
                 } else {
                     int suffixIndex = expectedUri.indexOf(WILDCARD + ".");
 
@@ -110,21 +110,18 @@ public abstract class PathMatcher<P> {
             }
         }
 
-        if (matchingPath != null) {
-            return matchingPath;
+        if (matchingAnySuffixPath != null) {
+            cache.put(targetUri, matchingAnySuffixPath);
+            return matchingAnySuffixPath;
         }
 
-        if (matchingAnySuffixPath != null) {
-            return matchingAnySuffixPath;
+        if (matchingAnyPath != null) {
+            cache.put(targetUri, matchingAnyPath);
         }
 
         return matchingAnyPath;
     }
 
-    protected abstract String getPath(P entry);
-
-    protected abstract Collection<P> getPaths();
-
     private boolean exactMatch(String expectedUri, String targetUri, String value) {
         if (targetUri.equals(value)) {
             return value.equals(targetUri);
@@ -214,16 +211,32 @@ public abstract class PathMatcher<P> {
     }
 
     public boolean endsWithWildcard(String expectedUri) {
-        int length = expectedUri.length();
-        return length > 0 && WILDCARD == expectedUri.charAt(length - 1);
+        return WILDCARD == expectedUri.charAt(expectedUri.length() - 1);
     }
 
     private boolean isTemplate(String uri) {
         return uri.indexOf("{") != -1;
     }
 
-    protected P resolvePathConfig(P entry, String path) {
-        return entry;
+    private PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
+        if (originalConfig.hasPattern()) {
+            ProtectedResource resource = this.authzClient.protection().resource();
+            Set<String> search = resource.findByFilter("uri=" + path);
+
+            if (!search.isEmpty()) {
+                // resource does exist on the server, cache it
+                ResourceRepresentation targetResource = resource.findById(search.iterator().next()).getResourceDescription();
+                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
+
+                config.setScopes(originalConfig.getScopes());
+                config.setMethods(originalConfig.getMethods());
+                config.setParentConfig(originalConfig);
+                config.setEnforcementMode(originalConfig.getEnforcementMode());
+
+                return config;
+            }
+        }
+
+        return originalConfig;
     }
 }
-

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PolicyEnforcer.java

@@ -17,17 +17,6 @@
  */
 package org.keycloak.adapters.authorization;
 
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.ServiceLoader;
-
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.adapters.KeycloakDeployment;
@@ -36,14 +25,22 @@ import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.authorization.client.AuthzClient;
 import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.authorization.client.Configuration;
+import org.keycloak.authorization.client.representation.RegistrationResponse;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.representation.ScopeRepresentation;
 import org.keycloak.authorization.client.resource.ProtectedResource;
-import org.keycloak.common.util.PathMatcher;
 import org.keycloak.representations.adapters.config.AdapterConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathCacheConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
-import org.keycloak.representations.idm.authorization.ResourceRepresentation;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -55,27 +52,20 @@ public class PolicyEnforcer {
     private final KeycloakDeployment deployment;
     private final AuthzClient authzClient;
     private final PolicyEnforcerConfig enforcerConfig;
-    private final PathConfigMatcher pathMatcher;
     private final Map<String, PathConfig> paths;
-    private final Map<String, ClaimInformationPointProviderFactory> claimInformationPointProviderFactories = new HashMap<>();
+    private final PathMatcher pathMatcher;
 
     public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
         this.deployment = deployment;
         this.enforcerConfig = adapterConfig.getPolicyEnforcerConfig();
-        Configuration configuration = new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient());
-        this.authzClient = AuthzClient.create(configuration, new ClientAuthenticator() {
+        this.authzClient = AuthzClient.create(new Configuration(adapterConfig.getAuthServerUrl(), adapterConfig.getRealm(), adapterConfig.getResource(), adapterConfig.getCredentials(), deployment.getClient()), new ClientAuthenticator() {
             @Override
-            public void configureClientCredentials(Map<String, List<String>> requestParams, Map<String, String> requestHeaders) {
-                Map<String, String> formparams = new HashMap<>();
-                ClientCredentialsProviderUtils.setClientCredentials(PolicyEnforcer.this.deployment, requestHeaders, formparams);
-                for (Entry<String, String> param : formparams.entrySet()) {
-                    requestParams.put(param.getKey(), Arrays.asList(param.getValue()));
-                }
+            public void configureClientCredentials(HashMap<String, String> requestParams, HashMap<String, String> requestHeaders) {
+                ClientCredentialsProviderUtils.setClientCredentials(PolicyEnforcer.this.deployment, requestHeaders, requestParams);
             }
         });
-
-        paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
-        pathMatcher = new PathConfigMatcher(paths, enforcerConfig, authzClient);
+        this.pathMatcher = new PathMatcher(this.authzClient);
+        this.paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Initialization complete. Path configurations:");
@@ -83,17 +73,20 @@ public class PolicyEnforcer {
                 LOGGER.debug(pathConfig);
             }
         }
-
-        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, ClaimInformationPointProviderFactory.class.getClassLoader()));
-        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, Thread.currentThread().getContextClassLoader()));
     }
 
     public AuthorizationContext enforce(OIDCHttpFacade facade) {
         if (LOGGER.isDebugEnabled()) {
-            LOGGER.debugv("Policy enforcement is enabled. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
+            LOGGER.debugv("Policy enforcement is enable. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
         }
 
-        AuthorizationContext context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
+        AuthorizationContext context;
+
+        if (deployment.isBearerOnly()) {
+            context = new BearerTokenPolicyEnforcer(this).authorize(facade);
+        } else {
+            context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
+        }
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debugv("Policy enforcement result for path [{0}] is : {1}", facade.getRequest().getURI(), context.isGranted() ? "GRANTED" : "DENIED");
@@ -106,11 +99,11 @@ public class PolicyEnforcer {
         return context;
     }
 
-    public PolicyEnforcerConfig getEnforcerConfig() {
+    PolicyEnforcerConfig getEnforcerConfig() {
         return enforcerConfig;
     }
 
-    public AuthzClient getClient() {
+    AuthzClient getClient() {
         return authzClient;
     }
 
@@ -118,30 +111,14 @@ public class PolicyEnforcer {
         return paths;
     }
 
-    public PathConfigMatcher getPathMatcher() {
-        return pathMatcher;
+    void addPath(PathConfig pathConfig) {
+        paths.put(pathConfig.getPath(), pathConfig);
     }
 
-    public KeycloakDeployment getDeployment() {
+    KeycloakDeployment getDeployment() {
         return deployment;
     }
 
-    public Map<String, ClaimInformationPointProviderFactory> getClaimInformationPointProviderFactories() {
-        return claimInformationPointProviderFactories;
-    }
-
-    private void loadClaimInformationPointProviders(ServiceLoader<ClaimInformationPointProviderFactory> loader) {
-        Iterator<ClaimInformationPointProviderFactory> iterator = loader.iterator();
-
-        while (iterator.hasNext()) {
-            ClaimInformationPointProviderFactory factory = iterator.next();
-
-            factory.init(this);
-
-            claimInformationPointProviderFactories.put(factory.getName(), factory);
-        }
-    }
-
     private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
         boolean loadPathsFromServer = true;
 
@@ -154,11 +131,7 @@ public class PolicyEnforcer {
 
         if (loadPathsFromServer) {
             LOGGER.info("No path provided in configuration.");
-            Map<String, PathConfig> paths = configureAllPathsForResourceServer(protectedResource);
-
-            paths.putAll(configureDefinedPaths(protectedResource, enforcerConfig));
-
-            return paths;
+            return configureAllPathsForResourceServer(protectedResource);
         } else {
             LOGGER.info("Paths provided in configuration.");
             return configureDefinedPaths(protectedResource, enforcerConfig);
@@ -166,41 +139,56 @@ public class PolicyEnforcer {
     }
 
     private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new LinkedHashMap<String, PathConfig>());
+        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
 
         for (PathConfig pathConfig : enforcerConfig.getPaths()) {
-            ResourceRepresentation resource;
+            Set<String> search;
             String resourceName = pathConfig.getName();
             String path = pathConfig.getPath();
 
             if (resourceName != null) {
                 LOGGER.debugf("Trying to find resource with name [%s] for path [%s].", resourceName, path);
-                resource = protectedResource.findByName(resourceName);
+                search = protectedResource.findByFilter("name=" + resourceName);
             } else {
                 LOGGER.debugf("Trying to find resource with uri [%s] for path [%s].", path, path);
-                List<ResourceRepresentation> resources = protectedResource.findByUri(path);
-
-                if (resources.isEmpty()) {
-                    resources = protectedResource.findByMatchingUri(path);
-                }
-
-                if (resources.size() == 1) {
-                    resource = resources.get(0);
-                } else if (resources.size() > 1) {
-                    throw new RuntimeException("Multiple resources found with the same uri");
-                } else {
-                    resource = null;
-                }
+                search = protectedResource.findByFilter("uri=" + path);
             }
 
-            if (resource != null) {
-                pathConfig.setId(resource.getId());
+            if (search.isEmpty()) {
+                if (enforcerConfig.isCreateResources()) {
+                    LOGGER.debugf("Creating resource on server for path [%s].", pathConfig);
+                    ResourceRepresentation resource = new ResourceRepresentation();
+
+                    resource.setName(resourceName);
+                    resource.setType(pathConfig.getType());
+                    resource.setUri(path);
+
+                    HashSet<ScopeRepresentation> scopes = new HashSet<>();
+
+                    for (String scopeName : pathConfig.getScopes()) {
+                        ScopeRepresentation scope = new ScopeRepresentation();
+
+                        scope.setName(scopeName);
+
+                        scopes.add(scope);
+                    }
+
+                    resource.setScopes(scopes);
+
+                    RegistrationResponse registrationResponse = protectedResource.create(resource);
+
+                    pathConfig.setId(registrationResponse.getId());
+                } else {
+                    throw new RuntimeException("Could not find matching resource on server with uri [" + path + "] or name [" + resourceName + "]. Make sure you have created a resource on the server that matches with the path configuration.");
+                }
+            } else {
+                pathConfig.setId(search.iterator().next());
             }
 
             PathConfig existingPath = null;
 
             for (PathConfig current : paths.values()) {
-                if (current.getPath().equals(pathConfig.getPath())) {
+                if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                     existingPath = current;
                     break;
                 }
@@ -221,104 +209,46 @@ public class PolicyEnforcer {
         LOGGER.info("Querying the server for all resources associated with this application.");
         Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
 
-        if (!enforcerConfig.getLazyLoadPaths()) {
-            for (String id : protectedResource.findAll()) {
-                ResourceRepresentation resourceDescription = protectedResource.findById(id);
+        for (String id : protectedResource.findAll()) {
+            RegistrationResponse response = protectedResource.findById(id);
+            ResourceRepresentation resourceDescription = response.getResourceDescription();
 
-                if (resourceDescription.getUri() != null) {
-                    PathConfig pathConfig = PathConfig.createPathConfig(resourceDescription);
-                    paths.put(pathConfig.getPath(), pathConfig);
-                }
+            if (resourceDescription.getUri() != null) {
+                PathConfig pathConfig = createPathConfig(resourceDescription);
+                paths.put(pathConfig.getPath(), pathConfig);
             }
         }
 
         return paths;
     }
 
-    public class PathConfigMatcher extends PathMatcher<PathConfig> {
+    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+        PathConfig pathConfig = new PathConfig();
 
-        private final Map<String, PathConfig> paths;
-        private final PathCache pathCache;
-        private final AuthzClient authzClient;
-        private final PolicyEnforcerConfig enforcerConfig;
+        pathConfig.setId(resourceDescription.getId());
+        pathConfig.setName(resourceDescription.getName());
 
-        public PathConfigMatcher(Map<String, PathConfig> paths, PolicyEnforcerConfig enforcerConfig, AuthzClient authzClient) {
-            this.paths = paths;
-            this.enforcerConfig = enforcerConfig;
-            PathCacheConfig cacheConfig = enforcerConfig.getPathCacheConfig();
+        String uri = resourceDescription.getUri();
 
-            if (cacheConfig == null) {
-                cacheConfig = new PathCacheConfig();
-            }
-
-            pathCache = new PathCache(cacheConfig.getMaxEntries(), cacheConfig.getLifespan());
-            this.authzClient = authzClient;
+        if (uri == null || "".equals(uri.trim())) {
+            throw new RuntimeException("Failed to configure paths. Resource [" + resourceDescription.getName() + "] has an invalid or empty URI [" + uri + "].");
         }
 
-        @Override
-        public PathConfig matches(String targetUri) {
-            PathConfig pathConfig = pathCache.get(targetUri);
+        pathConfig.setPath(uri);
 
-            if (pathCache.containsKey(targetUri) || pathConfig != null) {
-                return pathConfig;
-            }
+        List<String> scopeNames = new ArrayList<>();
 
-            pathConfig = super.matches(targetUri);
-
-            if (enforcerConfig.getLazyLoadPaths() || enforcerConfig.getPathCacheConfig() != null) {
-                if ((pathConfig == null || (pathConfig.getPath().contains("*")))) {
-                    try {
-                        List<ResourceRepresentation> matchingResources = authzClient.protection().resource().findByMatchingUri(targetUri);
-
-                        if (!matchingResources.isEmpty()) {
-                            pathConfig = PathConfig.createPathConfig(matchingResources.get(0));
-                        }
-                    } catch (Exception cause) {
-                        LOGGER.errorf(cause, "Could not lazy load resource with path [" + targetUri + "] from server");
-                        return null;
-                    }
-                }
-            }
-
-            pathCache.put(targetUri, pathConfig);
-
-            return pathConfig;
+        for (ScopeRepresentation scope : resourceDescription.getScopes()) {
+            scopeNames.add(scope.getName());
         }
 
-        @Override
-        protected String getPath(PathConfig entry) {
-            return entry.getPath();
-        }
+        pathConfig.setScopes(scopeNames);
+        pathConfig.setType(resourceDescription.getType());
 
-        @Override
-        protected Collection<PathConfig> getPaths() {
-            return paths.values();
-        }
+        return pathConfig;
+    }
 
-        @Override
-        protected PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
-            if (originalConfig.hasPattern()) {
-                ProtectedResource resource = authzClient.protection().resource();
-                List<ResourceRepresentation> search = resource.findByUri(path);
-
-                if (!search.isEmpty()) {
-                    ResourceRepresentation targetResource = search.get(0);
-                    PathConfig config = PathConfig.createPathConfig(targetResource);
-
-                    config.setScopes(originalConfig.getScopes());
-                    config.setMethods(originalConfig.getMethods());
-                    config.setParentConfig(originalConfig);
-                    config.setEnforcementMode(originalConfig.getEnforcementMode());
-
-                    return config;
-                }
-            }
-
-            return null;
-        }
-
-        public void removeFromCache(String pathConfig) {
-            pathCache.remove(pathConfig);
-        }
-    };
+    public PathMatcher getPathMatcher() {
+        return pathMatcher;
+    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProvider.java

@@ -1,76 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
-import org.keycloak.adapters.authorization.util.PlaceHolders;
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ClaimsInformationPointProvider implements ClaimInformationPointProvider {
-
-    private final Map<String, Object> config;
-
-    public ClaimsInformationPointProvider(Map<String, Object> config) {
-        this.config = config;
-    }
-
-    @Override
-    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
-        Map<String, List<String>> claims = new HashMap<>();
-
-        for (Entry<String, Object> configEntry : config.entrySet()) {
-            String claimName = configEntry.getKey();
-            Object claimValue = configEntry.getValue();
-            List<String> values = new ArrayList<>();
-
-            if (claimValue instanceof String) {
-                values = getValues(claimValue.toString(), httpFacade);
-            } else if (claimValue instanceof Collection) {
-                Iterator iterator = Collection.class.cast(claimValue).iterator();
-
-                while (iterator.hasNext()) {
-                    List<String> resolvedValues = getValues(iterator.next().toString(), httpFacade);
-
-                    if (!resolvedValues.isEmpty()) {
-                        values.addAll(resolvedValues);
-                    }
-                }
-            }
-
-            if (!values.isEmpty()) {
-                claims.put(claimName, values);
-            }
-        }
-
-        return claims;
-    }
-
-    private List<String> getValues(String value, HttpFacade httpFacade) {
-        return PlaceHolders.resolve(value, httpFacade);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProviderFactory.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.Map;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ClaimsInformationPointProviderFactory implements ClaimInformationPointProviderFactory<ClaimsInformationPointProvider> {
-
-    @Override
-    public String getName() {
-        return "claims";
-    }
-
-    @Override
-    public void init(PolicyEnforcer policyEnforcer) {
-
-    }
-
-    @Override
-    public ClaimsInformationPointProvider create(Map<String, Object> config) {
-        return new ClaimsInformationPointProvider(config);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProvider.java

@@ -1,210 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.io.BufferedInputStream;
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.Charset;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpResponse;
-import org.apache.http.StatusLine;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.methods.RequestBuilder;
-import org.apache.http.util.EntityUtils;
-import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-import org.keycloak.adapters.authorization.util.JsonUtils;
-import org.keycloak.adapters.authorization.util.PlaceHolders;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.authorization.client.util.HttpResponseException;
-import org.keycloak.common.util.StreamUtil;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class HttpClaimInformationPointProvider implements ClaimInformationPointProvider {
-
-    private final Map<String, Object> config;
-    private final HttpClient httpClient;
-
-    public HttpClaimInformationPointProvider(Map<String, Object> config, PolicyEnforcer policyEnforcer) {
-        this.config = config;
-        this.httpClient = policyEnforcer.getDeployment().getClient();
-    }
-
-    @Override
-    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
-        try {
-            InputStream responseStream = executeRequest(httpFacade);
-
-            try (InputStream inputStream = new BufferedInputStream(responseStream)) {
-                JsonNode jsonNode = JsonSerialization.mapper.readTree(inputStream);
-                Map<String, List<String>> claims = new HashMap<>();
-                Map<String, Object> claimsDef = (Map<String, Object>) config.get("claims");
-
-                if (claimsDef == null) {
-                    Iterator<String> nodeNames = jsonNode.fieldNames();
-
-                    while (nodeNames.hasNext()) {
-                        String nodeName = nodeNames.next();
-                        claims.put(nodeName, JsonUtils.getValues(jsonNode.get(nodeName)));
-                    }
-                } else {
-                    for (Entry<String, Object> claimDef : claimsDef.entrySet()) {
-                        List<String> jsonPaths = new ArrayList<>();
-
-                        if (claimDef.getValue() instanceof Collection) {
-                            jsonPaths.addAll(Collection.class.cast(claimDef.getValue()));
-                        } else {
-                            jsonPaths.add(claimDef.getValue().toString());
-                        }
-
-                        List<String> claimValues = new ArrayList<>();
-
-                        for (String path : jsonPaths) {
-                            claimValues.addAll(JsonUtils.getValues(jsonNode, path));
-                        }
-
-                        claims.put(claimDef.getKey(), claimValues);
-                    }
-                }
-
-                return claims;
-            }
-        } catch (IOException cause) {
-            throw new RuntimeException("Could not obtain claims from http claim information point [" + config.get("url") + "] response", cause);
-        }
-    }
-
-    private InputStream executeRequest(HttpFacade httpFacade) {
-        String method = config.get("method").toString();
-
-        if (method == null) {
-            method = "GET";
-        }
-
-        RequestBuilder builder = null;
-
-        if ("GET".equalsIgnoreCase(method)) {
-            builder = RequestBuilder.get();
-        } else {
-            builder = RequestBuilder.post();
-        }
-
-        builder.setUri(config.get("url").toString());
-
-        byte[] bytes = new byte[0];
-
-        try {
-            setParameters(builder, httpFacade);
-
-            if (config.containsKey("headers")) {
-                setHeaders(builder, httpFacade);
-            }
-
-            HttpResponse response = httpClient.execute(builder.build());
-            HttpEntity entity = response.getEntity();
-
-            if (entity != null) {
-                bytes = EntityUtils.toByteArray(entity);
-            }
-
-            StatusLine statusLine = response.getStatusLine();
-            int statusCode = statusLine.getStatusCode();
-
-            if (statusCode < 200 || statusCode >= 300) {
-                throw new HttpResponseException("Unexpected response from server: " + statusCode + " / " + statusLine.getReasonPhrase(), statusCode, statusLine.getReasonPhrase(), bytes);
-            }
-
-            return new ByteArrayInputStream(bytes);
-        } catch (Exception cause) {
-            try {
-                throw new RuntimeException("Error executing http method [" + builder + "]. Response : " + StreamUtil.readString(new ByteArrayInputStream(bytes), Charset.forName("UTF-8")), cause);
-            } catch (Exception e) {
-                throw new RuntimeException("Error executing http method [" + builder + "]", cause);
-            }
-        }
-    }
-
-    private void setHeaders(RequestBuilder builder, HttpFacade httpFacade) {
-        Object headersDef = config.get("headers");
-
-        if (headersDef != null) {
-            Map<String, Object> headers = Map.class.cast(headersDef);
-
-            for (Entry<String, Object> header : headers.entrySet()) {
-                Object value = header.getValue();
-                List<String> headerValues = new ArrayList<>();
-
-                if (value instanceof Collection) {
-                    Collection values = Collection.class.cast(value);
-                    Iterator iterator = values.iterator();
-
-                    while (iterator.hasNext()) {
-                        headerValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
-                    }
-                } else {
-                    headerValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
-                }
-
-                for (String headerValue : headerValues) {
-                    builder.addHeader(header.getKey(), headerValue);
-                }
-            }
-        }
-    }
-
-    private void setParameters(RequestBuilder builder, HttpFacade httpFacade) {
-        Object config = this.config.get("parameters");
-
-        if (config != null) {
-            Map<String, Object> paramsDef = Map.class.cast(config);
-
-            for (Entry<String, Object> paramDef : paramsDef.entrySet()) {
-                Object value = paramDef.getValue();
-                List<String> paramValues = new ArrayList<>();
-
-                if (value instanceof Collection) {
-                    Collection values = Collection.class.cast(value);
-                    Iterator iterator = values.iterator();
-
-                    while (iterator.hasNext()) {
-                        paramValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
-                    }
-                } else {
-                    paramValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
-                }
-
-                for (String paramValue : paramValues) {
-                    builder.addParameter(paramDef.getKey(), paramValue);
-                }
-            }
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProviderFactory.java

@@ -1,45 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.Map;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class HttpClaimInformationPointProviderFactory implements ClaimInformationPointProviderFactory<HttpClaimInformationPointProvider> {
-
-    private PolicyEnforcer policyEnforcer;
-
-    @Override
-    public String getName() {
-        return "http";
-    }
-
-    @Override
-    public void init(PolicyEnforcer policyEnforcer) {
-        this.policyEnforcer = policyEnforcer;
-    }
-
-    @Override
-    public HttpClaimInformationPointProvider create(Map<String, Object> config) {
-        return new HttpClaimInformationPointProvider(config, policyEnforcer);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/JsonUtils.java

@@ -1,58 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class JsonUtils {
-
-    public static List<String> getValues(JsonNode jsonNode, String path) {
-        return getValues(jsonNode.at(path));
-    }
-
-    public static List<String> getValues(JsonNode jsonNode) {
-        List<String> values = new ArrayList<>();
-
-        if (jsonNode.isArray()) {
-            Iterator<JsonNode> iterator = jsonNode.iterator();
-
-            while (iterator.hasNext()) {
-                String value = iterator.next().textValue();
-
-                if (value != null) {
-                    values.add(value);
-                }
-            }
-        } else {
-            String value = jsonNode.textValue();
-
-            if (value != null) {
-                values.add(value);
-            }
-        }
-
-        return values;
-    }
-
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/KeycloakSecurityContextPlaceHolderResolver.java

@@ -1,67 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
-
-import java.util.Arrays;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakSecurityContextPlaceHolderResolver implements PlaceHolderResolver {
-
-    public static final String NAME = "keycloak";
-
-    @Override
-    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
-        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
-        OIDCHttpFacade oidcHttpFacade = OIDCHttpFacade.class.cast(httpFacade);
-        KeycloakSecurityContext securityContext = oidcHttpFacade.getSecurityContext();
-
-        if (securityContext == null) {
-            return null;
-        }
-
-        if (source.endsWith("access_token")) {
-            return Arrays.asList(securityContext.getTokenString());
-        }
-
-        if (source.endsWith("id_token")) {
-            return Arrays.asList(securityContext.getIdTokenString());
-        }
-
-        JsonNode jsonNode;
-
-        if (source.startsWith("access_token[")) {
-            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getToken());
-        } else if (source.startsWith("id_token[")) {
-            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getIdToken());
-        } else {
-            throw new RuntimeException("Invalid placeholder [" + placeHolder + "]");
-        }
-
-        return JsonUtils.getValues(jsonNode, getParameter(source, "Invalid placeholder [" + placeHolder + "]"));
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/PlaceHolders.java

@@ -1,107 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class PlaceHolders {
-
-    private static Map<String, PlaceHolderResolver> resolvers = new HashMap<>();
-
-    static {
-        resolvers.put(RequestPlaceHolderResolver.NAME, new RequestPlaceHolderResolver());
-        resolvers.put(KeycloakSecurityContextPlaceHolderResolver.NAME, new KeycloakSecurityContextPlaceHolderResolver());
-    }
-
-    private static Pattern PLACEHOLDER_PATTERN = Pattern.compile("\\{(.+?)\\}");
-    private static Pattern PLACEHOLDER_PARAM_PATTERN = Pattern.compile("\\[(.+?)\\]");
-
-    public static List<String> resolve(String value, HttpFacade httpFacade) {
-        Map<String, List<String>> placeHolders = parsePlaceHolders(value, httpFacade);
-
-        if (!placeHolders.isEmpty()) {
-            value = formatPlaceHolder(value);
-
-            for (Entry<String, List<String>> entry : placeHolders.entrySet()) {
-                List<String> values = entry.getValue();
-
-                if (values.isEmpty() || values.size() > 1) {
-                    return values;
-                }
-
-                value = value.replaceAll(entry.getKey(), values.get(0)).trim();
-            }
-        }
-
-        return Arrays.asList(value);
-    }
-
-    static String getParameter(String source, String messageIfNotFound) {
-        Matcher matcher = PLACEHOLDER_PARAM_PATTERN.matcher(source);
-
-        while (matcher.find()) {
-            return matcher.group(1).replaceAll("'", "");
-        }
-
-        if (messageIfNotFound != null) {
-            throw new RuntimeException(messageIfNotFound);
-        }
-
-        return null;
-    }
-
-    private static Map<String, List<String>> parsePlaceHolders(String value, HttpFacade httpFacade) {
-        Map<String, List<String>> placeHolders = new HashMap<>();
-        Matcher matcher = PLACEHOLDER_PATTERN.matcher(value);
-
-        while (matcher.find()) {
-            String placeHolder = matcher.group(1);
-            int resolverNameIdx = placeHolder.indexOf('.');
-
-            if (resolverNameIdx == -1) {
-                throw new RuntimeException("Invalid placeholder [" + value + "]. Could not find resolver name.");
-            }
-
-            PlaceHolderResolver resolver = resolvers.get(placeHolder.substring(0, resolverNameIdx));
-
-            if (resolver != null) {
-                List<String> resolved = resolver.resolve(placeHolder, httpFacade);
-
-                if (resolved != null) {
-                    placeHolders.put(formatPlaceHolder(placeHolder), resolved);
-                }
-            }
-        }
-
-        return placeHolders;
-    }
-
-    private static String formatPlaceHolder(String placeHolder) {
-        return placeHolder.replaceAll("\\{", "").replace("}", "").replace("[", "").replace("]", "").replace("[", "").replace("]", "");
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/RequestPlaceHolderResolver.java

@@ -1,175 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
-
-import java.io.BufferedInputStream;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.spi.HttpFacade.Cookie;
-import org.keycloak.adapters.spi.HttpFacade.Request;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class RequestPlaceHolderResolver implements PlaceHolderResolver {
-
-    static String NAME = "request";
-
-    @Override
-    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
-        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
-        Request request = httpFacade.getRequest();
-
-        if (source.startsWith("parameter")) {
-            String parameterName = getParameter(source, "Could not obtain parameter name from placeholder [" + source + "]");
-            String parameterValue = request.getQueryParamValue(parameterName);
-
-            if (parameterValue == null) {
-                parameterValue = request.getFirstParam(parameterName);
-            }
-
-            if (parameterValue != null) {
-                return Arrays.asList(parameterValue);
-            }
-        } else if (source.startsWith("header")) {
-            String headerName = getParameter(source, "Could not obtain header name from placeholder [" + source + "]");
-            List<String> headerValue = request.getHeaders(headerName);
-
-            if (headerValue != null) {
-                return headerValue;
-            }
-        } else if (source.startsWith("cookie")) {
-            String cookieName = getParameter(source, "Could not obtain cookie name from placeholder [" + source + "]");
-            Cookie cookieValue = request.getCookie(cookieName);
-
-            if (cookieValue != null) {
-                return Arrays.asList(cookieValue.getValue());
-            }
-        } else if (source.startsWith("remoteAddr")) {
-            String value = request.getRemoteAddr();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("method")) {
-            String value = request.getMethod();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("uri")) {
-            String value = request.getURI();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("relativePath")) {
-            String value = request.getRelativePath();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("secure")) {
-            return Arrays.asList(String.valueOf(request.isSecure()));
-        } else if (source.startsWith("body")) {
-            String contentType = request.getHeader("Content-Type");
-
-            if (contentType == null) {
-                contentType = "";
-            }
-
-            InputStream body = request.getInputStream(true);
-
-            try {
-                if (body == null || body.available() == 0) {
-                    return Collections.emptyList();
-                }
-            } catch (IOException cause) {
-                throw new RuntimeException("Failed to check available bytes in request input stream", cause);
-            }
-
-            if (body.markSupported()) {
-                body.mark(0);
-            }
-
-            List<String> values = new ArrayList<>();
-
-            try {
-                switch (contentType) {
-                    case "application/json":
-                        try {
-                            JsonNode jsonNode = JsonSerialization.mapper.readTree(new BufferedInputStream(body) {
-                                @Override
-                                public void close() {
-                                    // we can't close the stream because it may be used later by the application
-                                }
-                            });
-                            String path = getParameter(source, null);
-
-                            if (path == null) {
-                                values.addAll(JsonUtils.getValues(jsonNode));
-                            } else {
-                                values.addAll(JsonUtils.getValues(jsonNode, path));
-                            }
-                        } catch (IOException cause) {
-                            throw new RuntimeException("Could not extract claim from request JSON body", cause);
-                        }
-                        break;
-                    default:
-                        StringBuilder value = new StringBuilder();
-                        BufferedReader reader = new BufferedReader(new InputStreamReader(body));
-
-                        try {
-                            int ch;
-
-                            while ((ch = reader.read()) != -1) {
-                                value.append((char) ch);
-                            }
-                        } catch (IOException cause) {
-                            throw new RuntimeException("Could not extract claim from request body", cause);
-                        }
-
-                        values.add(value.toString());
-                }
-            } finally {
-                if (body.markSupported()) {
-                    try {
-                        body.reset();
-                    } catch (IOException cause) {
-                        throw new RuntimeException("Failed to reset request input stream", cause);
-                    }
-                }
-            }
-
-            return values;
-        }
-
-        return Collections.emptyList();
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/AbstractKeycloakLoginModule.java

@@ -37,12 +37,8 @@ import javax.security.auth.callback.PasswordCallback;
 import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.security.auth.login.LoginException;
 import javax.security.auth.spi.LoginModule;
-
-import java.io.IOException;
 import java.io.InputStream;
 import java.lang.reflect.Constructor;
-import java.net.MalformedURLException;
-import java.net.URL;
 import java.security.Principal;
 import java.util.HashSet;
 import java.util.Map;
@@ -57,7 +53,7 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     public static final String KEYCLOAK_CONFIG_FILE_OPTION = "keycloak-config-file";
     public static final String ROLE_PRINCIPAL_CLASS_OPTION = "role-principal-class";
-    public static final String PROFILE_RESOURCE = "profile:";
+
     protected Subject subject;
     protected CallbackHandler callbackHandler;
     protected Auth auth;
@@ -88,27 +84,14 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
     protected KeycloakDeployment resolveDeployment(String keycloakConfigFile) {
         try {
-            InputStream is = null;
-            if (keycloakConfigFile.startsWith(PROFILE_RESOURCE)) {
-                try {
-                    is = new URL(keycloakConfigFile).openStream();
-                } catch (MalformedURLException mfue) {
-                    throw new RuntimeException(mfue);
-                } catch (IOException ioe) {
-                    throw new RuntimeException(ioe);
-                }
-            } else {
-                is = FindFile.findFile(keycloakConfigFile);
-            }
+            InputStream is = FindFile.findFile(keycloakConfigFile);
             KeycloakDeployment kd = KeycloakDeploymentBuilder.build(is);
             return kd;
-
         } catch (RuntimeException e) {
             getLogger().debug("Unable to find or parse file " + keycloakConfigFile + " due to " + e.getMessage(), e);
             throw e;
         }
     }
-    
 
     @Override
     public boolean login() throws LoginException {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/JWKPublicKeyLocator.java

@@ -81,7 +81,7 @@ public class JWKPublicKeyLocator implements PublicKeyLocator {
 
 
     private PublicKey lookupCachedKey(int publicKeyCacheTtl, int currentTime, String kid) {
-        if (lastRequestTime + publicKeyCacheTtl > currentTime && kid != null) {
+        if (lastRequestTime + publicKeyCacheTtl > currentTime) {
             return currentKeys.get(kid);
         } else {
             return null;

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authentication.ClientCredentialsProvider

@@ -16,5 +16,4 @@
 #
 
 org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider
-org.keycloak.adapters.authentication.JWTClientCredentialsProvider
-org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider
+org.keycloak.adapters.authentication.JWTClientCredentialsProvider

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory

@@ -1,19 +0,0 @@
-#
-# * Copyright 2018 Red Hat, Inc. and/or its affiliates
-# * and other contributors as indicated by the @author tags.
-# *
-# * Licensed under the Apache License, Version 2.0 (the "License");
-# * you may not use this file except in compliance with the License.
-# * You may obtain a copy of the License at
-# *
-# * http://www.apache.org/licenses/LICENSE-2.0
-# *
-# * Unless required by applicable law or agreed to in writing, software
-# * distributed under the License is distributed on an "AS IS" BASIS,
-# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# * See the License for the specific language governing permissions and
-# * limitations under the License.
-#
-
-org.keycloak.adapters.authorization.cip.ClaimsInformationPointProviderFactory
-org.keycloak.adapters.authorization.cip.HttpClaimInformationPointProviderFactory

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentBuilderTest.java

@@ -21,7 +21,6 @@ import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
 import org.junit.Test;
 import org.keycloak.adapters.authentication.ClientIdAndSecretCredentialsProvider;
 import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
-import org.keycloak.adapters.authentication.JWTClientSecretCredentialsProvider;
 import org.keycloak.adapters.rotation.HardcodedPublicKeyLocator;
 import org.keycloak.adapters.rotation.JWKPublicKeyLocator;
 import org.keycloak.common.enums.RelativeUrlsUsed;
@@ -95,9 +94,4 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(JWTClientCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
     }
 
-    @Test
-    public void loadSecretJwtCredentials() throws Exception {
-        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getClass().getResourceAsStream("/keycloak-secret-jwt.json"));
-        assertEquals(JWTClientSecretCredentialsProvider.PROVIDER_ID, deployment.getClientAuthenticator().getId());
-    }
 }

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentTest.java

@@ -17,9 +17,7 @@
 package org.keycloak.adapters;
 
 import org.junit.Test;
-import org.keycloak.representations.adapters.config.AdapterConfig;
 
-import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 
@@ -48,21 +46,4 @@ public class KeycloakDeploymentTest {
 
         assertTrue(keycloakDeployment.isOAuthQueryParameterEnabled());
     }
-
-    @Test
-    public void stripDefaultPorts() {
-        KeycloakDeployment keycloakDeployment = new KeycloakDeployment();
-        keycloakDeployment.setRealm("test");
-        AdapterConfig config = new AdapterConfig();
-        config.setAuthServerUrl("http://localhost:80/auth");
-        keycloakDeployment.setAuthServerBaseUrl(config);
-
-        assertEquals("http://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
-
-        config.setAuthServerUrl("https://localhost:443/auth");
-        keycloakDeployment.setAuthServerBaseUrl(config);
-
-        assertEquals("https://localhost/auth", keycloakDeployment.getAuthServerBaseUrl());
-    }
-
 }

adapters/oidc/adapter-core/src/test/resources/keycloak-secret-jwt.json

@@ -1,12 +0,0 @@
-{
-    "realm": "demo",
-    "resource": "customer-portal",
-    "realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
-    "auth-server-url": "https://localhost:8443/auth",
-    "ssl-required": "external",
-    "credentials": {
-        "secret-jwt": {
-            "secret": "234234-234234-234234"
-        }
-    }
-}

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/AuthenticatedActionsValve.java

@@ -1,13 +0,0 @@
-package org.keycloak.adapters.jbossweb;
-
-import org.apache.catalina.Container;
-import org.apache.catalina.Valve;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
-
-public class AuthenticatedActionsValve extends AbstractAuthenticatedActionsValve {
-
-    public AuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
-        super(deploymentContext, next, container);
-    }
-}

adapters/oidc/as7-eap6/as7-adapter/src/main/java/org/keycloak/adapters/jbossweb/KeycloakAuthenticatorValve.java

@@ -17,15 +17,11 @@
 
 package org.keycloak.adapters.jbossweb;
 
-import org.apache.catalina.Container;
 import org.apache.catalina.LifecycleException;
-import org.apache.catalina.Valve;
 import org.apache.catalina.connector.Request;
 import org.apache.catalina.connector.Response;
 import org.apache.catalina.core.StandardContext;
 import org.apache.catalina.deploy.LoginConfig;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve;
 import org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve;
 import org.keycloak.adapters.tomcat.GenericPrincipalFactory;
 
@@ -60,6 +56,7 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
         super.start();
     }
 
+
     public void logout(Request request) {
         logoutInternal(request);
     }
@@ -68,9 +65,4 @@ public class KeycloakAuthenticatorValve extends AbstractKeycloakAuthenticatorVal
     protected GenericPrincipalFactory createPrincipalFactory() {
         return new JBossWebPrincipalFactory();
     }
-
-    @Override
-    protected AbstractAuthenticatedActionsValve createAuthenticatedActionsValve(AdapterDeploymentContext deploymentContext, Valve next, Container container) {
-        return new AuthenticatedActionsValve(deploymentContext, next, container);
-    }
 }

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>

adapters/oidc/cli-sso/login.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+export KC_AUTH_SERVER=http://localhost:8080/auth
+export KC_REALM=master
+export KC_CLIENT=cli
+
+export KC_ACCESS_TOKEN=`java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar login`
+
+
+
+

adapters/oidc/cli-sso/logout.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar logout
+
+unset KC_ACCESS_TOKEN
+
+
+
+

adapters/oidc/cli-sso/pom.xml

@@ -21,12 +21,12 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
-    <artifactId>kcinit</artifactId>
+    <artifactId>keycloak-cli-sso</artifactId>
     <name>Keycloak CLI SSO Framework</name>
     <description/>
 
@@ -54,7 +54,7 @@
                 <configuration>
                     <transformers>
                         <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-                            <mainClass>org.keycloak.adapters.KcinitMain</mainClass>
+                            <mainClass>org.keycloak.adapters.KeycloakCliSsoMain</mainClass>
                         </transformer>
                     </transformers>
 

adapters/oidc/cli-sso/src/main/java/org/keycloak/adapters/KeycloakCliSsoMain.java

@@ -16,15 +16,30 @@
  */
 package org.keycloak.adapters;
 
-import org.keycloak.adapters.installed.KcinitDriver;
+import org.keycloak.adapters.installed.KeycloakCliSso;
+import org.keycloak.adapters.installed.KeycloakInstalled;
+import org.keycloak.common.util.Time;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class KcinitMain extends KcinitDriver {
+public class KeycloakCliSsoMain extends KeycloakCliSso {
 
     public static void main(String[] args) throws Exception {
-        new KcinitMain().mainCmd(args);
+        new KeycloakCliSsoMain().mainCmd(args);
     }
 }

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -63,15 +63,6 @@
             <groupId>org.jboss.logging</groupId>
             <artifactId>jboss-logging</artifactId>
         </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.spec.javax.ws.rs</groupId>
-            <artifactId>jboss-jaxrs-api_2.0_spec</artifactId>
-        </dependency>
-
     </dependencies>
 
     <build>

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KcinitDriver.java

@@ -1,702 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.installed;
-
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.adapters.ServerRequest;
-import org.keycloak.common.util.Base64;
-import org.keycloak.common.util.Time;
-import org.keycloak.jose.jwe.*;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.adapters.config.AdapterConfig;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.util.JsonSerialization;
-
-import javax.crypto.SecretKey;
-import javax.crypto.SecretKeyFactory;
-import javax.crypto.spec.PBEKeySpec;
-import javax.crypto.spec.SecretKeySpec;
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.io.*;
-import java.nio.file.Paths;
-import java.security.NoSuchAlgorithmException;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.KeySpec;
-import java.util.*;
-
-/**
- * All kcinit commands that take input ask for
- * <p>
- * 1. . kcinit
- * - setup and export KC_SESSION_KEY env var if not set.
- * - checks to see if master token valid, refresh is possible, exit if token valid
- * - performs command line login
- * - stores master token for master client
- * 2. app.sh is a wrapper for app cli.
- * - token=`kcinit token app`
- * - checks to see if token for app client has been fetched, refresh if valid, output token to sys.out if exists
- * - if no token, login.  Prompts go to stderr.
- * - pass token as cmd line param to app or as environment variable.
- * <p>
- * 3. kcinit password {password}
- * - outputs password key that is used for encryption.
- * - can be used in .bashrc as export KC_SESSSION_KEY=`kcinit password {password}` or just set it in .bat file
- * <p>
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KcinitDriver {
-
-    public static final String KC_SESSION_KEY = "KC_SESSION_KEY";
-    public static final String KC_LOGIN_CONFIG_PATH = "KC_LOGIN_CONFIG_PATH";
-    protected Map<String, String> config;
-    protected boolean debug = true;
-
-    protected static byte[] salt = new byte[]{-4, 88, 66, -101, 78, -94, 21, 105};
-
-    String[] args = null;
-
-    protected boolean forceLogin;
-    protected boolean browserLogin;
-
-    public void mainCmd(String[] args) throws Exception {
-
-        this.args = args;
-
-
-        if (args.length == 0) {
-            printHelp();
-            return;
-        }
-
-        if (args[0].equalsIgnoreCase("token")) {
-            //System.err.println("executing token");
-            token();
-        } else if (args[0].equalsIgnoreCase("login")) {
-            login();
-        } else if (args[0].equalsIgnoreCase("logout")) {
-            logout();
-        } else if (args[0].equalsIgnoreCase("env")) {
-            System.out.println(System.getenv().toString());
-        } else if (args[0].equalsIgnoreCase("install")) {
-            install();
-        } else if (args[0].equalsIgnoreCase("uninstall")) {
-            uninstall();
-        } else if (args[0].equalsIgnoreCase("password")) {
-            passwordKey();
-        } else {
-            KeycloakInstalled.console().writer().println("Unknown command: " + args[0]);
-            KeycloakInstalled.console().writer().println();
-            printHelp();
-        }
-    }
-
-    public String getHome() {
-        String home = System.getenv("HOME");
-        if (home == null) {
-            home = System.getProperty("HOME");
-            if (home == null) {
-                home = Paths.get("").toAbsolutePath().normalize().toString();
-            }
-        }
-        return home;
-    }
-
-    public void passwordKey() {
-        if (args.length < 2) {
-            printHelp();
-            System.exit(1);
-        }
-        String password = args[1];
-        try {
-            String encodedKey = generateEncryptionKey(password);
-            System.out.printf(encodedKey);
-        } catch (Exception e) {
-            e.printStackTrace();
-            System.exit(1);
-        }
-    }
-
-    protected String generateEncryptionKey(String password) throws NoSuchAlgorithmException, InvalidKeySpecException {
-        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
-        KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 100, 128);
-        SecretKey tmp = factory.generateSecret(spec);
-        byte[] aeskey = tmp.getEncoded();
-        return Base64.encodeBytes(aeskey);
-    }
-
-    public JWE createJWE() {
-        String key = getEncryptionKey();
-        if (key == null) {
-            throw new RuntimeException(KC_SESSION_KEY + " env var not set");
-        }
-        byte[] aesKey = null;
-        try {
-            aesKey = Base64.decode(key.getBytes("UTF-8"));
-        } catch (IOException e) {
-            throw new RuntimeException("invalid " + KC_SESSION_KEY + "env var");
-        }
-
-        JWE jwe = new JWE();
-        final SecretKey aesSecret = new SecretKeySpec(aesKey, "AES");
-        jwe.getKeyStorage()
-                .setEncryptionKey(aesSecret);
-        return jwe;
-    }
-
-    protected String encryptionKey;
-
-    protected String getEncryptionKey() {
-        if (encryptionKey != null) return encryptionKey;
-        return System.getenv(KC_SESSION_KEY);
-    }
-
-    public String encrypt(String payload) {
-        JWE jwe = createJWE();
-        JWEHeader jweHeader = new JWEHeader(JWEConstants.A128KW, JWEConstants.A128CBC_HS256, null);
-        try {
-            jwe.header(jweHeader).content(payload.getBytes("UTF-8"));
-        } catch (UnsupportedEncodingException e) {
-            throw new RuntimeException("cannot encode payload as UTF-8");
-        }
-        try {
-            return jwe.encodeJwe();
-        } catch (JWEException e) {
-            throw new RuntimeException("cannot encrypt payload", e);
-        }
-    }
-
-    public String decrypt(String encoded) {
-        JWE jwe = createJWE();
-        try {
-            jwe.verifyAndDecodeJwe(encoded);
-            byte[] content = jwe.getContent();
-            if (content == null) return null;
-            return new String(content, "UTF-8");
-        } catch (Exception ex) {
-            throw new RuntimeException("cannot decrypt payload", ex);
-
-        }
-
-    }
-
-    public static String getenv(String name, String defaultValue) {
-        String val = System.getenv(name);
-        return val == null ? defaultValue : val;
-    }
-
-    public File getConfigDirectory() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit").toFile();
-    }
-
-
-    public File getConfigFile() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "config.json").toFile();
-    }
-
-    public File getTokenFilePath(String client) {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens", client).toFile();
-    }
-
-    public File getTokenDirectory() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens").toFile();
-    }
-
-    protected boolean encrypted = false;
-
-    protected void checkEnv() {
-        File configFile = getConfigFile();
-        if (!configFile.exists()) {
-            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-        }
-        byte[] data = new byte[0];
-        try {
-            data = readFileRaw(configFile);
-        } catch (IOException e) {
-
-        }
-        if (data == null) {
-            KeycloakInstalled.console().writer().println("Config file unreadable.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-
-        }
-        String encodedJwe = null;
-        try {
-            encodedJwe = new String(data, "UTF-8");
-        } catch (UnsupportedEncodingException e) {
-            e.printStackTrace();
-        }
-
-        if (encodedJwe.contains("realm")) {
-            encrypted = false;
-            return;
-        } else {
-            encrypted = true;
-        }
-
-        if (System.getenv(KC_SESSION_KEY) == null) {
-            promptLocalPassword();
-        }
-    }
-
-    protected void promptLocalPassword() {
-        String password = KeycloakInstalled.console().passwordPrompt("Enter password to unlock kcinit config files: ");
-        try {
-            encryptionKey = generateEncryptionKey(password);
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-
-    protected String readFile(File fp) {
-        try {
-            byte[] data = readFileRaw(fp);
-            if (data == null) return null;
-            String file = new String(data, "UTF-8");
-            if (!encrypted) {
-                return file;
-            }
-            String decrypted = decrypt(file);
-            if (decrypted == null)
-                throw new RuntimeException("Unable to decrypt file.  Did you set your local password correctly?");
-            return decrypted;
-        } catch (IOException e) {
-            throw new RuntimeException("failed to decrypt file: " + fp.getAbsolutePath() + " Did you set your local password correctly?", e);
-        }
-
-
-    }
-
-    protected byte[] readFileRaw(File fp) throws IOException {
-        if (!fp.exists()) return null;
-        FileInputStream fis = new FileInputStream(fp);
-        byte[] data = new byte[(int) fp.length()];
-        fis.read(data);
-        fis.close();
-        return data;
-    }
-
-    protected void writeFile(File fp, String payload) {
-        try {
-            String data = payload;
-            if (encrypted) data = encrypt(payload);
-            FileOutputStream fos = new FileOutputStream(fp);
-            fos.write(data.getBytes("UTF-8"));
-            fos.flush();
-            fos.close();
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-
-    public void install() {
-        if (getEncryptionKey() == null) {
-            if (KeycloakInstalled.console().confirm("Do you want to protect tokens stored locally with a password? (y/n): ")) {
-                String password = "p";
-                String confirm = "c";
-                do {
-                    password = KeycloakInstalled.console().passwordPrompt("Enter local password: ");
-                    confirm = KeycloakInstalled.console().passwordPrompt("Confirm local password: ");
-                    if (!password.equals(confirm)) {
-                        KeycloakInstalled.console().writer().println();
-                        KeycloakInstalled.console().writer().println("Confirmation does not match.  Try again.");
-                        KeycloakInstalled.console().writer().println();
-                    }
-                } while (!password.equals(confirm));
-                try {
-                    this.encrypted = true;
-                    this.encryptionKey = generateEncryptionKey(password);
-                } catch (Exception e) {
-                    e.printStackTrace();
-                    System.exit(1);
-                }
-            }
-        } else {
-            if (!KeycloakInstalled.console().confirm("KC_SESSION_KEY env var already set.  Do you want to use this as your local encryption key? (y/n): ")) {
-                KeycloakInstalled.console().writer().println("Unset KC_SESSION_KEY env var and run again");
-                System.exit(1);
-            }
-            this.encrypted = true;
-            this.encryptionKey = getEncryptionKey();
-        }
-        String server = KeycloakInstalled.console().readLine("Authentication server URL [http://localhost:8080/auth]: ").trim();
-        String realm = KeycloakInstalled.console().readLine("Name of realm [master]: ").trim();
-        String client = KeycloakInstalled.console().readLine("CLI client id [kcinit]: ").trim();
-        String secret = KeycloakInstalled.console().readLine("CLI client secret [none]: ").trim();
-        if (server.equals("")) {
-            server = "http://localhost:8080/auth";
-        }
-        if (realm.equals("")) {
-            realm = "master";
-        }
-        if (client.equals("")) {
-            client = "kcinit";
-        }
-        File configDir = getTokenDirectory();
-        configDir.mkdirs();
-
-        File configFile = getConfigFile();
-        Map<String, String> props = new HashMap<>();
-        props.put("server", server);
-        props.put("realm", realm);
-        props.put("client", client);
-        props.put("secret", secret);
-
-        try {
-            String json = JsonSerialization.writeValueAsString(props);
-            writeFile(configFile, json);
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-
-        KeycloakInstalled.console().writer().println();
-        KeycloakInstalled.console().writer().println("Installation complete!");
-        KeycloakInstalled.console().writer().println();
-    }
-
-
-    public void printHelp() {
-        KeycloakInstalled.console().writer().println("Commands:");
-        KeycloakInstalled.console().writer().println("  login [-f] -f forces login");
-        KeycloakInstalled.console().writer().println("  logout");
-        KeycloakInstalled.console().writer().println("  token [client] - print access token of desired client.  Defaults to default master client.  Will print either 'error', 'not-allowed',  or 'login-required' on error.");
-        KeycloakInstalled.console().writer().println("  install - Install this utility.  Will store in $HOME/.keycloak/kcinit unless " + KC_LOGIN_CONFIG_PATH + " env var is set");
-        System.exit(1);
-    }
-
-
-    public AdapterConfig getConfig() {
-        File configFile = getConfigFile();
-        if (!configFile.exists()) {
-            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-            return null;
-        }
-
-        AdapterConfig config = new AdapterConfig();
-        config.setAuthServerUrl((String) getConfigProperties().get("server"));
-        config.setRealm((String) getConfigProperties().get("realm"));
-        config.setResource((String) getConfigProperties().get("client"));
-        config.setSslRequired("external");
-        String secret = (String) getConfigProperties().get("secret");
-        if (secret != null && !secret.trim().equals("")) {
-            Map<String, Object> creds = new HashMap<>();
-            creds.put("secret", secret);
-            config.setCredentials(creds);
-        } else {
-            config.setPublicClient(true);
-        }
-        return config;
-    }
-
-    private Map<String, String> getConfigProperties() {
-        if (this.config != null) return this.config;
-        if (!getConfigFile().exists()) {
-            KeycloakInstalled.console().writer().println();
-            KeycloakInstalled.console().writer().println(("Config file does not exist.  Run kcinit install to set it up."));
-            System.exit(1);
-        }
-        String json = readFile(getConfigFile());
-        try {
-            Map map = JsonSerialization.readValue(json, Map.class);
-            config = (Map<String, String>) map;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-        return this.config;
-    }
-
-    public String readToken(String client) throws Exception {
-        String json = getTokenResponse(client);
-        if (json == null) return null;
-
-
-        if (json != null) {
-            try {
-                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                if (Time.currentTime() < tokenResponse.getExpiresIn()) {
-                    return tokenResponse.getToken();
-                }
-                AdapterConfig config = getConfig();
-                KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-                installed.refreshToken(tokenResponse.getRefreshToken());
-                processResponse(installed, client);
-                return tokenResponse.getToken();
-            } catch (Exception e) {
-                File tokenFile = getTokenFilePath(client);
-                if (tokenFile.exists()) {
-                    tokenFile.delete();
-                }
-
-                return null;
-            }
-        }
-        return null;
-
-    }
-
-    public String readRefreshToken(String client) throws Exception {
-        String json = getTokenResponse(client);
-        if (json == null) return null;
-
-
-        if (json != null) {
-            try {
-                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                return tokenResponse.getRefreshToken();
-            } catch (Exception e) {
-                if (debug) {
-                    e.printStackTrace();
-                }
-                File tokenFile = getTokenFilePath(client);
-                if (tokenFile.exists()) {
-                    tokenFile.delete();
-                }
-
-                return null;
-            }
-        }
-        return null;
-
-    }
-
-
-    private String getTokenResponse(String client) throws IOException {
-        File tokenFile = getTokenFilePath(client);
-        try {
-            return readFile(tokenFile);
-        } catch (Exception e) {
-            if (debug) {
-                System.err.println("Failed to read encrypted file");
-                e.printStackTrace();
-            }
-            if (tokenFile.exists()) tokenFile.delete();
-            return null;
-        }
-    }
-
-
-    public void token() throws Exception {
-        KeycloakInstalled.console().stderrOutput();
-
-        checkEnv();
-        String masterClient = getMasterClient();
-        String client = masterClient;
-        if (args.length > 1) {
-            client = args[1];
-        }
-        //System.err.println("readToken: " + client);
-        String token = readToken(client);
-        if (token != null) {
-            System.out.print(token);
-            return;
-        }
-        if (token == null && client.equals(masterClient)) {
-            //System.err.println("not logged in, logging in.");
-            doConsoleLogin();
-            token = readToken(client);
-            if (token != null) {
-                System.out.print(token);
-                return;
-            }
-
-        }
-        String masterToken = readToken(masterClient);
-        if (masterToken == null) {
-            //System.err.println("not logged in, logging in.");
-            doConsoleLogin();
-            masterToken = readToken(masterClient);
-            if (masterToken == null) {
-                System.err.println("Login failed.  Cannot retrieve token");
-                System.exit(1);
-            }
-        }
-
-        //System.err.println("exchange: " + client);
-        Client httpClient = getHttpClient();
-
-        WebTarget exchangeUrl = httpClient.target(getServer())
-                .path("/realms")
-                .path(getRealm())
-                .path("protocol/openid-connect/token");
-
-        Form form = new Form()
-                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                .param(OAuth2Constants.CLIENT_ID, masterClient)
-                .param(OAuth2Constants.SUBJECT_TOKEN, masterToken)
-                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                .param(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE)
-                .param(OAuth2Constants.AUDIENCE, client);
-        if (getMasterClientSecret() != null) {
-            form.param(OAuth2Constants.CLIENT_SECRET, getMasterClientSecret());
-        }
-        Response response = exchangeUrl.request().post(Entity.form(
-                form
-        ));
-
-        if (response.getStatus() == 401 || response.getStatus() == 403) {
-            response.close();
-            System.err.println("Not allowed to exchange for client token");
-            System.exit(1);
-        }
-
-        if (response.getStatus() != 200) {
-            if (response.getMediaType() != null && response.getMediaType().equals(MediaType.APPLICATION_JSON_TYPE)) {
-                try {
-                    String json = response.readEntity(String.class);
-                    OAuth2ErrorRepresentation error = JsonSerialization.readValue(json, OAuth2ErrorRepresentation.class);
-                    System.err.println("Failed to exchange token: " + error.getError() + ". " + error.getErrorDescription());
-                    System.exit(1);
-                } catch (Exception ignore) {
-                    ignore.printStackTrace();
-
-                }
-            }
-
-            response.close();
-            System.err.println("Unknown error exchanging for client token: " + response.getStatus());
-            System.exit(1);
-        }
-
-        String json = response.readEntity(String.class);
-        response.close();
-        AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-        if (tokenResponse.getToken() != null) {
-            getTokenDirectory().mkdirs();
-            tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
-            tokenResponse.setIdToken(null);
-            json = JsonSerialization.writeValueAsString(tokenResponse);
-            writeFile(getTokenFilePath(client), json);
-            System.out.printf(tokenResponse.getToken());
-        } else {
-            System.err.println("Error processing token");
-            System.exit(1);
-        }
-    }
-
-    protected String getMasterClientSecret() {
-        return getProperty("secret");
-    }
-
-    protected String getServer() {
-        return getProperty("server");
-    }
-
-    protected String getRealm() {
-        return getProperty("realm");
-    }
-
-    public String getProperty(String name) {
-        return (String) getConfigProperties().get(name);
-    }
-
-    protected boolean forceLogin() {
-        return args.length > 0 && args[0].equals("-f");
-
-    }
-
-    public Client getHttpClient() {
-        return new ResteasyClientBuilder().disableTrustManager().build();
-    }
-
-    public void login() throws Exception {
-        checkEnv();
-        this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-        for (String arg : args) {
-            if (arg.equals("-f") || arg.equals("-force")) {
-                forceLogin = true;
-                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-            } else if (arg.equals("-browser") || arg.equals("-b")) {
-                browserLogin = true;
-                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-            } else {
-                System.err.println("Illegal argument: " + arg);
-                printHelp();
-                System.exit(1);
-            }
-        }
-
-        String masterClient = getMasterClient();
-        if (!forceLogin && readToken(masterClient) != null) {
-            KeycloakInstalled.console().writer().println("Already logged in.  `kcinit -f` to force relogin");
-            return;
-        }
-        doConsoleLogin();
-        KeycloakInstalled.console().writer().println("Login successful!");
-    }
-
-    public void doConsoleLogin() throws Exception {
-        String masterClient = getMasterClient();
-        AdapterConfig config = getConfig();
-        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-        //System.err.println("calling loginCommandLine");
-        if (!installed.loginCommandLine()) {
-            System.exit(1);
-        }
-        processResponse(installed, masterClient);
-    }
-
-    private String getMasterClient() {
-        return getProperty("client");
-    }
-
-    private void processResponse(KeycloakInstalled installed, String client) throws IOException {
-        AccessTokenResponse tokenResponse = installed.getTokenResponse();
-        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
-        tokenResponse.setIdToken(null);
-        String json = JsonSerialization.writeValueAsString(tokenResponse);
-        getTokenDirectory().mkdirs();
-        writeFile(getTokenFilePath(client), json);
-    }
-
-    public void logout() throws Exception {
-        String token = readRefreshToken(getMasterClient());
-        if (token != null) {
-            try {
-                KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getConfig());
-                ServerRequest.invokeLogout(deployment, token);
-            } catch (Exception e) {
-                if (debug) {
-                    e.printStackTrace();
-                }
-            }
-
-        }
-        if (getTokenDirectory().exists()) {
-            for (File fp : getTokenDirectory().listFiles()) fp.delete();
-        }
-    }
-    public void uninstall() throws Exception {
-        File configFile = getConfigFile();
-        if (configFile.exists()) configFile.delete();
-        if (getTokenDirectory().exists()) {
-            for (File fp : getTokenDirectory().listFiles()) fp.delete();
-        }
-    }
-}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakCliSso.java

@@ -0,0 +1,266 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.installed;
+
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.ServerRequest;
+import org.keycloak.common.util.Time;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ *
+ *
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakCliSso {
+
+    public void mainCmd(String[] args) throws Exception {
+        if (args.length != 1) {
+            printHelp();
+            return;
+        }
+
+        if (args[0].equalsIgnoreCase("login")) {
+            login();
+        } else if (args[0].equalsIgnoreCase("login-manual")) {
+            loginManual();
+        } else if (args[0].equalsIgnoreCase("token")) {
+            token();
+        } else if (args[0].equalsIgnoreCase("logout")) {
+            logout();
+        } else if (args[0].equalsIgnoreCase("env")) {
+            System.out.println(System.getenv().toString());
+        } else {
+            printHelp();
+        }
+    }
+
+
+    public void printHelp() {
+        System.err.println("Commands:");
+        System.err.println("  login - login with desktop browser if available, otherwise do manual login.  Output is access token.");
+        System.err.println("  login-manual - manual login");
+        System.err.println("  token - print access token if logged in");
+        System.err.println("  logout - logout.");
+        System.exit(1);
+    }
+
+    public AdapterConfig getConfig() {
+        String url = System.getProperty("KEYCLOAK_AUTH_SERVER");
+        if (url == null) {
+            System.err.println("KEYCLOAK_AUTH_SERVER property not set");
+            System.exit(1);
+        }
+        String realm = System.getProperty("KEYCLOAK_REALM");
+        if (realm == null) {
+            System.err.println("KEYCLOAK_REALM property not set");
+            System.exit(1);
+
+        }
+        String client = System.getProperty("KEYCLOAK_CLIENT");
+        if (client == null) {
+            System.err.println("KEYCLOAK_CLIENT property not set");
+            System.exit(1);
+        }
+        String secret = System.getProperty("KEYCLOAK_CLIENT_SECRET");
+
+
+
+        AdapterConfig config = new AdapterConfig();
+        config.setAuthServerUrl(url);
+        config.setRealm(realm);
+        config.setResource(client);
+        config.setSslRequired("external");
+        if (secret != null) {
+            Map<String, Object> creds = new HashMap<>();
+            creds.put("secret", secret);
+            config.setCredentials(creds);
+        } else {
+            config.setPublicClient(true);
+        }
+        return config;
+    }
+
+    public boolean checkToken() throws Exception {
+        String token = getTokenResponse();
+        if (token == null) return false;
+
+
+        if (token != null) {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
+                        return true;
+                    }
+                    AdapterConfig config = getConfig();
+                    KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+                    installed.refreshToken(tokenResponse.getRefreshToken());
+                    processResponse(installed);
+                    return true;
+                } catch (Exception e) {
+                    System.err.println("Error processing existing token");
+                    e.printStackTrace();
+                }
+
+            }
+        }
+        return false;
+
+    }
+
+    private String getTokenResponse() throws IOException {
+        String token = null;
+        File tokenFile = getTokenFilePath();
+        if (tokenFile.exists()) {
+            FileInputStream fis = new FileInputStream(tokenFile);
+            byte[] data = new byte[(int) tokenFile.length()];
+            fis.read(data);
+            fis.close();
+            token = new String(data, "UTF-8");
+        }
+        return token;
+    }
+
+    public void token() throws Exception {
+        String token = getTokenResponse();
+        if (token == null) {
+            System.err.println("There is no token for client");
+            System.exit(1);
+        } else {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
+                        System.out.println(tokenResponse.getToken());
+                        return;
+                    } else {
+                        System.err.println("token in response file is expired");
+                        System.exit(1);
+                    }
+                } catch (Exception e) {
+                    System.err.println("Failure processing token response file");
+                    e.printStackTrace();
+                    System.exit(1);
+                }
+            } else {
+                System.err.println("Could not find json within token response file");
+                System.exit(1);
+            }
+        }
+    }
+
+    public void login() throws Exception {
+        if (checkToken()) return;
+        AdapterConfig config = getConfig();
+        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+        installed.login();
+        processResponse(installed);
+    }
+
+    public String getHome() {
+        String home = System.getenv("HOME");
+        if (home == null) {
+            home = System.getProperty("HOME");
+            if (home == null) {
+                home = Paths.get("").toAbsolutePath().normalize().toString();
+            }
+        }
+        return home;
+    }
+
+    public File getTokenDirectory() {
+        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM")).toFile();
+    }
+
+    public File getTokenFilePath() {
+        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM"), System.getProperty("KEYCLOAK_CLIENT") + ".json").toFile();
+    }
+
+    private void processResponse(KeycloakInstalled installed) throws IOException {
+        AccessTokenResponse tokenResponse = installed.getTokenResponse();
+        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
+        tokenResponse.setIdToken(null);
+        String output = JsonSerialization.writeValueAsString(tokenResponse);
+        getTokenDirectory().mkdirs();
+        FileOutputStream fos = new FileOutputStream(getTokenFilePath());
+        fos.write(output.getBytes("UTF-8"));
+        fos.flush();
+        fos.close();
+        System.out.println(tokenResponse.getToken());
+    }
+
+    public void loginManual() throws Exception {
+        if (checkToken()) return;
+        AdapterConfig config = getConfig();
+        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
+        KeycloakInstalled installed = new KeycloakInstalled(deployment);
+        installed.loginManual();
+        processResponse(installed);
+    }
+
+    public void logout() throws Exception {
+        String token = getTokenResponse();
+        if (token != null) {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() > tokenResponse.getExpiresIn()) {
+                        System.err.println("Login is expired");
+                        System.exit(1);
+                    }
+                    AdapterConfig config = getConfig();
+                    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
+                    ServerRequest.invokeLogout(deployment, tokenResponse.getRefreshToken());
+                    for (File fp : getTokenDirectory().listFiles()) fp.delete();
+                    System.out.println("logout complete");
+                } catch (Exception e) {
+                    System.err.println("Failure processing token response file");
+                    e.printStackTrace();
+                    System.exit(1);
+                }
+            } else {
+                System.err.println("Could not find json within token response file");
+                System.exit(1);
+            }
+        } else {
+            System.err.println("Not logged in");
+            System.exit(1);
+        }
+    }
+}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakInstalled.java

@@ -17,8 +17,7 @@
 
 package org.keycloak.adapters.installed;
 
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
+import org.apache.commons.codec.Charsets;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.OAuthErrorException;
 import org.keycloak.adapters.KeycloakDeployment;
@@ -33,13 +32,15 @@ import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
 
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
 import java.awt.*;
-import java.io.*;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.PrintStream;
+import java.io.PrintWriter;
+import java.io.Reader;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.URI;
@@ -47,8 +48,6 @@ import java.net.URISyntaxException;
 import java.util.Locale;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -57,7 +56,6 @@ public class KeycloakInstalled {
 
     public interface HttpResponseWriter {
         void success(PrintWriter pw, KeycloakInstalled ki);
-
         void failure(PrintWriter pw, KeycloakInstalled ki);
     }
 
@@ -79,10 +77,7 @@ public class KeycloakInstalled {
     private Locale locale;
     private HttpResponseWriter loginResponseWriter;
     private HttpResponseWriter logoutResponseWriter;
-    private ResteasyClient resteasyClient;
-    Pattern callbackPattern = Pattern.compile("callback\\s*=\\s*\"([^\"]+)\"");
-    Pattern paramPattern = Pattern.compile("param=\"([^\"]+)\"\\s+label=\"([^\"]+)\"\\s+mask=(\\S+)");
-    Pattern codePattern = Pattern.compile("code=([^&]+)");
+
 
 
     public KeycloakInstalled() {
@@ -98,12 +93,70 @@ public class KeycloakInstalled {
         this.deployment = deployment;
     }
 
+    private static HttpResponseWriter defaultLoginWriter = new HttpResponseWriter() {
+        @Override
+        public void success(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Login completed.</h1><div>");
+            pw.println("This browser will remain logged in until you close it, logout, or the session expires.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+
+        @Override
+        public void failure(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Login attempt failed.</h1><div>");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+    };
+    private static HttpResponseWriter defaultLogoutWriter = new HttpResponseWriter() {
+        @Override
+        public void success(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Logout completed.</h1><div>");
+            pw.println("You may close this browser tab.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+
+        @Override
+        public void failure(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Logout failed.</h1><div>");
+            pw.println("You may close this browser tab.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+    };
+
     public HttpResponseWriter getLoginResponseWriter() {
-        return null;
+        if (loginResponseWriter == null) {
+            return defaultLoginWriter;
+        } else {
+            return loginResponseWriter;
+        }
     }
 
     public HttpResponseWriter getLogoutResponseWriter() {
-        return null;
+        if (logoutResponseWriter == null) {
+            return defaultLogoutWriter;
+        } else {
+            return logoutResponseWriter;
+        }
     }
 
     public void setLoginResponseWriter(HttpResponseWriter loginResponseWriter) {
@@ -114,10 +167,6 @@ public class KeycloakInstalled {
         this.logoutResponseWriter = logoutResponseWriter;
     }
 
-    public void setResteasyClient(ResteasyClient resteasyClient) {
-        this.resteasyClient = resteasyClient;
-    }
-
     public Locale getLocale() {
         return locale;
     }
@@ -241,272 +290,6 @@ public class KeycloakInstalled {
         status = Status.LOGGED_MANUAL;
     }
 
-    public static class Console {
-        protected java.io.Console console = System.console();
-        protected PrintWriter writer;
-        protected BufferedReader reader;
-
-        static Console SINGLETON = new Console();
-
-        private Console() {
-        }
-
-
-        public PrintWriter writer() {
-            if (console == null) {
-                if (writer == null) {
-                    writer = new PrintWriter(System.err, true);
-                }
-                return writer;
-            }
-            return console.writer();
-        }
-
-        public Reader reader() {
-            if (console == null) {
-                return getReader();
-            }
-            return console.reader();
-        }
-
-        protected BufferedReader getReader() {
-            if (reader != null) return reader;
-            reader = new BufferedReader(new BufferedReader(new InputStreamReader(System.in)));
-            return reader;
-        }
-
-        public Console format(String fmt, Object... args) {
-            if (console == null) {
-                writer().format(fmt, args);
-                return this;
-            }
-            console.format(fmt, args);
-            return this;
-        }
-
-        public Console printf(String format, Object... args) {
-            if (console == null) {
-                writer().printf(format, args);
-                return this;
-            }
-            console.printf(format, args);
-            return this;
-        }
-
-        public String readLine(String fmt, Object... args) {
-            if (console == null) {
-                format(fmt, args);
-                return readLine();
-            }
-            return console.readLine(fmt, args);
-        }
-
-        public boolean confirm(String fmt, Object... args) {
-            String prompt = "";
-            while (!"y".equals(prompt) && !"n".equals(prompt)) {
-                prompt = readLine(fmt, args);
-            }
-            return "y".equals(prompt);
-
-        }
-
-        public String prompt(String fmt, Object... args) {
-            String prompt = "";
-            while (prompt.equals("")) {
-                prompt = readLine(fmt, args).trim();
-            }
-            return prompt;
-
-        }
-
-        public String passwordPrompt(String fmt, Object... args) {
-            String prompt = "";
-            while (prompt.equals("")) {
-                char[] val = readPassword(fmt, args);
-                prompt = new String(val);
-                prompt = prompt.trim();
-            }
-            return prompt;
-
-        }
-
-        public String readLine() {
-            if (console == null) {
-                try {
-                    return getReader().readLine();
-                } catch (IOException e) {
-                    throw new RuntimeException(e);
-                }
-            }
-            return console.readLine();
-        }
-
-        public char[] readPassword(String fmt, Object... args) {
-            if (console == null) {
-                return readLine(fmt, args).toCharArray();
-
-            }
-            return console.readPassword(fmt, args);
-        }
-
-        public char[] readPassword() {
-            if (console == null) {
-                return readLine().toCharArray();
-            }
-            return console.readPassword();
-        }
-
-        public void flush() {
-            if (console == null) {
-                System.err.flush();
-                return;
-            }
-            console.flush();
-        }
-
-        public void stderrOutput() {
-            //System.err.println("not using System.console()");
-            console = null;
-        }
-    }
-
-    public static Console console() {
-        return Console.SINGLETON;
-    }
-
-    public boolean loginCommandLine() throws IOException, ServerRequest.HttpFailure, VerificationException {
-        String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
-
-        return loginCommandLine(redirectUri);
-    }
-
-
-    /**
-     * Experimental proprietary WWW-Authentication challenge protocol.
-     * WWW-Authentication: X-Text-Form-Challenge callback="{url}" param="{param-name}" label="{param-display-label}"
-     *
-     * @param redirectUri
-     * @return
-     * @throws IOException
-     * @throws ServerRequest.HttpFailure
-     * @throws VerificationException
-     */
-    public boolean loginCommandLine(String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
-        String authUrl = deployment.getAuthUrl().clone()
-                .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
-                .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
-                .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
-                .queryParam("display", "console")
-                .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
-                .build().toString();
-        ResteasyClient client = createResteasyClient();
-        try {
-            //System.err.println("initial request");
-            Response response = client.target(authUrl).request().get();
-            while (true) {
-                if (response.getStatus() == 403) {
-                    if (response.getMediaType() != null) {
-                        String splash = response.readEntity(String.class);
-                        console().writer().println(splash);
-                    } else {
-                        System.err.println("Forbidden to login");
-                    }
-                    return false;
-                } else if (response.getStatus() == 401) {
-                    String authenticationHeader = response.getHeaderString(HttpHeaders.WWW_AUTHENTICATE);
-                    if (authenticationHeader == null) {
-                        System.err.println("Failure:  Invalid protocol.  No WWW-Authenticate header");
-                        return false;
-                    }
-                    //System.err.println("got header: " + authenticationHeader);
-                    if (!authenticationHeader.contains("X-Text-Form-Challenge")) {
-                        System.err.println("Failure:  Invalid WWW-Authenticate header.");
-                        return false;
-                    }
-                    if (response.getMediaType() != null) {
-                        String splash = response.readEntity(String.class);
-                        console().writer().println(splash);
-                    } else {
-                        response.close();
-                    }
-                    Matcher m = callbackPattern.matcher(authenticationHeader);
-                    if (!m.find()) {
-                        System.err.println("Failure: Invalid WWW-Authenticate header.");
-                        return false;
-                    }
-                    String callback = m.group(1);
-                    //System.err.println("callback: " + callback);
-                    m = paramPattern.matcher(authenticationHeader);
-                    Form form = new Form();
-                    while (m.find()) {
-                        String param = m.group(1);
-                        String label = m.group(2);
-                        String mask = m.group(3).trim();
-                        boolean maskInput = mask.equals("true");
-                        String value = null;
-                        if (maskInput) {
-                            char[] txt = console().readPassword(label);
-                            value = new String(txt);
-                        } else {
-                            value = console().readLine(label);
-                        }
-                        form.param(param, value);
-                    }
-                    response.close();
-                    client.close();
-                    client = createResteasyClient();
-                    response = client.target(callback).request().post(Entity.form(form));
-                } else if (response.getStatus() == 302) {
-                    int redirectCount = 0;
-                    do {
-                        String location = response.getLocation().toString();
-                        Matcher m = codePattern.matcher(location);
-                        if (!m.find()) {
-                            response.close();
-                            client.close();
-                            client = createResteasyClient();
-                            response = client.target(location).request().get();
-                        } else {
-                            response.close();
-                            client.close();
-                            String code = m.group(1);
-                            processCode(code, redirectUri);
-                            return true;
-                        }
-                        if (response.getStatus() == 302 && redirectCount++ > 4) {
-                            System.err.println("Too many redirects.  Aborting");
-                            return false;
-                        }
-                    } while (response.getStatus() == 302);
-                } else {
-                    System.err.println("Unknown response from server: " + response.getStatus());
-                    return false;
-                }
-            }
-        } catch (Exception ex) {
-            throw ex;
-        } finally {
-            client.close();
-
-        }
-    }
-
-    protected ResteasyClient getResteasyClient() {
-        if (this.resteasyClient == null) {
-            this.resteasyClient = createResteasyClient();
-        }
-        return this.resteasyClient;
-    }
-
-    protected ResteasyClient createResteasyClient() {
-        return new ResteasyClientBuilder()
-                .connectionCheckoutTimeout(1, TimeUnit.HOURS)
-                .connectionTTL(1, TimeUnit.HOURS)
-                .socketTimeout(1, TimeUnit.HOURS)
-                .disableTrustManager().build();
-    }
-
-
     public String getTokenString() throws VerificationException, IOException, ServerRequest.HttpFailure {
         return tokenString;
     }
@@ -525,7 +308,7 @@ public class KeycloakInstalled {
         parseAccessToken(tokenResponse);
     }
 
-    public void refreshToken(String refreshToken) throws IOException, ServerRequest.HttpFailure, VerificationException {
+    public void refreshToken(String refreshToken)  throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeRefresh(deployment, refreshToken);
         parseAccessToken(tokenResponse);
 
@@ -577,6 +360,7 @@ public class KeycloakInstalled {
     }
 
 
+
     private void processCode(String code, String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, redirectUri, null);
         parseAccessToken(tokenResponse);
@@ -651,26 +435,11 @@ public class KeycloakInstalled {
 
                 OutputStreamWriter out = new OutputStreamWriter(socket.getOutputStream());
                 PrintWriter pw = new PrintWriter(out);
-                if (writer != null) {
-                    System.err.println("Using a writer is deprecated.  Please remove its usage.  This is now handled by endpoint on server");
-                }
 
                 if (error == null) {
-                     if (writer != null) {
-                         writer.success(pw, KeycloakInstalled.this);
-                     } else {
-                         pw.println("HTTP/1.1 302 Found");
-                         pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated"));
-
-                     }
+                    writer.success(pw, KeycloakInstalled.this);
                 } else {
-                    if (writer != null) {
-                        writer.failure(pw, KeycloakInstalled.this);
-                    } else {
-                        pw.println("HTTP/1.1 302 Found");
-                        pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated?error=true"));
-
-                    }
+                    writer.failure(pw, KeycloakInstalled.this);
                 }
                 pw.flush();
                 socket.close();

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -27,9 +27,6 @@ import javax.security.cert.X509Certificate;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.SecurityContext;
-
-import java.io.BufferedInputStream;
-import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.List;
@@ -54,8 +51,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
     protected class RequestFacade implements OIDCHttpFacade.Request {
 
-        private InputStream inputStream;
-
         @Override
         public String getFirstParam(String param) {
             throw new RuntimeException("NOT IMPLEMENTED");
@@ -113,19 +108,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
         @Override
         public InputStream getInputStream() {
-            return getInputStream(false);
-        }
-
-        @Override
-        public InputStream getInputStream(boolean buffered) {
-            if (inputStream != null) {
-                return inputStream;
-            }
-
-            if (buffered) {
-                return inputStream = new BufferedInputStream(requestContext.getEntityStream());
-            }
-
             return requestContext.getEntityStream();
         }
 

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Jetty Integration</name>
@@ -33,7 +33,6 @@
     <modules>
         <module>jetty-core</module>
         <module>jetty8.1</module>
-        <module>jetty9.1</module>
         <module>jetty9.2</module>
         <module>jetty9.3</module>
     </modules>
@@ -47,6 +46,7 @@
                 </property>
             </activation>
             <modules>
+                <module>jetty9.1</module>
                 <module>jetty9.4</module>
             </modules>
         </profile>

adapters/oidc/js/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/js/src/main/resources/keycloak-authz.js

@@ -18,14 +18,14 @@
 
 (function( window, undefined ) {
 
-    var KeycloakAuthorization = function (keycloak, options) {
+    var KeycloakAuthorization = function (keycloak) {
         var _instance = this;
         this.rpt = null;
 
         this.init = function () {
             var request = new XMLHttpRequest();
 
-            request.open('GET', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/.well-known/uma2-configuration');
+            request.open('GET', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/.well-known/uma-configuration');
             request.onreadystatechange = function () {
                 if (request.readyState == 4) {
                     if (request.status == 200) {
@@ -47,61 +47,68 @@
          * necessary information to ask a Keycloak server for authorization data using both UMA and Entitlement protocol,
          * depending on how the policy enforcer at the resource server was configured.
          */
-        this.authorize = function (authorizationRequest) {
+        this.authorize = function (wwwAuthenticateHeader) {
             this.then = function (onGrant, onDeny, onError) {
-                if (authorizationRequest && authorizationRequest.ticket) {
-                    var request = new XMLHttpRequest();
+                if (wwwAuthenticateHeader.indexOf('UMA') != -1) {
+                    var params = wwwAuthenticateHeader.split(',');
 
-                    request.open('POST', _instance.config.token_endpoint, true);
-                    request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
-                    request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token);
+                    for (i = 0; i < params.length; i++) {
+                        var param = params[i].split('=');
 
-                    request.onreadystatechange = function () {
-                        if (request.readyState == 4) {
-                            var status = request.status;
+                        if (param[0] == 'ticket') {
+                            var request = new XMLHttpRequest();
 
-                            if (status >= 200 && status < 300) {
-                                var rpt = JSON.parse(request.responseText).access_token;
-                                _instance.rpt = rpt;
-                                onGrant(rpt);
-                            } else if (status == 403) {
-                                if (onDeny) {
-                                    onDeny();
-                                } else {
-                                    console.error('Authorization request was denied by the server.');
+                            request.open('POST', _instance.config.rpt_endpoint, true);
+                            request.setRequestHeader('Content-Type', 'application/json')
+                            request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token)
+
+                            request.onreadystatechange = function () {
+                                if (request.readyState == 4) {
+                                    var status = request.status;
+
+                                    if (status >= 200 && status < 300) {
+                                        var rpt = JSON.parse(request.responseText).rpt;
+                                        _instance.rpt = rpt;
+                                        onGrant(rpt);
+                                    } else if (status == 403) {
+                                        if (onDeny) {
+                                            onDeny();
+                                        } else {
+                                            console.error('Authorization request was denied by the server.');
+                                        }
+                                    } else {
+                                        if (onError) {
+                                            onError();
+                                        } else {
+                                            console.error('Could not obtain authorization data from server.');
+                                        }
+                                    }
                                 }
-                            } else {
-                                if (onError) {
-                                    onError();
-                                } else {
-                                    console.error('Could not obtain authorization data from server.');
+                            };
+
+                            var ticket = param[1].substring(1, param[1].length - 1).trim();
+
+                            request.send(JSON.stringify(
+                                {
+                                    ticket: ticket,
+                                    rpt: _instance.rpt
                                 }
-                            }
+                            ));
                         }
-                    };
-
-                    var params = "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&client_id=" + keycloak.clientId + "&ticket=" + authorizationRequest.ticket;
-
-                    if (authorizationRequest.submitRequest != undefined) {
-                        params += "&submit_request=" + authorizationRequest.submitRequest;
                     }
+                } else if (wwwAuthenticateHeader.indexOf('KC_ETT') != -1) {
+                    var params = wwwAuthenticateHeader.substring('KC_ETT'.length).trim().split(',');
+                    var clientId = null;
 
-                    var metadata = authorizationRequest.metadata;
+                    for (i = 0; i < params.length; i++) {
+                        var param = params[i].split('=');
 
-                    if (metadata) {
-                        if (metadata.responseIncludeResourceName) {
-                            params += "&response_include_resource_name=" + metadata.responseIncludeResourceName;
-                        }
-                        if (metadata.responsePermissionsLimit) {
-                            params += "&response_permissions_limit=" + metadata.responsePermissionsLimit;
+                        if (param[0] == 'realm') {
+                            clientId = param[1].substring(1, param[1].length - 1).trim();
                         }
                     }
 
-                    if (_instance.rpt && (authorizationRequest.incrementalAuthorization == undefined || authorizationRequest.incrementalAuthorization)) {
-                        params += "&rpt=" + _instance.rpt;
-                    }
-
-                    request.send(params);
+                    _instance.entitlement(clientId).then(onGrant, onDeny, onError);
                 }
             };
 
@@ -109,22 +116,20 @@
         };
 
         /**
-         * Obtains all entitlements from a Keycloak Server based on a given resourceServerId.
+         * Obtains all entitlements from a Keycloak Server based on a give resourceServerId.
          */
-        this.entitlement = function (resourceServerId, authorizationRequest) {
+        this.entitlement = function (resourceSeververId, entitlementRequest     ) {
             this.then = function (onGrant, onDeny, onError) {
                 var request = new XMLHttpRequest();
 
-                request.open('POST', _instance.config.token_endpoint, true);
-                request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
-                request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token);
+
 
                 request.onreadystatechange = function () {
                     if (request.readyState == 4) {
                         var status = request.status;
 
                         if (status >= 200 && status < 300) {
-                            var rpt = JSON.parse(request.responseText).access_token;
+                            var rpt = JSON.parse(request.responseText).rpt;
                             _instance.rpt = rpt;
                             onGrant(rpt);
                         } else if (status == 403) {
@@ -143,62 +148,19 @@
                     }
                 };
 
-                if (!authorizationRequest) {
-                    authorizationRequest = {};
+                var erJson = null
+
+                if(entitlementRequest) {
+                    request.open('POST', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/authz/entitlement/' + resourceSeververId, true);
+                    request.setRequestHeader("Content-type", "application/json");
+                    erJson = JSON.stringify(entitlementRequest)
+                } else {
+                    request.open('GET', keycloak.authServerUrl + '/realms/' + keycloak.realm + '/authz/entitlement/' + resourceSeververId, true);
                 }
 
-                var params = "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket&client_id=" + keycloak.clientId;
+                request.setRequestHeader('Authorization', 'Bearer ' + keycloak.token)
+                request.send(erJson);
 
-                if (authorizationRequest.claimToken) {
-                    params += "&claim_token=" + authorizationRequest.claimToken;
-
-                    if (authorizationRequest.claimTokenFormat) {
-                        params += "&claim_token_format=" + authorizationRequest.claimTokenFormat;
-                    }
-                }
-
-                params += "&audience=" + resourceServerId;
-
-                var permissions = authorizationRequest.permissions;
-
-                if (!permissions) {
-                    permissions = [];
-                }
-
-                for (i = 0; i < permissions.length; i++) {
-                    var resource = permissions[i];
-                    var permission = resource.id;
-
-                    if (resource.scopes && resource.scopes.length > 0) {
-                        permission += "#";
-                        for (j = 0; j < resource.scopes.length; j++) {
-                            var scope = resource.scopes[j];
-                            if (permission.indexOf('#') != permission.length - 1) {
-                                permission += ",";
-                            }
-                            permission += scope;
-                        }
-                    }
-
-                    params += "&permission=" + permission;
-                }
-
-                var metadata = authorizationRequest.metadata;
-
-                if (metadata) {
-                    if (metadata.responseIncludeResourceName) {
-                        params += "&response_include_resource_name=" + metadata.responseIncludeResourceName;
-                    }
-                    if (metadata.responsePermissionsLimit) {
-                        params += "&response_permissions_limit=" + metadata.responsePermissionsLimit;
-                    }
-                }
-
-                if (_instance.rpt) {
-                    params += "&rpt=" + _instance.rpt;
-                }
-
-                request.send(params);
             };
 
             return this;

adapters/oidc/js/src/main/resources/keycloak.d.ts

@@ -1,495 +1,478 @@
-/*
- * MIT License
- *
- * Copyright 2017 Brett Epps <https://github.com/eppsilon>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
- * associated documentation files (the "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
- * following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all copies or substantial
- * portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
- * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
- * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-export as namespace Keycloak;
-
-export = Keycloak;
-
-/**
- * Creates a new Keycloak client instance.
- * @param config Path to a JSON config file or a plain config object.
- */
-declare function Keycloak(config?: string|{}): Keycloak.KeycloakInstance;
-
-declare namespace Keycloak {
-	type KeycloakAdapterName = 'cordova'|'default' | any;
-	type KeycloakOnLoad = 'login-required'|'check-sso';
-	type KeycloakResponseMode = 'query'|'fragment';
-	type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
-	type KeycloakFlow = 'standard'|'implicit'|'hybrid';
-
-	interface KeycloakInitOptions {
-		/**
-		 * @private Undocumented.
-		 */
-		useNonce?: boolean;
-
-		/**
-		 * Allows to use different adapter:
-		 * 
-		 * - {string} default - using browser api for redirects
-		 * - {string} cordova - using cordova plugins 
-		 * - {function} - allows to provide custom function as adapter.
-		 */
-		adapter?: KeycloakAdapterName;
-		
-		/**
-		 * Specifies an action to do on load.
-		 */
-		onLoad?: KeycloakOnLoad;
-
-		/**
-		 * Set an initial value for the token.
-		 */
-		token?: string;
-
-		/**
-		 * Set an initial value for the refresh token.
-		 */
-		refreshToken?: string;
-
-		/**
-		 * Set an initial value for the id token (only together with `token` or
-		 * `refreshToken`).
-		 */
-		idToken?: string;
-
-		/**
-		 * Set an initial value for skew between local time and Keycloak server in
-		 * seconds (only together with `token` or `refreshToken`).
-		 */
-		timeSkew?: number;
-
-		/**
-		 * Set to enable/disable monitoring login state.
-		 * @default true
-		 */
-		checkLoginIframe?: boolean;
-
-		/**
-		 * Set the interval to check login state (in seconds).
-		 * @default 5
-		 */
-		checkLoginIframeInterval?: number;
-
-		/**
-		 * Set the OpenID Connect response mode to send to Keycloak upon login.
-		 * @default fragment After successful authentication Keycloak will redirect
-		 *                   to JavaScript application with OpenID Connect parameters
-		 *                   added in URL fragment. This is generally safer and
-		 *                   recommended over query.
-		 */
-		responseMode?: KeycloakResponseMode;
-
-		/**
-		 * Set the OpenID Connect flow.
-		 * @default standard
-		 */
-		flow?: KeycloakFlow;
-	}
-
-	interface KeycloakLoginOptions {
-		/**
-		 * @private Undocumented.
-		 */
-		scope?: string;
-
-		/**
-		 * Specifies the uri to redirect to after login.
-		 */
-		redirectUri?: string;
-
-		/**
-		 * By default the login screen is displayed if the user is not logged into
-		 * Keycloak. To only authenticate to the application if the user is already
-		 * logged in and not display the login page if the user is not logged in, set
-		 * this option to `'none'`. To always require re-authentication and ignore
-		 * SSO, set this option to `'login'`.
-		 */
-		prompt?: 'none'|'login';
-
-		/**
-		 * If value is `'register'` then user is redirected to registration page,
-		 * otherwise to login page.
-		 */
-		action?: 'register';
-
-		/**
-		 * Used just if user is already authenticated. Specifies maximum time since
-		 * the authentication of user happened. If user is already authenticated for
-		 * longer time than `'maxAge'`, the SSO is ignored and he will need to
-		 * authenticate again.
-		 */
-		maxAge?: number;
-
-		/**
-		 * Used to pre-fill the username/email field on the login form.
-		 */
-		loginHint?: string;
-
-		/**
-		 * Used to tell Keycloak which IDP the user wants to authenticate with.
-		 */
-		idpHint?: string;
-
-	        /**
-		 * Sets the 'ui_locales' query param in compliance with section 3.1.2.1
-                 * of the OIDC 1.0 specification.
-		 */
-		locale?: string;
-                
-                /**
-		 * Specifies the desired Keycloak locale for the UI.  This differs from
-                 * the locale param in that it tells the Keycloak server to set a cookie and update
-                 * the user's profile to a new preferred locale.
-		 */
-		kcLocale?: string;
-	}
-
-	type KeycloakPromiseCallback<T> = (result: T) => void;
-
-	interface KeycloakPromise<TSuccess, TError> {
-		/**
-		 * Function to call if the promised action succeeds.
-		 */
-		success(callback: KeycloakPromiseCallback<TSuccess>): KeycloakPromise<TSuccess, TError>;
-
-		/**
-		 * Function to call if the promised action throws an error.
-		 */
-		error(callback: KeycloakPromiseCallback<TError>): KeycloakPromise<TSuccess, TError>;
-	}
-
-	interface KeycloakError {
-		error: string;
-		error_description: string;
-	}
-
-	interface KeycloakAdapter {
-		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-		logout(options?: any): KeycloakPromise<void, void>;
-		register(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-		accountManagement(): KeycloakPromise<void, void>;
-		redirectUri(options: { redirectUri: string; }, encodeHash: boolean): string;
-	}
-
-	interface KeycloakProfile {
-		id?: string;
-		username?: string;
-		email?: string;
-		firstName?: string;
-		lastName?: string;
-		enabled?: boolean;
-		emailVerified?: boolean;
-		totp?: boolean;
-		createdTimestamp?: number;
-	}
-
-	// export interface KeycloakUserInfo {}
-
-	/**
-	 * A client for the Keycloak authentication server.
-	 * @see {@link https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html|Keycloak JS adapter documentation}
-	 */
-	interface KeycloakInstance {
-		/**
-		 * Is true if the user is authenticated, false otherwise.
-		 */
-		authenticated?: boolean;
-
-		/**
-		 * The user id.
-		 */
-		subject?: string;
-
-		/**
-		 * Response mode passed in init (default value is `'fragment'`).
-		 */
-		responseMode?: KeycloakResponseMode;
-
-		/**
-		 * Response type sent to Keycloak with login requests. This is determined
-		 * based on the flow value used during initialization, but can be overridden
-		 * by setting this value.
-		 */
-		responseType?: KeycloakResponseType;
-
-		/**
-		 * Flow passed in init.
-		 */
-		flow?: KeycloakFlow;
-
-		/**
-		 * The realm roles associated with the token.
-		 */
-		realmAccess?: { roles: string[] };
-
-		/**
-		 * The resource roles associated with the token.
-		 */
-		resourceAccess?: string[];
-
-		/**
-		 * The base64 encoded token that can be sent in the Authorization header in
-		 * requests to services.
-		 */
-		token?: string;
-
-		/**
-		 * The parsed token as a JavaScript object.
-		 */
-		tokenParsed?: {
-			exp?: number;
-			iat?: number;
-			nonce?: string;
-			sub?: string;
-			session_state?: string;
-			realm_access?: { roles: string[] };
-			resource_access?: string[];
-		};
-
-		/**
-		 * The base64 encoded refresh token that can be used to retrieve a new token.
-		 */
-		refreshToken?: string;
-
-		/**
-		 * The parsed refresh token as a JavaScript object.
-		 */
-		refreshTokenParsed?: { nonce?: string };
-
-		/**
-		 * The base64 encoded ID token.
-		 */
-		idToken?: string;
-
-		/**
-		 * The parsed id token as a JavaScript object.
-		 */
-		idTokenParsed?: { nonce?: string };
-
-		/**
-		 * The estimated time difference between the browser time and the Keycloak
-		 * server in seconds. This value is just an estimation, but is accurate
-		 * enough when determining if a token is expired or not.
-		 */
-		timeSkew?: number;
-
-		/**
-		 * @private Undocumented.
-		 */
-		loginRequired?: boolean;
-
-		/**
-		 * @private Undocumented.
-		 */
-		authServerUrl?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		realm?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		clientId?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		clientSecret?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		redirectUri?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		sessionId?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		profile?: KeycloakProfile;
-
-		/**
-		 * @private Undocumented.
-		 */
-		userInfo?: {}; // KeycloakUserInfo;
-
-		/**
-		 * Called when the adapter is initialized.
-		 */
-		onReady?(authenticated?: boolean): void;
-
-		/**
-		 * Called when a user is successfully authenticated.
-		 */
-		onAuthSuccess?(): void;
-
-		/**
-		 * Called if there was an error during authentication.
-		 */
-		onAuthError?(errorData: KeycloakError): void;
-
-		/**
-		 * Called when the token is refreshed.
-		 */
-		onAuthRefreshSuccess?(): void;
-
-		/**
-		 * Called if there was an error while trying to refresh the token.
-		 */
-		onAuthRefreshError?(): void;
-
-		/**
-		 * Called if the user is logged out (will only be called if the session
-		 * status iframe is enabled, or in Cordova mode).
-		 */
-		onAuthLogout?(): void;
-
-		/**
-		 * Called when the access token is expired. If a refresh token is available
-		 * the token can be refreshed with Keycloak#updateToken, or in cases where
-		 * it's not (ie. with implicit flow) you can redirect to login screen to
-		 * obtain a new access token.
-		 */
-		onTokenExpired?(): void;
-
-		/**
-		 * Called to initialize the adapter.
-		 * @param initOptions Initialization options.
-		 * @returns A promise to set functions to be invoked on success or error.
-		 */
-		init(initOptions: KeycloakInitOptions): KeycloakPromise<boolean, KeycloakError>;
-
-		/**
-		 * Redirects to login form.
-		 * @param options Login options.
-		 */
-		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to logout.
-		 * @param options Logout options.
-		 * @param options.redirectUri Specifies the uri to redirect to after logout.
-		 */
-		logout(options?: any): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to registration form.
-		 * @param options Supports same options as Keycloak#login but `action` is
-		 *                set to `'register'`.
-		 */
-		register(options?: any): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to the Account Management Console.
-		 */
-		accountManagement(): KeycloakPromise<void, void>;
-
-		/**
-		 * Returns the URL to login form.
-		 * @param options Supports same options as Keycloak#login.
-		 */
-		createLoginUrl(options?: KeycloakLoginOptions): string;
-
-		/**
-		 * Returns the URL to logout the user.
-		 * @param options Logout options.
-		 * @param options.redirectUri Specifies the uri to redirect to after logout.
-		 */
-		createLogoutUrl(options?: any): string;
-
-		/**
-		 * Returns the URL to registration page.
-		 * @param options Supports same options as Keycloak#createLoginUrl but
-		 *                `action` is set to `'register'`.
-		 */
-		createRegisterUrl(options?: KeycloakLoginOptions): string;
-
-		/**
-		 * Returns the URL to the Account Management Console.
-		 */
-		createAccountUrl(): string;
-
-		/**
-		 * Returns true if the token has less than `minValidity` seconds left before
-		 * it expires.
-		 * @param minValidity If not specified, `0` is used.
-		 */
-		isTokenExpired(minValidity?: number): boolean;
-
-		/**
-		 * If the token expires within `minValidity` seconds, the token is refreshed.
-		 * If the session status iframe is enabled, the session status is also
-		 * checked.
-		 * @returns A promise to set functions that can be invoked if the token is
-		 *          still valid, or if the token is no longer valid.
-		 * @example
-		 * ```js
-		 * keycloak.updateToken(5).success(function(refreshed) {
-		 *   if (refreshed) {
-		 *     alert('Token was successfully refreshed');
-		 *   } else {
-		 *     alert('Token is still valid');
-		 *   }
-		 * }).error(function() {
-		 *   alert('Failed to refresh the token, or the session has expired');
-		 * });
-		 */
-		updateToken(minValidity: number): KeycloakPromise<boolean, boolean>;
-
-		/**
-		 * Clears authentication state, including tokens. This can be useful if
-		 * the application has detected the session was expired, for example if
-		 * updating token fails. Invoking this results in Keycloak#onAuthLogout
-		 * callback listener being invoked.
-		 */
-		clearToken(): void;
-
-		/**
-		 * Returns true if the token has the given realm role.
-		 * @param role A realm role name.
-		 */
-		hasRealmRole(role: string): boolean;
-
-		/**
-		 * Returns true if the token has the given role for the resource.
-		 * @param role A role name.
-		 * @param resource If not specified, `clientId` is used.
-		 */
-		hasResourceRole(role: string, resource?: string): boolean;
-
-		/**
-		 * Loads the user's profile.
-		 * @returns A promise to set functions to be invoked on success or error.
-		 */
-		loadUserProfile(): KeycloakPromise<KeycloakProfile, void>;
-
-		/**
-		 * @private Undocumented.
-		 */
-		loadUserInfo(): KeycloakPromise<{}, void>;
-	}
-}
+/*
+ * MIT License
+ *
+ * Copyright 2017 Brett Epps <https://github.com/eppsilon>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+ * associated documentation files (the "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+ * following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+ * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+ * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+export as namespace Keycloak;
+
+export = Keycloak;
+
+/**
+ * Creates a new Keycloak client instance.
+ * @param config Path to a JSON config file or a plain config object.
+ */
+declare function Keycloak(config?: string|{}): Keycloak.KeycloakInstance;
+
+declare namespace Keycloak {
+	type KeycloakAdapterName = 'cordova'|'default';
+	type KeycloakOnLoad = 'login-required'|'check-sso';
+	type KeycloakResponseMode = 'query'|'fragment';
+	type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
+	type KeycloakFlow = 'standard'|'implicit'|'hybrid';
+
+	interface KeycloakInitOptions {
+		/**
+		 * @private Undocumented.
+		 */
+		adapter?: KeycloakAdapterName;
+
+		/**
+		 * Specifies an action to do on load.
+		 */
+		onLoad?: KeycloakOnLoad;
+
+		/**
+		 * Set an initial value for the token.
+		 */
+		token?: string;
+
+		/**
+		 * Set an initial value for the refresh token.
+		 */
+		refreshToken?: string;
+
+		/**
+		 * Set an initial value for the id token (only together with `token` or
+		 * `refreshToken`).
+		 */
+		idToken?: string;
+
+		/**
+		 * Set an initial value for skew between local time and Keycloak server in
+		 * seconds (only together with `token` or `refreshToken`).
+		 */
+		timeSkew?: number;
+
+		/**
+		 * Set to enable/disable monitoring login state.
+		 * @default true
+		 */
+		checkLoginIframe?: boolean;
+
+		/**
+		 * Set the interval to check login state (in seconds).
+		 * @default 5
+		 */
+		checkLoginIframeInterval?: boolean;
+
+		/**
+		 * Set the OpenID Connect response mode to send to Keycloak upon login.
+		 * @default fragment After successful authentication Keycloak will redirect
+		 *                   to JavaScript application with OpenID Connect parameters
+		 *                   added in URL fragment. This is generally safer and
+		 *                   recommended over query.
+		 */
+		responseMode?: KeycloakResponseMode;
+
+		/**
+		 * Set the OpenID Connect flow.
+		 * @default standard
+		 */
+		flow?: KeycloakFlow;
+	}
+
+	interface KeycloakLoginOptions {
+		/**
+		 * @private Undocumented.
+		 */
+		scope?: string;
+
+		/**
+		 * Specifies the uri to redirect to after login.
+		 */
+		redirectUri?: string;
+
+		/**
+		 * By default the login screen is displayed if the user is not logged into
+		 * Keycloak. To only authenticate to the application if the user is already
+		 * logged in and not display the login page if the user is not logged in, set
+		 * this option to `'none'`. To always require re-authentication and ignore
+		 * SSO, set this option to `'login'`.
+		 */
+		prompt?: 'none'|'login';
+
+		/**
+		 * If value is `'register'` then user is redirected to registration page,
+		 * otherwise to login page.
+		 */
+		action?: 'register';
+
+		/**
+		 * Used just if user is already authenticated. Specifies maximum time since
+		 * the authentication of user happened. If user is already authenticated for
+		 * longer time than `'maxAge'`, the SSO is ignored and he will need to
+		 * authenticate again.
+		 */
+		maxAge?: number;
+
+		/**
+		 * Used to pre-fill the username/email field on the login form.
+		 */
+		loginHint?: string;
+
+		/**
+		 * Used to tell Keycloak which IDP the user wants to authenticate with.
+		 */
+		idpHint?: string;
+
+		/**
+		 * Specifies the desired locale for the UI.
+		 */
+		locale?: string;
+	}
+
+	type KeycloakPromiseCallback<T> = (result: T) => void;
+
+	interface KeycloakPromise<TSuccess, TError> {
+		/**
+		 * Function to call if the promised action succeeds.
+		 */
+		success(callback: KeycloakPromiseCallback<TSuccess>): KeycloakPromise<TSuccess, TError>;
+
+		/**
+		 * Function to call if the promised action throws an error.
+		 */
+		error(callback: KeycloakPromiseCallback<TError>): KeycloakPromise<TSuccess, TError>;
+	}
+
+	interface KeycloakError {
+		error: string;
+		error_description: string;
+	}
+
+	interface KeycloakAdapter {
+		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+		logout(options?: any): KeycloakPromise<void, void>;
+		register(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+		accountManagement(): KeycloakPromise<void, void>;
+		redirectUri(options: { redirectUri: string; }, encodeHash: boolean): string;
+	}
+
+	interface KeycloakProfile {
+		id?: string;
+		username?: string;
+		email?: string;
+		firstName?: string;
+		lastName?: string;
+		enabled?: boolean;
+		emailVerified?: boolean;
+		totp?: boolean;
+		createdTimestamp?: number;
+	}
+
+	// export interface KeycloakUserInfo {}
+
+	/**
+	 * A client for the Keycloak authentication server.
+	 * @see {@link https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html|Keycloak JS adapter documentation}
+	 */
+	interface KeycloakInstance {
+		/**
+		 * Is true if the user is authenticated, false otherwise.
+		 */
+		authenticated?: boolean;
+
+		/**
+		 * The user id.
+		 */
+		subject?: string;
+
+		/**
+		 * Response mode passed in init (default value is `'fragment'`).
+		 */
+		responseMode?: KeycloakResponseMode;
+
+		/**
+		 * Response type sent to Keycloak with login requests. This is determined
+		 * based on the flow value used during initialization, but can be overridden
+		 * by setting this value.
+		 */
+		responseType?: KeycloakResponseType;
+
+		/**
+		 * Flow passed in init.
+		 */
+		flow?: KeycloakFlow;
+
+		/**
+		 * The realm roles associated with the token.
+		 */
+		realmAccess?: { roles: string[] };
+
+		/**
+		 * The resource roles associated with the token.
+		 */
+		resourceAccess?: string[];
+
+		/**
+		 * The base64 encoded token that can be sent in the Authorization header in
+		 * requests to services.
+		 */
+		token?: string;
+
+		/**
+		 * The parsed token as a JavaScript object.
+		 */
+		tokenParsed?: {
+			exp?: number;
+			iat?: number;
+			nonce?: string;
+			sub?: string;
+			session_state?: string;
+			realm_access?: { roles: string[] };
+			resource_access?: string[];
+		};
+
+		/**
+		 * The base64 encoded refresh token that can be used to retrieve a new token.
+		 */
+		refreshToken?: string;
+
+		/**
+		 * The parsed refresh token as a JavaScript object.
+		 */
+		refreshTokenParsed?: { nonce?: string };
+
+		/**
+		 * The base64 encoded ID token.
+		 */
+		idToken?: string;
+
+		/**
+		 * The parsed id token as a JavaScript object.
+		 */
+		idTokenParsed?: { nonce?: string };
+
+		/**
+		 * The estimated time difference between the browser time and the Keycloak
+		 * server in seconds. This value is just an estimation, but is accurate
+		 * enough when determining if a token is expired or not.
+		 */
+		timeSkew?: number;
+
+		/**
+		 * @private Undocumented.
+		 */
+		loginRequired?: boolean;
+
+		/**
+		 * @private Undocumented.
+		 */
+		authServerUrl?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		realm?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		clientId?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		clientSecret?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		redirectUri?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		sessionId?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		profile?: KeycloakProfile;
+
+		/**
+		 * @private Undocumented.
+		 */
+		userInfo?: {}; // KeycloakUserInfo;
+
+		/**
+		 * Called when the adapter is initialized.
+		 */
+		onReady?(authenticated?: boolean): void;
+
+		/**
+		 * Called when a user is successfully authenticated.
+		 */
+		onAuthSuccess?(): void;
+
+		/**
+		 * Called if there was an error during authentication.
+		 */
+		onAuthError?(errorData: KeycloakError): void;
+
+		/**
+		 * Called when the token is refreshed.
+		 */
+		onAuthRefreshSuccess?(): void;
+
+		/**
+		 * Called if there was an error while trying to refresh the token.
+		 */
+		onAuthRefreshError?(): void;
+
+		/**
+		 * Called if the user is logged out (will only be called if the session
+		 * status iframe is enabled, or in Cordova mode).
+		 */
+		onAuthLogout?(): void;
+
+		/**
+		 * Called when the access token is expired. If a refresh token is available
+		 * the token can be refreshed with Keycloak#updateToken, or in cases where
+		 * it's not (ie. with implicit flow) you can redirect to login screen to
+		 * obtain a new access token.
+		 */
+		onTokenExpired?(): void;
+
+		/**
+		 * Called to initialize the adapter.
+		 * @param initOptions Initialization options.
+		 * @returns A promise to set functions to be invoked on success or error.
+		 */
+		init(initOptions: KeycloakInitOptions): KeycloakPromise<boolean, KeycloakError>;
+
+		/**
+		 * Redirects to login form.
+		 * @param options Login options.
+		 */
+		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to logout.
+		 * @param options Logout options.
+		 * @param options.redirectUri Specifies the uri to redirect to after logout.
+		 */
+		logout(options?: any): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to registration form.
+		 * @param options Supports same options as Keycloak#login but `action` is
+		 *                set to `'register'`.
+		 */
+		register(options?: any): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to the Account Management Console.
+		 */
+		accountManagement(): KeycloakPromise<void, void>;
+
+		/**
+		 * Returns the URL to login form.
+		 * @param options Supports same options as Keycloak#login.
+		 */
+		createLoginUrl(options?: KeycloakLoginOptions): string;
+
+		/**
+		 * Returns the URL to logout the user.
+		 * @param options Logout options.
+		 * @param options.redirectUri Specifies the uri to redirect to after logout.
+		 */
+		createLogoutUrl(options?: any): string;
+
+		/**
+		 * Returns the URL to registration page.
+		 * @param options Supports same options as Keycloak#createLoginUrl but
+		 *                `action` is set to `'register'`.
+		 */
+		createRegisterUrl(options?: KeycloakLoginOptions): string;
+
+		/**
+		 * Returns the URL to the Account Management Console.
+		 */
+		createAccountUrl(): string;
+
+		/**
+		 * Returns true if the token has less than `minValidity` seconds left before
+		 * it expires.
+		 * @param minValidity If not specified, `0` is used.
+		 */
+		isTokenExpired(minValidity?: number): boolean;
+
+		/**
+		 * If the token expires within `minValidity` seconds, the token is refreshed.
+		 * If the session status iframe is enabled, the session status is also
+		 * checked.
+		 * @returns A promise to set functions that can be invoked if the token is
+		 *          still valid, or if the token is no longer valid.
+		 * @example
+		 * ```js
+		 * keycloak.updateToken(5).success(function(refreshed) {
+		 *   if (refreshed) {
+		 *     alert('Token was successfully refreshed');
+		 *   } else {
+		 *     alert('Token is still valid');
+		 *   }
+		 * }).error(function() {
+		 *   alert('Failed to refresh the token, or the session has expired');
+		 * });
+		 */
+		updateToken(minValidity: number): KeycloakPromise<boolean, boolean>;
+
+		/**
+		 * Clears authentication state, including tokens. This can be useful if
+		 * the application has detected the session was expired, for example if
+		 * updating token fails. Invoking this results in Keycloak#onAuthLogout
+		 * callback listener being invoked.
+		 */
+		clearToken(): void;
+
+		/**
+		 * Returns true if the token has the given realm role.
+		 * @param role A realm role name.
+		 */
+		hasRealmRole(role: string): boolean;
+
+		/**
+		 * Returns true if the token has the given role for the resource.
+		 * @param role A role name.
+		 * @param resource If not specified, `clientId` is used.
+		 */
+		hasResourceRole(role: string, resource?: string): boolean;
+
+		/**
+		 * Loads the user's profile.
+		 * @returns A promise to set functions to be invoked on success or error.
+		 */
+		loadUserProfile(): KeycloakPromise<KeycloakProfile, void>;
+
+		/**
+		 * @private Undocumented.
+		 */
+		loadUserInfo(): KeycloakPromise<{}, void>;
+	}
+}

adapters/oidc/js/src/main/resources/keycloak.js

@@ -40,8 +40,6 @@
             }
         }
 
-        var useNonce = true;
-        
         kc.init = function (initOptions) {
             kc.authenticated = false;
 
@@ -51,10 +49,8 @@
                 adapter = loadAdapter('cordova');
             } else if (initOptions && initOptions.adapter === 'default') {
                 adapter = loadAdapter();
-            } else if (initOptions && typeof initOptions.adapter === "object") {
-                adapter = initOptions.adapter;
             } else {
-                if (window.Cordova || window.cordova) {
+                if (window.Cordova) {
                     adapter = loadAdapter('cordova');
                 } else {
                     adapter = loadAdapter();
@@ -62,10 +58,6 @@
             }
 
             if (initOptions) {
-                if (typeof initOptions.useNonce !== 'undefined') {
-                    useNonce = initOptions.useNonce;
-                }
-
                 if (typeof initOptions.checkLoginIframe !== 'undefined') {
                     loginIframe.enable = initOptions.checkLoginIframe;
                 }
@@ -167,15 +159,10 @@
                 var callback = parseCallback(window.location.href);
 
                 if (callback) {
+                    setupCheckLoginIframe();
                     window.history.replaceState({}, null, callback.newUrl);
-                }
-
-                if (callback && callback.valid) {
-                    return setupCheckLoginIframe().success(function() {
-                        processCallback(callback, initPromise);
-                    }).error(function (e) {
-                        initPromise.setError();
-                    });
+                    processCallback(callback, initPromise);
+                    return;
                 } else if (initOptions) {
                     if (initOptions.token && initOptions.refreshToken) {
                         setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
@@ -243,25 +230,22 @@
 
             callbackStorage.add(callbackState);
 
-            var baseUrl;
+            var action = 'auth';
             if (options && options.action == 'register') {
-                baseUrl = kc.endpoints.register();
-            } else {
-                baseUrl = kc.endpoints.authorize();
+                action = 'registrations';
             }
 
             var scope = (options && options.scope) ? "openid " + options.scope : "openid";
 
-            var url = baseUrl
+            var url = getRealmUrl()
+                + '/protocol/openid-connect/' + action
                 + '?client_id=' + encodeURIComponent(kc.clientId)
                 + '&redirect_uri=' + encodeURIComponent(redirectUri)
                 + '&state=' + encodeURIComponent(state)
+                + '&nonce=' + encodeURIComponent(nonce)
                 + '&response_mode=' + encodeURIComponent(kc.responseMode)
                 + '&response_type=' + encodeURIComponent(kc.responseType)
                 + '&scope=' + encodeURIComponent(scope);
-                if (useNonce) {
-                    url = url + '&nonce=' + encodeURIComponent(nonce);
-                }
 
             if (options && options.prompt) {
                 url += '&prompt=' + encodeURIComponent(options.prompt);
@@ -282,10 +266,6 @@
             if (options && options.locale) {
                 url += '&ui_locales=' + encodeURIComponent(options.locale);
             }
-            
-            if (options && options.kcLocale) {
-                url += '&kc_locale=' + encodeURIComponent(options.kcLocale);
-            }
 
             return url;
         }
@@ -295,7 +275,8 @@
         }
 
         kc.createLogoutUrl = function(options) {
-            var url = kc.endpoints.logout()
+            var url = getRealmUrl()
+                + '/protocol/openid-connect/logout'
                 + '?redirect_uri=' + encodeURIComponent(adapter.redirectUri(options, false));
 
             return url;
@@ -314,14 +295,11 @@
         }
 
         kc.createAccountUrl = function(options) {
-            var realm = getRealmUrl();
-            var url = undefined;
-            if (typeof realm !== 'undefined') {
-                url = realm
+            var url = getRealmUrl()
                 + '/account'
                 + '?referrer=' + encodeURIComponent(kc.clientId)
                 + '&referrer_uri=' + encodeURIComponent(adapter.redirectUri(options));
-            }
+
             return url;
         }
 
@@ -369,7 +347,7 @@
         }
 
         kc.loadUserInfo = function() {
-            var url = kc.endpoints.userinfo();
+            var url = getRealmUrl() + '/protocol/openid-connect/userinfo';
             var req = new XMLHttpRequest();
             req.open('GET', url, true);
             req.setRequestHeader('Accept', 'application/json');
@@ -434,7 +412,7 @@
                     promise.setSuccess(false);
                 } else {
                     var params = 'grant_type=refresh_token&' + 'refresh_token=' + kc.refreshToken;
-                    var url = kc.endpoints.token();
+                    var url = getRealmUrl() + '/protocol/openid-connect/token';
 
                     refreshQueue.push(promise);
 
@@ -470,10 +448,6 @@
                                 } else {
                                     console.warn('[KEYCLOAK] Failed to refresh token');
 
-                                    if (req.status == 400) {
-                                        kc.clearToken();
-                                    }
-
                                     kc.onAuthRefreshError && kc.onAuthRefreshError();
                                     for (var p = refreshQueue.pop(); p != null; p = refreshQueue.pop()) {
                                         p.setError(true);
@@ -512,14 +486,10 @@
         }
 
         function getRealmUrl() {
-            if (typeof kc.authServerUrl !== 'undefined') {
-                if (kc.authServerUrl.charAt(kc.authServerUrl.length - 1) == '/') {
-                    return kc.authServerUrl + 'realms/' + encodeURIComponent(kc.realm);
-                } else {
-                    return kc.authServerUrl + '/realms/' + encodeURIComponent(kc.realm);
-                }
+            if (kc.authServerUrl.charAt(kc.authServerUrl.length - 1) == '/') {
+                return kc.authServerUrl + 'realms/' + encodeURIComponent(kc.realm);
             } else {
-            	return undefined;
+                return kc.authServerUrl + '/realms/' + encodeURIComponent(kc.realm);
             }
         }
 
@@ -553,7 +523,7 @@
 
             if ((kc.flow != 'implicit') && code) {
                 var params = 'code=' + code + '&grant_type=authorization_code';
-                var url = kc.endpoints.token();
+                var url = getRealmUrl() + '/protocol/openid-connect/token';
 
                 var req = new XMLHttpRequest();
                 req.open('POST', url, true);
@@ -590,9 +560,9 @@
 
                 setToken(accessToken, refreshToken, idToken, timeLocal);
 
-                if (useNonce && ((kc.tokenParsed && kc.tokenParsed.nonce != oauth.storedNonce) ||
+                if ((kc.tokenParsed && kc.tokenParsed.nonce != oauth.storedNonce) ||
                     (kc.refreshTokenParsed && kc.refreshTokenParsed.nonce != oauth.storedNonce) ||
-                    (kc.idTokenParsed && kc.idTokenParsed.nonce != oauth.storedNonce))) {
+                    (kc.idTokenParsed && kc.idTokenParsed.nonce != oauth.storedNonce)) {
 
                     console.info('[KEYCLOAK] Invalid nonce, clearing token');
                     kc.clearToken();
@@ -617,65 +587,6 @@
                 configUrl = config;
             }
 
-            function setupOidcEndoints(oidcConfiguration) {
-                if (! oidcConfiguration) {
-                    kc.endpoints = {
-                        authorize: function() {
-                            return getRealmUrl() + '/protocol/openid-connect/auth';
-                        },
-                        token: function() {
-                            return getRealmUrl() + '/protocol/openid-connect/token';
-                        },
-                        logout: function() {
-                            return getRealmUrl() + '/protocol/openid-connect/logout';
-                        },
-                        checkSessionIframe: function() {
-                            var src = getRealmUrl() + '/protocol/openid-connect/login-status-iframe.html';
-                            if (kc.iframeVersion) {
-                              src = src + '?version=' + kc.iframeVersion;
-                            }
-                            return src;
-                        },
-                        register: function() {
-                            return getRealmUrl() + '/protocol/openid-connect/registrations';
-                        },
-                        userinfo: function() {
-                            return getRealmUrl() + '/protocol/openid-connect/userinfo';
-                        }
-                    };
-                } else {
-                    kc.endpoints = {
-                        authorize: function() {
-                            return oidcConfiguration.authorization_endpoint;
-                        },
-                        token: function() {
-                            return oidcConfiguration.token_endpoint;
-                        },
-                        logout: function() {
-                            if (!oidcConfiguration.end_session_endpoint) {
-                                throw "Not supported by the OIDC server";
-                            }
-                            return oidcConfiguration.end_session_endpoint;
-                        },
-                        checkSessionIframe: function() {
-                            if (!oidcConfiguration.check_session_iframe) {
-                                throw "Not supported by the OIDC server";
-                            }
-                            return oidcConfiguration.check_session_iframe;
-                        },
-                        register: function() {
-                            throw 'Redirection to "Register user" page not supported in standard OIDC mode';
-                        },
-                        userinfo: function() {
-                            if (!oidcConfiguration.userinfo_endpoint) {
-                                throw "Not supported by the OIDC server";
-                            }
-                            return oidcConfiguration.userinfo_endpoint;
-                        }
-                    }
-                }
-            }
-
             if (configUrl) {
                 var req = new XMLHttpRequest();
                 req.open('GET', configUrl, true);
@@ -690,7 +601,7 @@
                             kc.realm = config['realm'];
                             kc.clientId = config['resource'];
                             kc.clientSecret = (config['credentials'] || {})['secret'];
-                            setupOidcEndoints(null);
+
                             promise.setSuccess();
                         } else {
                             promise.setError();
@@ -700,62 +611,30 @@
 
                 req.send();
             } else {
+                if (!config['url']) {
+                    var scripts = document.getElementsByTagName('script');
+                    for (var i = 0; i < scripts.length; i++) {
+                        if (scripts[i].src.match(/.*keycloak\.js/)) {
+                            config.url = scripts[i].src.substr(0, scripts[i].src.indexOf('/js/keycloak.js'));
+                            break;
+                        }
+                    }
+                }
+
+                if (!config.realm) {
+                    throw 'realm missing';
+                }
+
                 if (!config.clientId) {
                     throw 'clientId missing';
                 }
 
+                kc.authServerUrl = config.url;
+                kc.realm = config.realm;
                 kc.clientId = config.clientId;
                 kc.clientSecret = (config.credentials || {}).secret;
 
-                var oidcProvider = config['oidcProvider'];
-                if (!oidcProvider) {
-                    if (!config['url']) {
-                        var scripts = document.getElementsByTagName('script');
-                        for (var i = 0; i < scripts.length; i++) {
-                            if (scripts[i].src.match(/.*keycloak\.js/)) {
-                                config.url = scripts[i].src.substr(0, scripts[i].src.indexOf('/js/keycloak.js'));
-                                break;
-                            }
-                        }
-                    }
-                    if (!config.realm) {
-                        throw 'realm missing';
-                    }
-
-                    kc.authServerUrl = config.url;
-                    kc.realm = config.realm;
-                    setupOidcEndoints(null);
-                    promise.setSuccess();
-                } else {
-                    if (typeof oidcProvider === 'string') {
-                        var oidcProviderConfigUrl;
-                        if (oidcProvider.charAt(oidcProvider.length - 1) == '/') {
-                            oidcProviderConfigUrl = oidcProvider + '.well-known/openid-configuration';
-                        } else {
-                            oidcProviderConfigUrl = oidcProvider + '/.well-known/openid-configuration';
-                        }
-                        var req = new XMLHttpRequest();
-                        req.open('GET', oidcProviderConfigUrl, true);
-                        req.setRequestHeader('Accept', 'application/json');
-
-                        req.onreadystatechange = function () {
-                            if (req.readyState == 4) {
-                                if (req.status == 200 || fileLoaded(req)) {
-                                    var oidcProviderConfig = JSON.parse(req.responseText);
-                                    setupOidcEndoints(oidcProviderConfig);
-                                    promise.setSuccess();
-                                } else {
-                                    promise.setError();
-                                }
-                            }
-                        };
-
-                        req.send();
-                    } else {
-                        setupOidcEndoints(oidcProvider);
-                        promise.setSuccess();
-                    }
-                }
+                promise.setSuccess();
             }
 
             return promise.promise;
@@ -874,137 +753,23 @@
         }
 
         function parseCallback(url) {
-            var oauth = parseCallbackUrl(url);
-            if (!oauth) {
-                return;
-            }
-
+            var oauth = new CallbackParser(url, kc.responseMode).parseUri();
             var oauthState = callbackStorage.get(oauth.state);
 
-            if (oauthState) {
-                oauth.valid = true;
+            if (oauthState && (oauth.code || oauth.error || oauth.access_token || oauth.id_token)) {
                 oauth.redirectUri = oauthState.redirectUri;
                 oauth.storedNonce = oauthState.nonce;
                 oauth.prompt = oauthState.prompt;
-            }
 
-            return oauth;
-        }
-
-        function parseCallbackUrl(url) {
-            var supportedParams;
-            switch (kc.flow) {
-                case 'standard':
-                    supportedParams = ['code', 'state', 'session_state'];
-                    break;
-                case 'implicit':
-                    supportedParams = ['access_token', 'id_token', 'state', 'session_state'];
-                    break;
-                case 'hybrid':
-                    supportedParams = ['access_token', 'id_token', 'code', 'state', 'session_state'];
-                    break;
-            }
-
-            supportedParams.push('error');
-            supportedParams.push('error_description');
-            supportedParams.push('error_uri');
-
-            var queryIndex = url.indexOf('?');
-            var fragmentIndex = url.indexOf('#');
-
-            var newUrl;
-            var parsed;
-
-            if (kc.responseMode === 'query' && queryIndex !== -1) {
-                newUrl = url.substring(0, queryIndex);
-                parsed = parseCallbackParams(url.substring(queryIndex + 1, fragmentIndex !== -1 ? fragmentIndex : url.length), supportedParams);
-                if (parsed.paramsString !== '') {
-                    newUrl += '?' + parsed.paramsString;
+                if (oauth.fragment) {
+                    oauth.newUrl += '#' + oauth.fragment;
                 }
-                if (fragmentIndex !== -1) {
-                    newUrl += url.substring(fragmentIndex);
-                }
-            } else if (kc.responseMode === 'fragment' && fragmentIndex !== -1) {
-                newUrl = url.substring(0, fragmentIndex);
-                parsed = parseCallbackParams(url.substring(fragmentIndex + 1), supportedParams);
-                if (parsed.paramsString !== '') {
-                    newUrl += '#' + parsed.paramsString;
-                }
-            }
 
-            if (parsed && parsed.oauthParams) {
-                if (kc.flow === 'standard' || kc.flow === 'hybrid') {
-                    if ((parsed.oauthParams.code || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                        parsed.oauthParams.newUrl = newUrl;
-                        return parsed.oauthParams;
-                    }
-                } else if (kc.flow === 'implicit') {
-                    if ((parsed.oauthParams.access_token || parsed.oauthParams.error) && parsed.oauthParams.state) {
-                        parsed.oauthParams.newUrl = newUrl;
-                        return parsed.oauthParams;
-                    }
-                }
+                return oauth;
             }
         }
 
-        function parseCallbackParams(paramsString, supportedParams) {
-            var p = paramsString.split('&');
-            var result = {
-                paramsString: '',
-                oauthParams: {}
-            }
-            for (var i = 0; i < p.length; i++) {
-                var t = p[i].split('=');
-                if (supportedParams.indexOf(t[0]) !== -1) {
-                    result.oauthParams[t[0]] = t[1];
-                } else {
-                    if (result.paramsString !== '') {
-                        result.paramsString += '&';
-                    }
-                    result.paramsString += p[i];
-                }
-            }
-            return result;
-        }
-
         function createPromise() {
-            if (typeof Promise === "function") {
-                return createNativePromise();
-            } else {
-                return createLegacyPromise();
-            }
-        }
-
-        function createNativePromise() {
-            // Need to create a native Promise which also preserves the
-            // interface of the custom promise type previously used by the API
-            var p = {
-                setSuccess: function(result) {
-                    p.success = true;
-                    p.resolve(result);
-                },
-
-                setError: function(result) {
-                    p.success = false;
-                    p.reject(result);
-                }
-            };
-            p.promise = new Promise(function(resolve, reject) {
-                p.resolve = resolve;
-                p.reject = reject;
-            });
-            p.promise.success = function(callback) {
-                p.promise.then(callback);
-                return p.promise;
-            }
-            p.promise.error = function(callback) {
-                p.promise.catch(callback);
-                return p.promise;
-            }
-            return p;
-        }
-
-        function createLegacyPromise() {
             var p = {
                 setSuccess: function(result) {
                     p.success = true;
@@ -1061,18 +826,22 @@
             loginIframe.iframe = iframe;
 
             iframe.onload = function() {
-                var authUrl = kc.endpoints.authorize();
-                if (authUrl.charAt(0) === '/') {
+                var realmUrl = getRealmUrl();
+                if (realmUrl.charAt(0) === '/') {
                     loginIframe.iframeOrigin = getOrigin();
                 } else {
-                    loginIframe.iframeOrigin = authUrl.substring(0, authUrl.indexOf('/', 8));
+                    loginIframe.iframeOrigin = realmUrl.substring(0, realmUrl.indexOf('/', 8));
                 }
                 promise.setSuccess();
 
                 setTimeout(check, loginIframe.interval * 1000);
             }
 
-            var src = kc.endpoints.checkSessionIframe();
+            var src = getRealmUrl() + '/protocol/openid-connect/login-status-iframe.html';
+            if (kc.iframeVersion) {
+                src = src + '?version=' + kc.iframeVersion;
+            }
+
             iframe.setAttribute('src', src );
             iframe.setAttribute('title', 'keycloak-session-iframe' );
             iframe.style.display = 'none';
@@ -1152,12 +921,7 @@
                     },
 
                     accountManagement : function() {
-                        var accountUrl = kc.createAccountUrl();
-                        if (typeof accountUrl !== 'undefined') {
-                            window.location.href = accountUrl;
-                        } else {
-                            throw "Not supported by the OIDC server";
-                        }
+                        window.location.href = kc.createAccountUrl();
                         return createPromise().promise;
                     },
 
@@ -1171,7 +935,12 @@
                         } else if (kc.redirectUri) {
                             return kc.redirectUri;
                         } else {
-                            return location.href;
+                            var redirectUri = location.href;
+                            if (location.hash && encodeHash) {
+                                redirectUri = redirectUri.substring(0, location.href.indexOf('#'));
+                                redirectUri += (redirectUri.indexOf('?') == -1 ? '?' : '&') + 'redirect_fragment=' + encodeURIComponent(location.hash.substring(1));
+                            }
+                            return redirectUri;
                         }
                     }
                 };
@@ -1179,14 +948,7 @@
 
             if (type == 'cordova') {
                 loginIframe.enable = false;
-                var cordovaOpenWindowWrapper = function(loginUrl, target, options) {
-                    if (window.cordova && window.cordova.InAppBrowser) {
-                        // Use inappbrowser for IOS and Android if available
-                        return window.cordova.InAppBrowser.open(loginUrl, target, options);
-                    } else {
-                        return window.open(loginUrl, target, options);
-                    }
-                };
+
                 return {
                     login: function(options) {
                         var promise = createPromise();
@@ -1197,7 +959,8 @@
                         }
 
                         var loginUrl = kc.createLoginUrl(options);
-                        var ref = cordovaOpenWindowWrapper(loginUrl, '_blank', o);
+                        var ref = window.open(loginUrl, '_blank', o);
+
                         var completed = false;
 
                         ref.addEventListener('loadstart', function(event) {
@@ -1230,7 +993,7 @@
                         var promise = createPromise();
 
                         var logoutUrl = kc.createLogoutUrl(options);
-                        var ref = cordovaOpenWindowWrapper(logoutUrl, '_blank', 'location=no,hidden=yes');
+                        var ref = window.open(logoutUrl, '_blank', 'location=no,hidden=yes');
 
                         var error;
 
@@ -1263,7 +1026,7 @@
 
                     register : function() {
                         var registerUrl = kc.createRegisterUrl();
-                        var ref = cordovaOpenWindowWrapper(registerUrl, '_blank', 'location=no');
+                        var ref = window.open(registerUrl, '_blank', 'location=no');
                         ref.addEventListener('loadstart', function(event) {
                             if (event.url.indexOf('http://localhost') == 0) {
                                 ref.close();
@@ -1273,16 +1036,12 @@
 
                     accountManagement : function() {
                         var accountUrl = kc.createAccountUrl();
-                        if (typeof accountUrl !== 'undefined') {
-                            var ref = cordovaOpenWindowWrapper(accountUrl, '_blank', 'location=no');
-                            ref.addEventListener('loadstart', function(event) {
-                                if (event.url.indexOf('http://localhost') == 0) {
-                                    ref.close();
-                                }
-                            });
-                        } else {
-                            throw "Not supported by the OIDC server";
-                        }
+                        var ref = window.open(accountUrl, '_blank', 'location=no');
+                        ref.addEventListener('loadstart', function(event) {
+                            if (event.url.indexOf('http://localhost') == 0) {
+                                ref.close();
+                            }
+                        });
                     },
 
                     redirectUri: function(options) {
@@ -1412,6 +1171,99 @@
 
             return new CookieStorage();
         }
+
+        var CallbackParser = function(uriToParse, responseMode) {
+            if (!(this instanceof CallbackParser)) {
+                return new CallbackParser(uriToParse, responseMode);
+            }
+            var parser = this;
+
+            var initialParse = function() {
+                var baseUri = null;
+                var queryString = null;
+                var fragmentString = null;
+
+                var questionMarkIndex = uriToParse.indexOf("?");
+                var fragmentIndex = uriToParse.indexOf("#", questionMarkIndex + 1);
+                if (questionMarkIndex == -1 && fragmentIndex == -1) {
+                    baseUri = uriToParse;
+                } else if (questionMarkIndex != -1) {
+                    baseUri = uriToParse.substring(0, questionMarkIndex);
+                    queryString = uriToParse.substring(questionMarkIndex + 1);
+                    if (fragmentIndex != -1) {
+                        fragmentIndex = queryString.indexOf("#");
+                        fragmentString = queryString.substring(fragmentIndex + 1);
+                        queryString = queryString.substring(0, fragmentIndex);
+                    }
+                } else {
+                    baseUri = uriToParse.substring(0, fragmentIndex);
+                    fragmentString = uriToParse.substring(fragmentIndex + 1);
+                }
+
+                return { baseUri: baseUri, queryString: queryString, fragmentString: fragmentString };
+            }
+
+            var parseParams = function(paramString) {
+                var result = {};
+                var params = paramString.split('&');
+                for (var i = 0; i < params.length; i++) {
+                    var p = params[i].split('=');
+                    var paramName = decodeURIComponent(p[0]);
+                    var paramValue = decodeURIComponent(p[1]);
+                    result[paramName] = paramValue;
+                }
+                return result;
+            }
+
+            var handleQueryParam = function(paramName, paramValue, oauth) {
+                var supportedOAuthParams = [ 'code', 'state', 'error', 'error_description' ];
+
+                for (var i = 0 ; i< supportedOAuthParams.length ; i++) {
+                    if (paramName === supportedOAuthParams[i]) {
+                        oauth[paramName] = paramValue;
+                        return true;
+                    }
+                }
+                return false;
+            }
+
+
+            parser.parseUri = function() {
+                var parsedUri = initialParse();
+
+                var queryParams = {};
+                if (parsedUri.queryString) {
+                    queryParams = parseParams(parsedUri.queryString);
+                }
+
+                var oauth = { newUrl: parsedUri.baseUri };
+                for (var param in queryParams) {
+                    switch (param) {
+                        case 'redirect_fragment':
+                            oauth.fragment = queryParams[param];
+                            break;
+                        default:
+                            if (responseMode != 'query' || !handleQueryParam(param, queryParams[param], oauth)) {
+                                oauth.newUrl += (oauth.newUrl.indexOf('?') == -1 ? '?' : '&') + param + '=' + encodeURIComponent(queryParams[param]);
+                            }
+                            break;
+                    }
+                }
+
+                if (responseMode === 'fragment') {
+                    var fragmentParams = {};
+                    if (parsedUri.fragmentString) {
+                        fragmentParams = parseParams(parsedUri.fragmentString);
+                    }
+                    for (var param in fragmentParams) {
+                        oauth[param] = fragmentParams[param];
+                    }
+                }
+
+                return oauth;
+            }
+        }
+
     }
 
     if ( typeof module === "object" && module && typeof module.exports === "object" ) {

adapters/oidc/js/src/main/resources/login-status-iframe.html

@@ -36,7 +36,7 @@
 
             req.onreadystatechange = function () {
                 if (req.readyState === 4) {
-                    if (req.status === 204 || req.status === 1223) {
+                    if (req.status === 204) {
                         init = {
                             clientId: clientId,
                             origin: origin
@@ -79,10 +79,6 @@
 
     function receiveMessage(event)
     {
-        if (typeof event.data !== 'string') {
-            return
-        }
-
         var origin = event.origin;
         var data = event.data.split(' ');
         if (data.length != 2) {

adapters/oidc/kcinit/src/main/bin/kcinit

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-case "`uname`" in
-    CYGWIN*)
-        CFILE = `cygpath "$0"`
-        RESOLVED_NAME=`readlink -f "$CFILE"`
-        ;;
-    Darwin*)
-        RESOLVED_NAME=`readlink "$0"`
-        ;;
-    FreeBSD)
-        RESOLVED_NAME=`readlink -f "$0"`
-        ;;
-    Linux)
-        RESOLVED_NAME=`readlink -f "$0"`
-        ;;
-esac
-
-if [ "x$RESOLVED_NAME" = "x" ]; then
-    RESOLVED_NAME="$0"
-fi
-
-SCRIPTPATH=`dirname "$RESOLVED_NAME"`
-JAR=$SCRIPTPATH/kcinit-${project.version}.jar
-
-java -jar $JAR $@

adapters/oidc/kcinit/src/main/bin/kcinit.bat

@@ -1,8 +0,0 @@
-@echo off
-
-if "%OS%" == "Windows_NT" (
-  set "DIRNAME=%~dp0%"
-) else (
-  set DIRNAME=.\
-)
-java -jar %DIRNAME%\kcinit-${project.version}.jar %*

adapters/oidc/osgi-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>
@@ -34,7 +34,7 @@
         <module>adapter-core</module>
         <module>as7-eap6</module>
         <module>installed</module>
-        <module>kcinit</module>
+        <module>cli-sso</module>
         <module>jaxrs-oauth-client</module>
         <module>jetty</module>
         <module>js</module>
@@ -42,8 +42,6 @@
         <module>servlet-filter</module>
         <module>servlet-oauth-client</module>
         <module>spring-boot</module>
-        <module>spring-boot2</module>
-        <module>spring-boot-adapter-core</module>
         <module>spring-boot-container-bundle</module>
         <module>spring-security</module>
         <module>tomcat</module>

adapters/oidc/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/src/main/java/org/keycloak/servlet/ServletOAuthClient.java

@@ -36,8 +36,6 @@ import javax.security.cert.X509Certificate;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-
-import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
@@ -267,8 +265,6 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
         public Request getRequest() {
             return new Request() {
 
-                private InputStream inputStream;
-
                 @Override
                 public String getFirstParam(String param) {
                     return servletRequest.getParameter(param);
@@ -318,27 +314,10 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
 
                 @Override
                 public InputStream getInputStream() {
-                    return getInputStream(false);
-                }
-
-                @Override
-                public InputStream getInputStream(boolean buffered) {
-                    if (inputStream != null) {
-                        return inputStream;
-                    }
-
-                    if (buffered) {
-                        try {
-                            return inputStream = new BufferedInputStream(servletRequest.getInputStream());
-                        } catch (IOException e) {
-                            throw new RuntimeException(e);
-                        }
-                    }
-
                     try {
                         return servletRequest.getInputStream();
-                    } catch (IOException e) {
-                        throw new RuntimeException(e);
+                    } catch (IOException ioe) {
+                        throw new RuntimeException(ioe);
                     }
                 }
 

adapters/oidc/spring-boot-adapter-core/pom.xml

@@ -1,116 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-  <parent>
-    <artifactId>keycloak-parent</artifactId>
-    <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
-    <relativePath>../../../pom.xml</relativePath>
-  </parent>
-  <modelVersion>4.0.0</modelVersion>
-
-  <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-  <name>Keycloak Spring Boot Adapter Core</name>
-  <description/>
-
-  <properties>
-    <spring-boot.version>1.3.0.RELEASE</spring-boot.version>
-  </properties>
-
-  <dependencies>
-    <dependency>
-      <groupId>org.jboss.logging</groupId>
-      <artifactId>jboss-logging</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-core</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>spring-boot-container-bundle</artifactId>
-      <version>${project.version}</version>
-      <optional>true</optional>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-security-adapter</artifactId>
-      <version>${project.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>${spring-boot.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>io.undertow</groupId>
-      <artifactId>undertow-servlet</artifactId>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-security</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-webapp</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <scope>test</scope>
-    </dependency>
-     <dependency>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-configuration-processor</artifactId>
-        <optional>true</optional>
-        <version>${spring-boot.version}</version>
-     </dependency>
-  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
-      </plugin>
-    </plugins>
-  </build>
-</project>

adapters/oidc/spring-boot-adapter-core/src/main/java/org/keycloak/adapters/springboot/KeycloakBaseSpringBootConfiguration.java

@@ -1,262 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot;
-
-import io.undertow.servlet.api.DeploymentInfo;
-import io.undertow.servlet.api.WebResourceCollection;
-import org.apache.catalina.Context;
-import org.apache.tomcat.util.descriptor.web.LoginConfig;
-import org.apache.tomcat.util.descriptor.web.SecurityCollection;
-import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
-import org.eclipse.jetty.security.ConstraintMapping;
-import org.eclipse.jetty.security.ConstraintSecurityHandler;
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.util.security.Constraint;
-import org.eclipse.jetty.webapp.WebAppContext;
-import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
-import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
-import org.keycloak.adapters.undertow.KeycloakServletExtension;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer;
-import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer;
-import org.springframework.boot.context.embedded.jetty.JettyEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.jetty.JettyServerCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.undertow.UndertowDeploymentInfoCustomizer;
-import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-/**
- * Keycloak authentication base integration for Spring Boot - base to be extended for particular boot versions.
- */
-public class KeycloakBaseSpringBootConfiguration {
-
-    protected KeycloakSpringBootProperties keycloakProperties;
-
-    @Autowired
-    public void setKeycloakSpringBootProperties(KeycloakSpringBootProperties keycloakProperties) {
-        this.keycloakProperties = keycloakProperties;
-        KeycloakSpringBootConfigResolver.setAdapterConfig(keycloakProperties);
-    }
-
-
-    static class KeycloakBaseUndertowDeploymentInfoCustomizer  {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(DeploymentInfo deploymentInfo) {
-
-            io.undertow.servlet.api.LoginConfig loginConfig = new io.undertow.servlet.api.LoginConfig(keycloakProperties.getRealm());
-            loginConfig.addFirstAuthMethod("KEYCLOAK");
-
-            deploymentInfo.setLoginConfig(loginConfig);
-
-            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
-            deploymentInfo.addSecurityConstraints(getSecurityConstraints());
-
-            deploymentInfo.addServletExtension(new KeycloakServletExtension());
-        }
-
-        private List<io.undertow.servlet.api.SecurityConstraint> getSecurityConstraints() {
-
-            List<io.undertow.servlet.api.SecurityConstraint> undertowSecurityConstraints = new ArrayList<io.undertow.servlet.api.SecurityConstraint>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
-
-                io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
-                undertowSecurityConstraint.addRolesAllowed(constraintDefinition.getAuthRoles());
-
-                for (KeycloakSpringBootProperties.SecurityCollection collectionDefinition : constraintDefinition.getSecurityCollections()) {
-
-                    WebResourceCollection webResourceCollection = new WebResourceCollection();
-                    webResourceCollection.addHttpMethods(collectionDefinition.getMethods());
-                    webResourceCollection.addHttpMethodOmissions(collectionDefinition.getOmittedMethods());
-                    webResourceCollection.addUrlPatterns(collectionDefinition.getPatterns());
-
-                    undertowSecurityConstraint.addWebResourceCollections(webResourceCollection);
-
-                }
-
-                undertowSecurityConstraints.add(undertowSecurityConstraint);
-            }
-            return undertowSecurityConstraints;
-        }
-    }
-
-    static class KeycloakBaseJettyServerCustomizer {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(Server server) {
-
-            KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
-            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
-
-            /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
-               on how to map servlet spec to Constraints */
-
-            List<ConstraintMapping> jettyConstraintMappings = new ArrayList<ConstraintMapping>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
-
-                for (KeycloakSpringBootProperties.SecurityCollection securityCollectionDefinition : constraintDefinition
-                        .getSecurityCollections()) {
-                    // securityCollection matches servlet spec's web-resource-collection
-                    Constraint jettyConstraint = new Constraint();
-
-                    if (constraintDefinition.getAuthRoles().size() > 0) {
-                        jettyConstraint.setAuthenticate(true);
-                        jettyConstraint.setRoles(constraintDefinition.getAuthRoles().toArray(new String[0]));
-                    }
-
-                    jettyConstraint.setName(securityCollectionDefinition.getName());
-
-                    // according to the servlet spec each security-constraint has at least one URL pattern
-                    for(String pattern : securityCollectionDefinition.getPatterns()) {
-
-                        /* the following code is asymmetric as Jetty's ConstraintMapping accepts only one allowed HTTP method,
-                           but multiple omitted methods. Therefore we add one ConstraintMapping for each allowed
-                           mapping but only one mapping in the cases of omitted methods or no methods.
-                         */
-
-                        if (securityCollectionDefinition.getMethods().size() > 0) {
-                            // according to the servlet spec we have either methods ...
-                            for(String method : securityCollectionDefinition.getMethods()) {
-                                ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                                jettyConstraintMappings.add(jettyConstraintMapping);
-
-                                jettyConstraintMapping.setConstraint(jettyConstraint);
-                                jettyConstraintMapping.setPathSpec(pattern);
-                                jettyConstraintMapping.setMethod(method);
-                            }
-                        } else if (securityCollectionDefinition.getOmittedMethods().size() > 0){
-                            // ... omitted methods ...
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                            jettyConstraintMapping.setMethodOmissions(
-                                    securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
-                        } else {
-                            // ... or no methods at all
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                        }
-
-                    }
-
-                }
-            }
-
-            WebAppContext webAppContext = server.getBean(WebAppContext.class);
-            //if not found as registered bean let's try the handler
-            if(webAppContext==null){
-                webAppContext = (WebAppContext) server.getHandler();
-            }
-
-            ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
-            securityHandler.setConstraintMappings(jettyConstraintMappings);
-            securityHandler.setAuthenticator(keycloakJettyAuthenticator);
-
-            webAppContext.setSecurityHandler(securityHandler);
-        }
-    }
-
-    static class KeycloakBaseTomcatContextCustomizer {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(Context context) {
-            LoginConfig loginConfig = new LoginConfig();
-            loginConfig.setAuthMethod("KEYCLOAK");
-            context.setLoginConfig(loginConfig);
-
-            Set<String> authRoles = new HashSet<String>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
-                for (String authRole : constraint.getAuthRoles()) {
-                    if (!authRoles.contains(authRole)) {
-                        context.addSecurityRole(authRole);
-                        authRoles.add(authRole);
-                    }
-                }
-            }
-
-            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
-                SecurityConstraint tomcatConstraint = new SecurityConstraint();
-
-                for (String authRole : constraint.getAuthRoles()) {
-                    tomcatConstraint.addAuthRole(authRole);
-                }
-
-                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
-                    SecurityCollection tomcatSecCollection = new SecurityCollection();
-
-                    if (collection.getName() != null) {
-                        tomcatSecCollection.setName(collection.getName());
-                    }
-                    if (collection.getDescription() != null) {
-                        tomcatSecCollection.setDescription(collection.getDescription());
-                    }
-
-                    for (String pattern : collection.getPatterns()) {
-                        tomcatSecCollection.addPattern(pattern);
-                    }
-
-                    for (String method : collection.getMethods()) {
-                        tomcatSecCollection.addMethod(method);
-                    }
-
-                    for (String method : collection.getOmittedMethods()) {
-                        tomcatSecCollection.addOmittedMethod(method);
-                    }
-
-                    tomcatConstraint.addCollection(tomcatSecCollection);
-                }
-
-                context.addConstraint(tomcatConstraint);
-            }
-
-            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
-        }
-    }
-}

adapters/oidc/spring-boot-adapter-core/src/main/resources/META-INF/spring.factories

@@ -1,2 +0,0 @@
-org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.keycloak.adapters.springboot.KeycloakAutoConfiguration

adapters/oidc/spring-boot-container-bundle/pom.xml

@@ -4,7 +4,7 @@
     <parent>
       <artifactId>keycloak-parent</artifactId>
       <groupId>org.keycloak</groupId>
-      <version>4.0.0.Beta2</version>
+      <version>3.3.0.CR2</version>
       <relativePath>../../../pom.xml</relativePath>
     </parent>
     <artifactId>spring-boot-container-bundle</artifactId>

adapters/oidc/spring-boot/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
+    <version>3.3.0.CR2</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>
@@ -37,12 +37,6 @@
   </properties>
 
   <dependencies>
-
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-    </dependency>
-
     <dependency>
       <groupId>org.jboss.logging</groupId>
       <artifactId>jboss-logging</artifactId>

adapters/oidc/spring-boot/src/main/java/org/keycloak/adapters/springboot/KeycloakAutoConfiguration.java

@@ -17,7 +17,20 @@
 
 package org.keycloak.adapters.springboot;
 
+import io.undertow.servlet.api.DeploymentInfo;
+import io.undertow.servlet.api.WebResourceCollection;
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.descriptor.web.LoginConfig;
+import org.apache.tomcat.util.descriptor.web.SecurityCollection;
+import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.util.security.Constraint;
+import org.eclipse.jetty.webapp.WebAppContext;
+import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
 import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
+import org.keycloak.adapters.undertow.KeycloakServletExtension;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -34,6 +47,10 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 
 /**
  * Keycloak authentication integration for Spring Boot
@@ -45,7 +62,7 @@ import org.springframework.context.annotation.Configuration;
 @ConditionalOnWebApplication
 @EnableConfigurationProperties(KeycloakSpringBootProperties.class)
 @ConditionalOnProperty(value = "keycloak.enabled", matchIfMissing = true)
-public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfiguration  {
+public class KeycloakAutoConfiguration {
 
     private KeycloakSpringBootProperties keycloakProperties;
 
@@ -100,27 +117,200 @@ public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfigurati
         return new KeycloakUndertowDeploymentInfoCustomizer(keycloakProperties);
     }
 
-    static class KeycloakUndertowDeploymentInfoCustomizer extends KeycloakBaseUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
+    static class KeycloakUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(DeploymentInfo deploymentInfo) {
+
+            io.undertow.servlet.api.LoginConfig loginConfig = new io.undertow.servlet.api.LoginConfig(keycloakProperties.getRealm());
+            loginConfig.addFirstAuthMethod("KEYCLOAK");
+
+            deploymentInfo.setLoginConfig(loginConfig);
+
+            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
+            deploymentInfo.addSecurityConstraints(getSecurityConstraints());
+
+            deploymentInfo.addServletExtension(new KeycloakServletExtension());
+        }
+
+        private List<io.undertow.servlet.api.SecurityConstraint> getSecurityConstraints() {
+
+            List<io.undertow.servlet.api.SecurityConstraint> undertowSecurityConstraints = new ArrayList<io.undertow.servlet.api.SecurityConstraint>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
+
+                io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
+                undertowSecurityConstraint.addRolesAllowed(constraintDefinition.getAuthRoles());
+
+                for (KeycloakSpringBootProperties.SecurityCollection collectionDefinition : constraintDefinition.getSecurityCollections()) {
+
+                    WebResourceCollection webResourceCollection = new WebResourceCollection();
+                    webResourceCollection.addHttpMethods(collectionDefinition.getMethods());
+                    webResourceCollection.addHttpMethodOmissions(collectionDefinition.getOmittedMethods());
+                    webResourceCollection.addUrlPatterns(collectionDefinition.getPatterns());
+
+                    undertowSecurityConstraint.addWebResourceCollections(webResourceCollection);
+
+                }
+
+                undertowSecurityConstraints.add(undertowSecurityConstraint);
+            }
+            return undertowSecurityConstraints;
+        }
     }
 
-    static class KeycloakJettyServerCustomizer extends KeycloakBaseJettyServerCustomizer implements JettyServerCustomizer {
+    static class KeycloakJettyServerCustomizer implements JettyServerCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(Server server) {
+
+            KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
+            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
+
+            /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
+               on how to map servlet spec to Constraints */
+
+            List<ConstraintMapping> jettyConstraintMappings = new ArrayList<ConstraintMapping>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
+
+                for (KeycloakSpringBootProperties.SecurityCollection securityCollectionDefinition : constraintDefinition
+                        .getSecurityCollections()) {
+                    // securityCollection matches servlet spec's web-resource-collection
+                    Constraint jettyConstraint = new Constraint();
+
+                    if (constraintDefinition.getAuthRoles().size() > 0) {
+                        jettyConstraint.setAuthenticate(true);
+                        jettyConstraint.setRoles(constraintDefinition.getAuthRoles().toArray(new String[0]));
+                    }
+
+                    jettyConstraint.setName(securityCollectionDefinition.getName());
+
+                    // according to the servlet spec each security-constraint has at least one URL pattern
+                    for(String pattern : securityCollectionDefinition.getPatterns()) {
+
+                        /* the following code is asymmetric as Jetty's ConstraintMapping accepts only one allowed HTTP method,
+                           but multiple omitted methods. Therefore we add one ConstraintMapping for each allowed
+                           mapping but only one mapping in the cases of omitted methods or no methods.
+                         */
+
+                        if (securityCollectionDefinition.getMethods().size() > 0) {
+                            // according to the servlet spec we have either methods ...
+                            for(String method : securityCollectionDefinition.getMethods()) {
+                                ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                                jettyConstraintMappings.add(jettyConstraintMapping);
+
+                                jettyConstraintMapping.setConstraint(jettyConstraint);
+                                jettyConstraintMapping.setPathSpec(pattern);
+                                jettyConstraintMapping.setMethod(method);
+                            }
+                        } else if (securityCollectionDefinition.getOmittedMethods().size() > 0){
+                            // ... omitted methods ...
+                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                            jettyConstraintMappings.add(jettyConstraintMapping);
+
+                            jettyConstraintMapping.setConstraint(jettyConstraint);
+                            jettyConstraintMapping.setPathSpec(pattern);
+                            jettyConstraintMapping.setMethodOmissions(
+                                    securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
+                        } else {
+                            // ... or no methods at all
+                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                            jettyConstraintMappings.add(jettyConstraintMapping);
+
+                            jettyConstraintMapping.setConstraint(jettyConstraint);
+                            jettyConstraintMapping.setPathSpec(pattern);
+                        }
+
+                    }
+
+                }
+            }
+
+            WebAppContext webAppContext = server.getBean(WebAppContext.class);
+            //if not found as registered bean let's try the handler
+            if(webAppContext==null){
+                webAppContext = (WebAppContext) server.getHandler();
+            }
+
+            ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+            securityHandler.setConstraintMappings(jettyConstraintMappings);
+            securityHandler.setAuthenticator(keycloakJettyAuthenticator);
+
+            webAppContext.setSecurityHandler(securityHandler);
+        }
     }
 
-    static class KeycloakTomcatContextCustomizer extends KeycloakBaseTomcatContextCustomizer implements TomcatContextCustomizer {
+    static class KeycloakTomcatContextCustomizer implements TomcatContextCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(Context context) {
+            LoginConfig loginConfig = new LoginConfig();
+            loginConfig.setAuthMethod("KEYCLOAK");
+            context.setLoginConfig(loginConfig);
+
+            Set<String> authRoles = new HashSet<String>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
+                for (String authRole : constraint.getAuthRoles()) {
+                    if (!authRoles.contains(authRole)) {
+                        context.addSecurityRole(authRole);
+                        authRoles.add(authRole);
+                    }
+                }
+            }
+
+            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
+                SecurityConstraint tomcatConstraint = new SecurityConstraint();
+
+                for (String authRole : constraint.getAuthRoles()) {
+                    tomcatConstraint.addAuthRole(authRole);
+                }
+
+                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
+                    SecurityCollection tomcatSecCollection = new SecurityCollection();
+
+                    if (collection.getName() != null) {
+                        tomcatSecCollection.setName(collection.getName());
+                    }
+                    if (collection.getDescription() != null) {
+                        tomcatSecCollection.setDescription(collection.getDescription());
+                    }
+
+                    for (String pattern : collection.getPatterns()) {
+                        tomcatSecCollection.addPattern(pattern);
+                    }
+
+                    for (String method : collection.getMethods()) {
+                        tomcatSecCollection.addMethod(method);
+                    }
+
+                    for (String method : collection.getOmittedMethods()) {
+                        tomcatSecCollection.addOmittedMethod(method);
+                    }
+
+                    tomcatConstraint.addCollection(tomcatSecCollection);
+                }
+
+                context.addConstraint(tomcatConstraint);
+            }
+
+            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
+        }
     }
 }

adapters/oidc/spring-boot2/pom.xml

@@ -1,151 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-  <parent>
-    <artifactId>keycloak-parent</artifactId>
-    <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
-    <relativePath>../../../pom.xml</relativePath>
-  </parent>
-  <modelVersion>4.0.0</modelVersion>
-
-  <artifactId>keycloak-spring-boot-2-adapter</artifactId>
-  <name>Keycloak Spring Boot 2 Integration</name>
-  <description/>
-
-  <properties>
-    <spring-boot.version>2.0.0.RELEASE</spring-boot.version>
-    <spring.version>5.0.2.RELEASE</spring.version>
-    <mockito.version>1.9.5</mockito.version>
-  </properties>
-
-  <dependencies>
-
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-    </dependency>
-
-    <dependency>
-      <groupId>org.jboss.logging</groupId>
-      <artifactId>jboss-logging</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-core</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>spring-boot-container-bundle</artifactId>
-      <version>${project.version}</version>
-      <optional>true</optional>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-security-adapter</artifactId>
-      <version>${project.version}</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-      <version>2.9.4</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-annotations</artifactId>
-      <version>2.9.4</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>5.0.2.RELEASE</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>${spring-boot.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>io.undertow</groupId>
-      <artifactId>undertow-servlet</artifactId>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-security</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-webapp</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-test</artifactId>
-      <version>${spring.version}</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-all</artifactId>
-      <version>${mockito.version}</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-configuration-processor</artifactId>
-      <optional>true</optional>
-      <version>${spring-boot.version}</version>
-    </dependency>
-  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
-      </plugin>
-    </plugins>
-  </build>
-</project>

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/KeycloakAutoConfiguration.java

@@ -1,116 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot;
-
-import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.boot.web.server.WebServerFactoryCustomizer;
-import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
-import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
-import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
-import org.springframework.boot.web.embedded.jetty.JettyServerCustomizer;
-import org.springframework.boot.web.embedded.jetty.JettyServletWebServerFactory;
-import org.springframework.boot.web.embedded.undertow.UndertowDeploymentInfoCustomizer;
-import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
-
-
-
-
-/**
- * Keycloak authentication integration for Spring Boot 2
- *
- */
-@Configuration
-@ConditionalOnWebApplication
-@EnableConfigurationProperties(KeycloakSpringBootProperties.class)
-@ConditionalOnProperty(value = "keycloak.enabled", matchIfMissing = true)
-public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfiguration {
-
-
-    @Bean
-    public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> getKeycloakContainerCustomizer() {
-        return new WebServerFactoryCustomizer<ConfigurableServletWebServerFactory>() {
-            @Override
-            public void customize(ConfigurableServletWebServerFactory configurableServletWebServerFactory) {
-                if(configurableServletWebServerFactory instanceof TomcatServletWebServerFactory){
-
-                    TomcatServletWebServerFactory container = (TomcatServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addContextValves(new KeycloakAuthenticatorValve());
-                    container.addContextCustomizers(tomcatKeycloakContextCustomizer());
-
-                } else if (configurableServletWebServerFactory instanceof UndertowServletWebServerFactory){
-
-                    UndertowServletWebServerFactory container = (UndertowServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addDeploymentInfoCustomizers(undertowKeycloakContextCustomizer());
-
-                } else if (configurableServletWebServerFactory instanceof JettyServletWebServerFactory){
-
-                    JettyServletWebServerFactory container = (JettyServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addServerCustomizers(jettyKeycloakServerCustomizer());
-                }
-            }
-
-        };
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"org.eclipse.jetty.webapp.WebAppContext"})
-    public JettyServerCustomizer jettyKeycloakServerCustomizer() {
-        return new KeycloakJettyServerCustomizer(keycloakProperties);
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"org.apache.catalina.startup.Tomcat"})
-    public TomcatContextCustomizer tomcatKeycloakContextCustomizer() {
-        return new KeycloakTomcatContextCustomizer(keycloakProperties);
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"io.undertow.Undertow"})
-    public UndertowDeploymentInfoCustomizer undertowKeycloakContextCustomizer() {
-        return new KeycloakUndertowDeploymentInfoCustomizer(keycloakProperties);
-    }
-
-    static class KeycloakJettyServerCustomizer extends KeycloakBaseJettyServerCustomizer implements JettyServerCustomizer {
-
-
-        public KeycloakJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
-        }
-
-    }
-
-    static class KeycloakTomcatContextCustomizer extends KeycloakBaseTomcatContextCustomizer implements TomcatContextCustomizer {
-
-        public KeycloakTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
-        }
-    }
-
-    static class KeycloakUndertowDeploymentInfoCustomizer extends KeycloakBaseUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
-
-        public KeycloakUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties){
-            super(keycloakProperties);
-        }
-    }
-}

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/client/KeycloakRestTemplateCustomizer.java

@@ -1,24 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.springframework.boot.web.client.RestTemplateCustomizer;
-import org.springframework.web.client.RestTemplate;
-
-public class KeycloakRestTemplateCustomizer implements RestTemplateCustomizer {
-
-    private final KeycloakSecurityContextClientRequestInterceptor keycloakInterceptor;
-
-    public KeycloakRestTemplateCustomizer() {
-        this(new KeycloakSecurityContextClientRequestInterceptor());
-    }
-
-    protected KeycloakRestTemplateCustomizer(
-            KeycloakSecurityContextClientRequestInterceptor keycloakInterceptor
-    ) {
-        this.keycloakInterceptor = keycloakInterceptor;
-    }
-
-    @Override
-    public void customize(RestTemplate restTemplate) {
-        restTemplate.getInterceptors().add(keycloakInterceptor);
-    }
-}

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/client/KeycloakSecurityContextClientRequestInterceptor.java

@@ -1,55 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.springframework.http.HttpRequest;
-import org.springframework.http.client.ClientHttpRequestExecution;
-import org.springframework.http.client.ClientHttpRequestInterceptor;
-import org.springframework.http.client.ClientHttpResponse;
-import org.springframework.web.context.request.RequestContextHolder;
-import org.springframework.web.context.request.ServletRequestAttributes;
-
-import java.io.IOException;
-import java.security.Principal;
-
-/**
- * Interceptor for {@link ClientHttpRequestExecution} objects created for server to server secured
- * communication using OAuth2 bearer tokens issued by Keycloak.
- *
- * @author <a href="mailto:jmcshan1@gmail.com">James McShane</a>
- * @version $Revision: 1 $
- */
-public class KeycloakSecurityContextClientRequestInterceptor implements ClientHttpRequestInterceptor {
-
-    private static final String AUTHORIZATION_HEADER = "Authorization";
-
-    /**
-     * Returns the {@link KeycloakSecurityContext} from the Spring {@link ServletRequestAttributes}'s {@link Principal}.
-     *
-     * The principal must support retrieval of the KeycloakSecurityContext, so at this point, only {@link KeycloakPrincipal}
-     * values are supported
-     *
-     * @return the current <code>KeycloakSecurityContext</code>
-     */
-    protected KeycloakSecurityContext getKeycloakSecurityContext() {
-        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
-        Principal principal = attributes.getRequest().getUserPrincipal();
-        if (principal == null) {
-            throw new IllegalStateException("Cannot set authorization header because there is no authenticated principal");
-        }
-        if (!(principal instanceof KeycloakPrincipal)) {
-            throw new IllegalStateException(
-                    String.format(
-                            "Cannot set authorization header because the principal type %s does not provide the KeycloakSecurityContext",
-                            principal.getClass()));
-        }
-        return ((KeycloakPrincipal) principal).getKeycloakSecurityContext();
-    }
-
-    @Override
-    public ClientHttpResponse intercept(HttpRequest httpRequest, byte[] bytes, ClientHttpRequestExecution clientHttpRequestExecution) throws IOException {
-        KeycloakSecurityContext context = this.getKeycloakSecurityContext();
-        httpRequest.getHeaders().set(AUTHORIZATION_HEADER, "Bearer " + context.getTokenString());
-        return clientHttpRequestExecution.execute(httpRequest, bytes);
-    }
-}

adapters/oidc/spring-boot2/src/main/resources/META-INF/spring.factories

@@ -1,2 +0,0 @@
-org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.keycloak.adapters.springboot.KeycloakAutoConfiguration

adapters/oidc/spring-boot2/src/test/java/org/keycloak/adapters/springboot/client/KeycloakRestTemplateCustomizerTest.java

@@ -1,28 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.web.client.RestTemplate;
-
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
-
-public class KeycloakRestTemplateCustomizerTest {
-
-    private KeycloakRestTemplateCustomizer customizer;
-    private KeycloakSecurityContextClientRequestInterceptor interceptor =
-            mock(KeycloakSecurityContextClientRequestInterceptor.class);
-
-    @Before
-    public void setup() {
-        customizer = new KeycloakRestTemplateCustomizer(interceptor);
-    }
-
-    @Test
-    public void interceptorIsAddedToRequest() {
-        RestTemplate restTemplate = new RestTemplate();
-        customizer.customize(restTemplate);
-        assertTrue(restTemplate.getInterceptors().contains(interceptor));
-    }
-
-}

adapters/oidc/spring-boot2/src/test/java/org/keycloak/adapters/springboot/client/KeycloakSecurityContextClientRequestInterceptorTest.java

@@ -1,87 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot.client;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.mockito.Mock;
-import org.mockito.MockitoAnnotations;
-import org.mockito.Spy;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.web.context.request.RequestContextHolder;
-import org.springframework.web.context.request.ServletRequestAttributes;
-
-import java.security.Principal;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.mockito.Mockito.when;
-
-/**
- * Keycloak spring boot client request factory tests.
- */
-public class KeycloakSecurityContextClientRequestInterceptorTest {
-
-    @Spy
-    private KeycloakSecurityContextClientRequestInterceptor factory;
-
-    private MockHttpServletRequest servletRequest;
-
-    @Mock
-    private KeycloakSecurityContext keycloakSecurityContext;
-
-    @Mock
-    private KeycloakPrincipal keycloakPrincipal;
-
-    @Before
-    public void setUp() {
-        MockitoAnnotations.initMocks(this);
-        servletRequest = new MockHttpServletRequest();
-        RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(servletRequest));
-        servletRequest.setUserPrincipal(keycloakPrincipal);
-        when(keycloakPrincipal.getKeycloakSecurityContext()).thenReturn(keycloakSecurityContext);
-    }
-
-    @Test
-    public void testGetKeycloakSecurityContext() throws Exception {
-        KeycloakSecurityContext context = factory.getKeycloakSecurityContext();
-        assertNotNull(context);
-        assertEquals(keycloakSecurityContext, context);
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testGetKeycloakSecurityContextInvalidPrincipal() throws Exception {
-        servletRequest.setUserPrincipal(new MarkerPrincipal());
-        factory.getKeycloakSecurityContext();
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testGetKeycloakSecurityContextNullAuthentication() throws Exception {
-        servletRequest.setUserPrincipal(null);
-        factory.getKeycloakSecurityContext();
-    }
-
-    private static class MarkerPrincipal implements Principal {
-        @Override
-        public String getName() {
-            return null;
-        }
-    }
-}

adapters/oidc/spring-security/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>3.3.0.CR2</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/HttpHeaderInspectingApiRequestMatcher.java

@@ -45,7 +45,11 @@ public class HttpHeaderInspectingApiRequestMatcher implements RequestMatcher {
      */
     @Override
     public boolean matches(HttpServletRequest request) {
-        return X_REQUESTED_WITH_HEADER_AJAX_VALUE.equals(request.getHeader(X_REQUESTED_WITH_HEADER));
+        boolean ajax = X_REQUESTED_WITH_HEADER_AJAX_VALUE.equals(request.getHeader(X_REQUESTED_WITH_HEADER));
+        boolean html = request.getHeader(HttpHeaders.ACCEPT) != null && request.getHeader(HttpHeaders.ACCEPT).contains(
+                MediaType.TEXT_HTML_VALUE);
+
+        return ajax || !html;
     }
 
 }

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/KeycloakAuthenticationEntryPoint.java

@@ -17,16 +17,7 @@
 
 package org.keycloak.adapters.springsecurity.authentication;
 
-import java.io.IOException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
 import org.apache.http.HttpHeaders;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
@@ -35,6 +26,17 @@ import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import org.keycloak.adapters.AdapterDeploymentContext;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
+import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+
 /**
  * Provides a Keycloak {@link AuthenticationEntryPoint authentication entry point}. Uses a
  * {@link RequestMatcher} to determine if the request is an interactive login request or a
@@ -60,14 +62,15 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
     private final RequestMatcher apiRequestMatcher;
     private String loginUri = DEFAULT_LOGIN_URI;
     private String realm = DEFAULT_REALM;
-
+ 
     private AdapterDeploymentContext adapterDeploymentContext;
 
     /**
      * Creates a new Keycloak authentication entry point.
      */
     public KeycloakAuthenticationEntryPoint(AdapterDeploymentContext adapterDeploymentContext) {
-        this(adapterDeploymentContext, DEFAULT_API_REQUEST_MATCHER);
+        this(DEFAULT_API_REQUEST_MATCHER);
+        this.adapterDeploymentContext = adapterDeploymentContext;
     }
 
     /**
@@ -77,15 +80,14 @@ public class KeycloakAuthenticationEntryPoint implements AuthenticationEntryPoin
      * @param apiRequestMatcher the <code>RequestMatcher</code> to use to determine
      * if the current request is an API request or a browser request (required)
      */
-    public KeycloakAuthenticationEntryPoint(AdapterDeploymentContext adapterDeploymentContext, RequestMatcher apiRequestMatcher) {
+    public KeycloakAuthenticationEntryPoint(RequestMatcher apiRequestMatcher) {
         Assert.notNull(apiRequestMatcher, "apiRequestMatcher required");
-        Assert.notNull(adapterDeploymentContext, "adapterDeploymentContext required");
-        this.adapterDeploymentContext = adapterDeploymentContext;
         this.apiRequestMatcher = apiRequestMatcher;
     }
 
     @Override
-    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
+    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException
+    {
         HttpFacade facade = new SimpleHttpFacade(request, response);
         if (apiRequestMatcher.matches(request) || adapterDeploymentContext.resolveDeployment(facade).isBearerOnly()) {
             commenceUnauthorizedResponse(request, response);

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/KeycloakAuthenticationFailureHandler.java

@@ -17,13 +17,14 @@
 
 package org.keycloak.adapters.springsecurity.authentication;
 
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.web.authentication.AuthenticationFailureHandler;
+import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 
 /**
  * To return the forbidden code with the corresponding message.
@@ -35,14 +36,6 @@ public class KeycloakAuthenticationFailureHandler implements AuthenticationFailu
 
 	@Override
 	public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
-		// Check that the response was not committed yet (this may happen when another
-		// part of the Keycloak adapter sends a challenge or a redirect).
-		if (!response.isCommitted()) {
-			response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unable to authenticate using the Authorization header");
-		} else {
-			if (200 <= response.getStatus() && response.getStatus() < 300) {
-				throw new RuntimeException("Success response was committed while authentication failed!", exception);
-			}
-		}
+		response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unable to authenticate using the Authorization header");
 	}
 }

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/KeycloakAuthenticationProvider.java

@@ -50,7 +50,7 @@ public class KeycloakAuthenticationProvider implements AuthenticationProvider {
         for (String role : token.getAccount().getRoles()) {
             grantedAuthorities.add(new KeycloakRole(role));
         }
-        return new KeycloakAuthenticationToken(token.getAccount(), token.isInteractive(), mapAuthorities(grantedAuthorities));
+        return new KeycloakAuthenticationToken(token.getAccount(), mapAuthorities(grantedAuthorities));
     }
 
     private Collection<? extends GrantedAuthority> mapAuthorities(

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/authentication/SpringSecurityRequestAuthenticator.java

@@ -94,7 +94,7 @@ public class SpringSecurityRequestAuthenticator extends RequestAuthenticator {
 
         logger.debug("Completing bearer authentication. Bearer roles: {} ",roles);
 
-        SecurityContextHolder.getContext().setAuthentication(new KeycloakAuthenticationToken(account, false));
+        SecurityContextHolder.getContext().setAuthentication(new KeycloakAuthenticationToken(account));
         request.setAttribute(KeycloakSecurityContext.class.getName(), securityContext);
     }
 

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/config/KeycloakWebSecurityConfigurerAdapter.java

@@ -23,11 +23,9 @@ import org.keycloak.adapters.springsecurity.AdapterDeploymentContextFactoryBean;
 import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationEntryPoint;
 import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
 import org.keycloak.adapters.springsecurity.authentication.KeycloakLogoutHandler;
-import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticatedActionsFilter;
 import org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter;
 import org.keycloak.adapters.springsecurity.filter.KeycloakCsrfRequestMatcher;
 import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter;
-import org.keycloak.adapters.springsecurity.filter.KeycloakSecurityContextRequestFilter;
 import org.keycloak.adapters.springsecurity.management.HttpSessionManager;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
@@ -43,7 +41,6 @@ import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.logout.LogoutFilter;
 import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
-import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter;
 
 /**
  * Provides a convenient base class for creating a {@link WebSecurityConfigurer}
@@ -94,11 +91,6 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
         return new KeycloakPreAuthActionsFilter(httpSessionManager());
     }
 
-    @Bean
-    protected KeycloakAuthenticatedActionsFilter keycloakAuthenticatedActionsFilter() {
-        return new KeycloakAuthenticatedActionsFilter();
-    }
-
     protected KeycloakCsrfRequestMatcher keycloakCsrfRequestMatcher() {
         return new KeycloakCsrfRequestMatcher();
     }
@@ -125,8 +117,6 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
                 .and()
                 .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
                 .addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class)
-                .addFilterBefore(keycloakAuthenticatedActionsFilter(), BasicAuthenticationFilter.class)
-                .addFilterAfter(keycloakSecurityContextRequestFilter(), SecurityContextHolderAwareRequestFilter.class)
                 .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
                 .and()
                 .logout()
@@ -134,9 +124,4 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
                 .logoutUrl("/sso/logout").permitAll()
                 .logoutSuccessUrl("/");
     }
-
-    @Bean
-    protected KeycloakSecurityContextRequestFilter keycloakSecurityContextRequestFilter() {
-        return new KeycloakSecurityContextRequestFilter();
-    }
 }

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/facade/WrappedHttpServletRequest.java

@@ -24,8 +24,6 @@ import org.keycloak.adapters.spi.LogoutError;
 import org.springframework.util.Assert;
 
 import javax.servlet.http.HttpServletRequest;
-
-import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
@@ -42,7 +40,6 @@ import java.util.List;
 class WrappedHttpServletRequest implements Request {
 
     private final HttpServletRequest request;
-    private InputStream inputStream;
 
     /**
      * Creates a new request for the given <code>HttpServletRequest</code>
@@ -125,27 +122,10 @@ class WrappedHttpServletRequest implements Request {
 
     @Override
     public InputStream getInputStream() {
-        return getInputStream(false);
-    }
-
-    @Override
-    public InputStream getInputStream(boolean buffered) {
-        if (inputStream != null) {
-            return inputStream;
-        }
-
-        if (buffered) {
-            try {
-                return inputStream = new BufferedInputStream(request.getInputStream());
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
         try {
             return request.getInputStream();
         } catch (IOException e) {
-            throw new RuntimeException(e);
+            throw new RuntimeException("Unable to get request input stream", e);
         }
     }
 

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakAuthenticationProcessingFilter.java

@@ -24,7 +24,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AdapterTokenStore;
 import org.keycloak.adapters.KeycloakDeployment;
@@ -37,7 +36,6 @@ import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticatio
 import org.keycloak.adapters.springsecurity.authentication.SpringSecurityRequestAuthenticator;
 import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
 import org.keycloak.adapters.springsecurity.token.AdapterTokenStoreFactory;
-import org.keycloak.adapters.springsecurity.token.KeycloakAuthenticationToken;
 import org.keycloak.adapters.springsecurity.token.SpringSecurityAdapterTokenStoreFactory;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -63,19 +61,19 @@ import org.springframework.util.Assert;
  * @version $Revision: 1 $
  */
 public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter implements ApplicationContextAware {
+
     public static final String DEFAULT_LOGIN_URL = "/sso/login";
     public static final String AUTHORIZATION_HEADER = "Authorization";
+    public static final String SCHEME_BEARER = "bearer ";
+    public static final String SCHEME_BASIC = "basic ";
+
 
     /**
      * Request matcher that matches requests to the {@link KeycloakAuthenticationEntryPoint#DEFAULT_LOGIN_URI default login URI}
      * and any request with a <code>Authorization</code> header.
      */
     public static final RequestMatcher DEFAULT_REQUEST_MATCHER =
-            new OrRequestMatcher(
-                    new AntPathRequestMatcher(DEFAULT_LOGIN_URL),
-                    new RequestHeaderRequestMatcher(AUTHORIZATION_HEADER),
-                    new QueryParamPresenceRequestMatcher(OAuth2Constants.ACCESS_TOKEN)
-            );
+            new OrRequestMatcher(new AntPathRequestMatcher(DEFAULT_LOGIN_URL), new RequestHeaderRequestMatcher(AUTHORIZATION_HEADER));
 
     private static final Logger log = LoggerFactory.getLogger(KeycloakAuthenticationProcessingFilter.class);
 
@@ -183,10 +181,36 @@ public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticati
         }
     }
 
+    /**
+     * Returns true if the request was made with a bearer token authorization header.
+     *
+     * @param request the current <code>HttpServletRequest</code>
+     *
+     * @return <code>true</code> if the <code>request</code> was made with a bearer token authorization header;
+     * <code>false</code> otherwise.
+     */
+    protected boolean isBearerTokenRequest(HttpServletRequest request) {
+        String authValue = request.getHeader(AUTHORIZATION_HEADER);
+        return authValue != null && authValue.toLowerCase().startsWith(SCHEME_BEARER);
+    }
+
+    /**
+     * Returns true if the request was made with a Basic authentication authorization header.
+     *
+     * @param request the current <code>HttpServletRequest</code>
+     * @return <code>true</code> if the <code>request</code> was made with a Basic authentication authorization header;
+     * <code>false</code> otherwise.
+     */
+    protected boolean isBasicAuthRequest(HttpServletRequest request) {
+        String authValue = request.getHeader(AUTHORIZATION_HEADER);
+        return authValue != null && authValue.toLowerCase().startsWith(SCHEME_BASIC);
+    }
+
     @Override
     protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                             Authentication authResult) throws IOException, ServletException {
-        if (authResult instanceof KeycloakAuthenticationToken && ((KeycloakAuthenticationToken) authResult).isInteractive()) {
+
+        if (!(this.isBearerTokenRequest(request) || this.isBasicAuthRequest(request))) {
             super.successfulAuthentication(request, response, chain, authResult);
             return;
         }
@@ -207,6 +231,7 @@ public class KeycloakAuthenticationProcessingFilter extends AbstractAuthenticati
         } finally {
             SecurityContextHolder.clearContext();
         }
+
     }
 
     @Override

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakSecurityContextRequestFilter.java

@@ -1,109 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.springsecurity.filter;
-
-import java.io.IOException;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.springframework.beans.BeansException;
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationContextAware;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.web.filter.GenericFilterBean;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakSecurityContextRequestFilter extends GenericFilterBean implements ApplicationContextAware {
-
-    private static final String FILTER_APPLIED = KeycloakSecurityContext.class.getPackage().getName() + ".token-refreshed";
-
-    private ApplicationContext applicationContext;
-    private AdapterDeploymentContext deploymentContext;
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
-        if (request.getAttribute(FILTER_APPLIED) != null) {
-            filterChain.doFilter(request, response);
-            return;
-        }
-
-        request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
-
-        KeycloakSecurityContext keycloakSecurityContext = getKeycloakPrincipal();
-
-        if (keycloakSecurityContext instanceof RefreshableKeycloakSecurityContext) {
-            RefreshableKeycloakSecurityContext refreshableSecurityContext = (RefreshableKeycloakSecurityContext) keycloakSecurityContext;
-            KeycloakDeployment deployment = resolveDeployment(request, response);
-
-            if (deployment.isAlwaysRefreshToken()) {
-                if (refreshableSecurityContext.refreshExpiredToken(false)) {
-                    request.setAttribute(KeycloakSecurityContext.class.getName(), refreshableSecurityContext);
-                } else {
-                    clearAuthenticationContext();
-                }
-            }
-        }
-
-        filterChain.doFilter(request, response);
-    }
-
-    @Override
-    protected void initFilterBean() {
-        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
-    }
-
-    @Override
-    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
-        this.applicationContext = applicationContext;
-    }
-
-    private KeycloakSecurityContext getKeycloakPrincipal() {
-        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-
-        if (authentication != null) {
-            Object principal = authentication.getPrincipal();
-
-            if (principal instanceof KeycloakPrincipal) {
-                return KeycloakPrincipal.class.cast(principal).getKeycloakSecurityContext();
-            }
-        }
-
-        return null;
-    }
-
-    private KeycloakDeployment resolveDeployment(ServletRequest servletRequest, ServletResponse servletResponse) {
-        return deploymentContext.resolveDeployment(new SimpleHttpFacade(HttpServletRequest.class.cast(servletRequest), HttpServletResponse.class.cast(servletResponse)));
-    }
-
-    private void clearAuthenticationContext() {
-        SecurityContextHolder.clearContext();
-    }
-}

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/QueryParamPresenceRequestMatcher.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2017 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.springsecurity.filter;
-
-import javax.servlet.http.HttpServletRequest;
-
-import org.springframework.security.web.util.matcher.RequestMatcher;
-
-/**
- * Spring RequestMatcher that checks for the presence of a query parameter.
- *
- * @author <a href="mailto:glavoie@gmail.com">Gabriel Lavoie</a>
- */
-public class QueryParamPresenceRequestMatcher implements RequestMatcher {
-    private String param;
-
-    public QueryParamPresenceRequestMatcher(String param) {
-        this.param = param;
-    }
-
-    @Override
-    public boolean matches(HttpServletRequest httpServletRequest) {
-        return param != null && httpServletRequest.getParameter(param) != null;
-    }
-}

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/token/KeycloakAuthenticationToken.java

@@ -38,27 +38,24 @@ import java.util.Collection;
 public class KeycloakAuthenticationToken extends AbstractAuthenticationToken implements Authentication {
 
     private Principal principal;
-    private boolean interactive;
 
     /**
      * Creates a new, unauthenticated Keycloak security token for the given account.
      */
-    public KeycloakAuthenticationToken(KeycloakAccount account, boolean interactive) {
+    public KeycloakAuthenticationToken(KeycloakAccount account) {
         super(null);
         Assert.notNull(account, "KeycloakAccount cannot be null");
         Assert.notNull(account.getPrincipal(), "KeycloakAccount.getPrincipal() cannot be null");
         this.principal = account.getPrincipal();
         this.setDetails(account);
-        this.interactive = interactive;
     }
 
-    public KeycloakAuthenticationToken(KeycloakAccount account, boolean interactive, Collection<? extends GrantedAuthority> authorities) {
+    public KeycloakAuthenticationToken(KeycloakAccount account, Collection<? extends GrantedAuthority> authorities) {
         super(authorities);
         Assert.notNull(account, "KeycloakAccount cannot be null");
         Assert.notNull(account.getPrincipal(), "KeycloakAccount.getPrincipal() cannot be null");
         this.principal = account.getPrincipal();
         this.setDetails(account);
-        this.interactive = interactive;
         setAuthenticated(true);
     }
 
@@ -75,8 +72,4 @@ public class KeycloakAuthenticationToken extends AbstractAuthenticationToken imp
     public OidcKeycloakAccount getAccount() {
         return (OidcKeycloakAccount) this.getDetails();
     }
-
-    public boolean isInteractive() {
-        return interactive;
-    }
 }

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/token/SpringSecurityTokenStore.java

@@ -105,7 +105,7 @@ public class SpringSecurityTokenStore implements AdapterTokenStore {
         }
 
         logger.debug("Saving account info {}", account);
-        SecurityContextHolder.getContext().setAuthentication(new KeycloakAuthenticationToken(account, true));
+        SecurityContextHolder.getContext().setAuthentication(new KeycloakAuthenticationToken(account));
     }
 
     @Override

adapters/oidc/spring-security/src/test/java/org/keycloak/adapters/springsecurity/authentication/HttpHeaderInspectingApiRequestMatcherTest.java

@@ -39,9 +39,14 @@ public class HttpHeaderInspectingApiRequestMatcherTest {
         request = new MockHttpServletRequest();
     }
 
+    @Test
+    public void testMatches() throws Exception {
+        assertTrue(apiRequestMatcher.matches(request));
+    }
+
     @Test
     public void testMatchesBrowserRequest() throws Exception {
-        request.addHeader(HttpHeaders.ACCEPT, "application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
+        request.addHeader(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
         assertFalse(apiRequestMatcher.matches(request));
     }
 
@@ -50,7 +55,7 @@ public class HttpHeaderInspectingApiRequestMatcherTest {
         request.addHeader(
                 HttpHeaderInspectingApiRequestMatcher.X_REQUESTED_WITH_HEADER,
                 HttpHeaderInspectingApiRequestMatcher.X_REQUESTED_WITH_HEADER_AJAX_VALUE);
-        
         assertTrue(apiRequestMatcher.matches(request));
     }
+
 }