Set version to 4.0.0.Beta1

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -102,14 +102,6 @@ public class AuthenticatedActionsHandler {
         KeycloakSecurityContext securityContext = facade.getSecurityContext();
         String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
         String exposeHeaders = deployment.getCorsExposedHeaders();
-
-        if (deployment.getPolicyEnforcer() != null) {
-            if (exposeHeaders != null) {
-                exposeHeaders += ",";
-            }
-            exposeHeaders += "WWW-Authenticate";
-        }
-
         String requestOrigin = UriUtils.getOrigin(facade.getRequest().getURI());
         log.debugv("Origin: {0} uri: {1}", origin, facade.getRequest().getURI());
         if (securityContext != null && origin != null && !origin.equals(requestOrigin)) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -18,10 +18,8 @@
 package org.keycloak.adapters.authorization;
 
 import java.util.Collections;
-import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.Set;
 
 import org.jboss.logging.Logger;
@@ -32,12 +30,10 @@ import org.keycloak.adapters.spi.HttpFacade.Request;
 import org.keycloak.authorization.client.AuthzClient;
 import org.keycloak.authorization.client.ClientAuthorizationContext;
 import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.AccessToken.Authorization;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.EnforcementMode;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.MethodConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.ScopeEnforcementMode;
 import org.keycloak.representations.idm.authorization.Permission;
 
 /**
@@ -46,23 +42,31 @@ import org.keycloak.representations.idm.authorization.Permission;
 public abstract class AbstractPolicyEnforcer {
 
     private static Logger LOGGER = Logger.getLogger(AbstractPolicyEnforcer.class);
-    private static final String HTTP_METHOD_DELETE = "DELETE";
-
+    private final PolicyEnforcerConfig enforcerConfig;
     private final PolicyEnforcer policyEnforcer;
 
-    protected AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
+    private Map<String, PathConfig> paths;
+    private AuthzClient authzClient;
+    private PathMatcher pathMatcher;
+
+    public AbstractPolicyEnforcer(PolicyEnforcer policyEnforcer) {
         this.policyEnforcer = policyEnforcer;
+        this.enforcerConfig = policyEnforcer.getEnforcerConfig();
+        this.authzClient = policyEnforcer.getClient();
+        this.pathMatcher = policyEnforcer.getPathMatcher();
+        this.paths = policyEnforcer.getPaths();
     }
 
     public AuthorizationContext authorize(OIDCHttpFacade httpFacade) {
-        EnforcementMode enforcementMode = getEnforcerConfig().getEnforcementMode();
+        EnforcementMode enforcementMode = this.enforcerConfig.getEnforcementMode();
 
         if (EnforcementMode.DISABLED.equals(enforcementMode)) {
             return createEmptyAuthorizationContext(true);
         }
 
         Request request = httpFacade.getRequest();
-        PathConfig pathConfig = getPathConfig(request);
+        String path = getPath(request);
+        PathConfig pathConfig = this.pathMatcher.matches(path, this.paths);
         KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
 
         if (securityContext == null) {
@@ -75,20 +79,16 @@ public abstract class AbstractPolicyEnforcer {
         AccessToken accessToken = securityContext.getToken();
 
         if (accessToken != null) {
-            if (LOGGER.isDebugEnabled()) {
-                LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
-            }
+            LOGGER.debugf("Checking permissions for path [%s] with config [%s].", request.getURI(), pathConfig);
 
             if (pathConfig == null) {
                 if (EnforcementMode.PERMISSIVE.equals(enforcementMode)) {
                     return createAuthorizationContext(accessToken, null);
                 }
 
-                if (LOGGER.isDebugEnabled()) {
-                    LOGGER.debugf("Could not find a configuration for path [%s]", getPath(request));
-                }
+                LOGGER.debugf("Could not find a configuration for path [%s]", path);
 
-                if (isDefaultAccessDeniedUri(request)) {
+                if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
                     return createAuthorizationContext(accessToken, null);
                 }
 
@@ -98,7 +98,7 @@ public abstract class AbstractPolicyEnforcer {
             }
 
             if (EnforcementMode.DISABLED.equals(pathConfig.getEnforcementMode())) {
-                return createAuthorizationContext(accessToken, pathConfig);
+                return createEmptyAuthorizationContext(true);
             }
 
             MethodConfig methodConfig = getRequiredScopes(pathConfig, request);
@@ -111,18 +111,10 @@ public abstract class AbstractPolicyEnforcer {
                 }
             }
 
-            if (methodConfig != null && ScopeEnforcementMode.DISABLED.equals(methodConfig.getScopesEnforcementMode())) {
-                return createEmptyAuthorizationContext(true);
-            }
-
-            if (LOGGER.isDebugEnabled()) {
-                LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
-            }
+            LOGGER.debugf("Sending challenge to the client. Path [%s]", pathConfig);
 
             if (!challenge(pathConfig, methodConfig, httpFacade)) {
-                if (LOGGER.isDebugEnabled()) {
-                    LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
-                }
+                LOGGER.debugf("Challenge not sent, sending default forbidden response. Path [%s]", pathConfig);
                 handleAccessDenied(httpFacade);
             }
         }
@@ -134,21 +126,22 @@ public abstract class AbstractPolicyEnforcer {
 
     protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         Request request = httpFacade.getRequest();
+        PolicyEnforcerConfig enforcerConfig = getEnforcerConfig();
 
-        if (isDefaultAccessDeniedUri(request)) {
+        if (isDefaultAccessDeniedUri(request, enforcerConfig)) {
             return true;
         }
 
-        Authorization authorization = accessToken.getAuthorization();
+        AccessToken.Authorization authorization = accessToken.getAuthorization();
 
         if (authorization == null) {
             return false;
         }
 
+        List<Permission> permissions = authorization.getPermissions();
         boolean hasPermission = false;
-        List<Permission> grantedPermissions = authorization.getPermissions();
 
-        for (Permission permission : grantedPermissions) {
+        for (Permission permission : permissions) {
             if (permission.getResourceId() != null) {
                 if (isResourcePermission(actualPathConfig, permission)) {
                     hasPermission = true;
@@ -158,14 +151,11 @@ public abstract class AbstractPolicyEnforcer {
                     }
 
                     if (hasResourceScopePermission(methodConfig, permission)) {
-                        if (LOGGER.isDebugEnabled()) {
-                            LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, grantedPermissions);
+                        LOGGER.debugf("Authorization GRANTED for path [%s]. Permissions [%s].", actualPathConfig, permissions);
+                        if (request.getMethod().equalsIgnoreCase("DELETE") && actualPathConfig.isInstance()) {
+                            this.paths.remove(actualPathConfig);
                         }
-                        if (HTTP_METHOD_DELETE.equalsIgnoreCase(request.getMethod()) && actualPathConfig.isInstance()) {
-                            policyEnforcer.getPathMatcher().removeFromCache(getPath(request));
-                        }
-
-                        return hasValidClaims(actualPathConfig, httpFacade, authorization);
+                        return true;
                     }
                 }
             } else {
@@ -180,67 +170,24 @@ public abstract class AbstractPolicyEnforcer {
             return true;
         }
 
-        if (LOGGER.isDebugEnabled()) {
-            LOGGER.debugf("Authorization FAILED for path [%s]. Not enough permissions [%s].", actualPathConfig, grantedPermissions);
-        }
+        LOGGER.debugf("Authorization FAILED for path [%s]. Not enough permissions [%s].", actualPathConfig, permissions);
 
         return false;
     }
 
-    private boolean hasValidClaims(PathConfig actualPathConfig, OIDCHttpFacade httpFacade, Authorization authorization) {
-        Map<String, Map<String, Object>> claimInformationPointConfig = actualPathConfig.getClaimInformationPointConfig();
-
-        if (claimInformationPointConfig != null) {
-            Map<String, List<String>> claims = new HashMap<>();
-
-            for (Entry<String, Map<String, Object>> entry : claimInformationPointConfig.entrySet()) {
-                ClaimInformationPointProviderFactory factory = policyEnforcer.getClaimInformationPointProviderFactories().get(entry.getKey());
-
-                if (factory == null) {
-                    throw new RuntimeException("Could not find claim information provider with name [" + entry.getKey() + "]");
-                }
-
-                claims.putAll(factory.create(entry.getValue()).resolve(httpFacade));
-            }
-
-            Map<String, List<String>> grantedClaims = authorization.getClaims();
-
-            if (grantedClaims != null) {
-                if (claims.isEmpty()) {
-                    return false;
-                }
-                for (Entry<String, List<String>> entry : grantedClaims.entrySet()) {
-                    List<String> requestClaims = claims.get(entry.getKey());
-
-                    if (requestClaims == null || requestClaims.isEmpty() || !entry.getValue().containsAll(requestClaims)) {
-                        return false;
-                    }
-                }
-            }
-        }
-
-        return true;
-    }
-
     protected void handleAccessDenied(OIDCHttpFacade httpFacade) {
         httpFacade.getResponse().sendError(403);
     }
 
-    protected AuthzClient getAuthzClient() {
-        return policyEnforcer.getClient();
-    }
+    private boolean isDefaultAccessDeniedUri(Request request, PolicyEnforcerConfig enforcerConfig) {
+        String accessDeniedPath = enforcerConfig.getOnDenyRedirectTo();
 
-    protected PolicyEnforcerConfig getEnforcerConfig() {
-        return policyEnforcer.getEnforcerConfig();
-    }
-
-    protected PolicyEnforcer getPolicyEnforcer() {
-        return policyEnforcer;
-    }
-
-    private boolean isDefaultAccessDeniedUri(Request request) {
-        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
-        return accessDeniedPath != null && request.getURI().contains(accessDeniedPath);
+        if (accessDeniedPath != null) {
+            if (request.getURI().contains(accessDeniedPath)) {
+                return true;
+            }
+        }
+        return false;
     }
 
     private boolean hasResourceScopePermission(MethodConfig methodConfig, Permission permission) {
@@ -268,8 +215,20 @@ public abstract class AbstractPolicyEnforcer {
         return requiredScopes.isEmpty();
     }
 
+    protected AuthzClient getAuthzClient() {
+        return this.authzClient;
+    }
+
+    protected PolicyEnforcerConfig getEnforcerConfig() {
+        return enforcerConfig;
+    }
+
+    protected PolicyEnforcer getPolicyEnforcer() {
+        return policyEnforcer;
+    }
+
     private AuthorizationContext createEmptyAuthorizationContext(final boolean granted) {
-        return new ClientAuthorizationContext(getAuthzClient()) {
+        return new ClientAuthorizationContext(authzClient) {
             @Override
             public boolean hasPermission(String resourceName, String scopeName) {
                 return granted;
@@ -320,7 +279,7 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private AuthorizationContext createAuthorizationContext(AccessToken accessToken, PathConfig pathConfig) {
-        return new ClientAuthorizationContext(accessToken, pathConfig, getAuthzClient());
+        return new ClientAuthorizationContext(accessToken, pathConfig, this.paths, authzClient);
     }
 
     private boolean isResourcePermission(PathConfig actualPathConfig, Permission permission) {
@@ -338,8 +297,4 @@ public abstract class AbstractPolicyEnforcer {
     private boolean matchResourcePermission(PathConfig actualPathConfig, Permission permission) {
         return permission.getResourceId().equals(actualPathConfig.getId());
     }
-
-    private PathConfig getPathConfig(Request request) {
-        return isDefaultAccessDeniedUri(request) ? null : policyEnforcer.getPathMatcher().matches(getPath(request));
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/BearerTokenPolicyEnforcer.java

@@ -0,0 +1,81 @@
+/*
+ *  Copyright 2016 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package org.keycloak.adapters.authorization;
+
+import java.util.HashSet;
+
+import org.jboss.logging.Logger;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.resource.PermissionResource;
+import org.keycloak.authorization.client.resource.ProtectionResource;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
+import org.keycloak.representations.idm.authorization.PermissionRequest;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class BearerTokenPolicyEnforcer extends AbstractPolicyEnforcer {
+
+    private static Logger LOGGER = Logger.getLogger(BearerTokenPolicyEnforcer.class);
+
+    public BearerTokenPolicyEnforcer(PolicyEnforcer enforcer) {
+        super(enforcer);
+    }
+
+    @Override
+    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade facade) {
+        HttpFacade.Response response = facade.getResponse();
+        AuthzClient authzClient = getAuthzClient();
+        String ticket = getPermissionTicket(pathConfig, methodConfig, authzClient);
+
+        if (ticket == null) {
+            response.setStatus(403);
+            return true;
+        }
+
+        String realm = authzClient.getConfiguration().getRealm();
+        String authorizationServerUri = authzClient.getServerConfiguration().getIssuer().toString();
+        response.setStatus(401);
+        StringBuilder wwwAuthenticate = new StringBuilder("UMA realm=\"").append(realm).append("\"").append(",as_uri=\"").append(authorizationServerUri).append("\"");
+
+        if (ticket != null) {
+            wwwAuthenticate.append(",ticket=\"").append(ticket).append("\"");
+        }
+
+        response.setHeader("WWW-Authenticate", wwwAuthenticate.toString());
+        if (LOGGER.isDebugEnabled()) {
+            LOGGER.debug("Sending UMA challenge");
+        }
+        return true;
+    }
+
+    private String getPermissionTicket(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AuthzClient authzClient) {
+        if (getEnforcerConfig().getUserManagedAccess() != null) {
+            ProtectionResource protection = authzClient.protection();
+            PermissionResource permission = protection.permission();
+            PermissionRequest permissionRequest = new PermissionRequest();
+            permissionRequest.setResourceId(pathConfig.getId());
+            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
+            return permission.create(permissionRequest).getTicket();
+        }
+        return null;
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/ClaimInformationPointProvider.java

@@ -1,30 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization;
-
-import java.util.List;
-import java.util.Map;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface ClaimInformationPointProvider {
-
-    Map<String, List<String>> resolve(HttpFacade httpFacade);
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/ClaimInformationPointProviderFactory.java

@@ -1,33 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization;
-
-import java.util.Map;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface ClaimInformationPointProviderFactory<C extends ClaimInformationPointProvider> {
-
-    String getName();
-
-    void init(PolicyEnforcer policyEnforcer);
-
-    C create(Map<String, Object> config);
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -18,11 +18,7 @@
 package org.keycloak.adapters.authorization;
 
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
 
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakSecurityContext;
@@ -32,9 +28,6 @@ import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthorizationDeniedException;
 import org.keycloak.authorization.client.AuthzClient;
-import org.keycloak.authorization.client.resource.PermissionResource;
-import org.keycloak.authorization.client.resource.ProtectionResource;
-import org.keycloak.common.util.Base64;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
@@ -42,7 +35,7 @@ import org.keycloak.representations.idm.authorization.AuthorizationRequest;
 import org.keycloak.representations.idm.authorization.AuthorizationResponse;
 import org.keycloak.representations.idm.authorization.Permission;
 import org.keycloak.representations.idm.authorization.PermissionRequest;
-import org.keycloak.util.JsonSerialization;
+import org.keycloak.representations.idm.authorization.PermissionResponse;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -79,27 +72,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         AccessToken.Authorization newAuthorization = accessToken.getAuthorization();
 
         if (newAuthorization != null) {
-            List<Permission> grantedPermissions = authorization.getPermissions();
-            List<Permission> newPermissions = newAuthorization.getPermissions();
-
-            for (Permission newPermission : newPermissions) {
-                if (!grantedPermissions.contains(newPermission)) {
-                    grantedPermissions.add(newPermission);
-                }
-            }
-
-            Map<String, List<String>> newClaims = newAuthorization.getClaims();
-
-            if (newClaims != null) {
-                Map<String, List<String>> claims = authorization.getClaims();
-
-                if (claims == null) {
-                    claims = new HashMap<>();
-                    authorization.setClaims(claims);
-                }
-
-                claims.putAll(newClaims);
-            }
+            authorization.getPermissions().addAll(newAuthorization.getPermissions());
         }
 
         original.setAuthorization(authorization);
@@ -108,29 +81,8 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
-        if (isBearerAuthorization(httpFacade)) {
-            HttpFacade.Response response = httpFacade.getResponse();
-            AuthzClient authzClient = getAuthzClient();
-            String ticket = getPermissionTicket(pathConfig, methodConfig, authzClient, httpFacade);
-
-            if (ticket != null) {
-                response.setStatus(401);
-                response.setHeader("WWW-Authenticate", new StringBuilder("UMA realm=\"").append(authzClient.getConfiguration().getRealm()).append("\"").append(",as_uri=\"")
-                        .append(authzClient.getServerConfiguration().getIssuer()).append("\"").append(",ticket=\"").append(ticket).append("\"").toString());
-            } else {
-                response.setStatus(403);
-            }
-
-            if (LOGGER.isDebugEnabled()) {
-                LOGGER.debug("Sending challenge");
-            }
-
-            return true;
-        }
-
-        handleAccessDenied(httpFacade);
-
+    protected boolean challenge(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade facade) {
+        handleAccessDenied(facade);
         return true;
     }
 
@@ -154,31 +106,28 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
-        if (getPolicyEnforcer().getDeployment().isBearerOnly() || (isBearerAuthorization(httpFacade) && getEnforcerConfig().getUserManagedAccess() != null)) {
-            return null;
-        }
-
         try {
             KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();
             String accessTokenString = securityContext.getTokenString();
+            AuthzClient authzClient = getAuthzClient();
             KeycloakDeployment deployment = getPolicyEnforcer().getDeployment();
+            PermissionRequest permissionRequest = new PermissionRequest();
+
+            permissionRequest.setResourceId(pathConfig.getId());
+            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
+
             AccessToken accessToken = securityContext.getToken();
-            AuthorizationRequest authzRequest = new AuthorizationRequest();
+            AuthorizationRequest authzRequest;
 
             if (getEnforcerConfig().getUserManagedAccess() != null) {
-                String ticket = getPermissionTicket(pathConfig, methodConfig, getAuthzClient(), httpFacade);
-                authzRequest.setTicket(ticket);
+                PermissionResponse permissionResponse = authzClient.protection().permission().create(permissionRequest);
+                authzRequest = new AuthorizationRequest();
+                authzRequest.setTicket(permissionResponse.getTicket());
             } else {
+                authzRequest = new AuthorizationRequest();
                 if (accessToken.getAuthorization() != null) {
                     authzRequest.addPermission(pathConfig.getId(), methodConfig.getScopes());
                 }
-
-                Map<String, List<String>> claims = getClaims(pathConfig, httpFacade);
-
-                if (!claims.isEmpty()) {
-                    authzRequest.setClaimTokenFormat("urn:ietf:params:oauth:token-type:jwt");
-                    authzRequest.setClaimToken(Base64.encodeBytes(JsonSerialization.writeValueAsBytes(claims)));
-                }
             }
 
             if (accessToken.getAuthorization() != null) {
@@ -186,70 +135,18 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
             }
 
             LOGGER.debug("Obtaining authorization for authenticated user.");
-            AuthorizationResponse authzResponse = getAuthzClient().authorization(accessTokenString).authorize(authzRequest);
+            AuthorizationResponse authzResponse = authzClient.authorization(accessTokenString).authorize(authzRequest);
 
             if (authzResponse != null) {
                 return AdapterRSATokenVerifier.verifyToken(authzResponse.getToken(), deployment);
             }
-        } catch (AuthorizationDeniedException ignore) {
-            LOGGER.debug("Authorization denied", ignore);
+
+            return null;
+        } catch (AuthorizationDeniedException e) {
+            LOGGER.debug("Authorization denied", e);
+            return null;
         } catch (Exception e) {
             throw new RuntimeException("Unexpected error during authorization request.", e);
         }
-
-        return null;
-    }
-
-    private String getPermissionTicket(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AuthzClient authzClient, HttpFacade httpFacade) {
-        if (getEnforcerConfig().getUserManagedAccess() != null) {
-            ProtectionResource protection = authzClient.protection();
-            PermissionResource permission = protection.permission();
-            PermissionRequest permissionRequest = new PermissionRequest();
-
-            permissionRequest.setResourceId(pathConfig.getId());
-            permissionRequest.setScopes(new HashSet<>(methodConfig.getScopes()));
-
-            Map<String, List<String>> claims = getClaims(pathConfig, httpFacade);
-
-            if (!claims.isEmpty()) {
-                permissionRequest.setClaims(claims);
-            }
-
-            return permission.create(permissionRequest).getTicket();
-        }
-
-        return null;
-    }
-
-    private Map<String, List<String>> getClaims(PathConfig pathConfig, HttpFacade httpFacade) {
-        Map<String, List<String>> claims = new HashMap<>();
-        Map<String, Map<String, Object>> claimInformationPointConfig = pathConfig.getClaimInformationPointConfig();
-
-        if (claimInformationPointConfig != null) {
-            for (Entry<String, Map<String, Object>> claimDef : claimInformationPointConfig.entrySet()) {
-                ClaimInformationPointProviderFactory factory = getPolicyEnforcer().getClaimInformationPointProviderFactories().get(claimDef.getKey());
-
-                if (factory != null) {
-                    claims.putAll(factory.create(claimDef.getValue()).resolve(httpFacade));
-                }
-            }
-        }
-        return claims;
-    }
-
-    private boolean isBearerAuthorization(OIDCHttpFacade httpFacade) {
-        List<String> authHeaders = httpFacade.getRequest().getHeaders("Authorization");
-        if (authHeaders == null || authHeaders.size() == 0) {
-            return false;
-        }
-
-        for (String authHeader : authHeaders) {
-            String[] split = authHeader.trim().split("\\s+");
-            if (split == null || split.length != 2) continue;
-            if (!split[0].equalsIgnoreCase("Bearer")) continue;
-            return true;
-        }
-
-        return false;
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathCache.java

@@ -24,8 +24,6 @@ import java.util.concurrent.locks.LockSupport;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
 /**
- * A simple LRU cache implementation supporting expiration and maximum number of entries.
- *
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
 public class PathCache {
@@ -40,7 +38,15 @@ public class PathCache {
     private final AtomicBoolean writing = new AtomicBoolean(false);
 
     private final long maxAge;
-    private final boolean enabled;
+
+    /**
+     * Creates a new instance.
+     *
+     * @param maxEntries the maximum number of entries to keep in the cache
+     */
+    public PathCache(int maxEntries) {
+        this(maxEntries, -1);
+    }
 
     /**
      * Creates a new instance.
@@ -56,14 +62,9 @@ public class PathCache {
             }
         };
         this.maxAge = maxAge;
-        this.enabled = maxAge > 0;
     }
 
     public void put(String uri, PathConfig newValue) {
-        if (!enabled) {
-            return;
-        }
-
         try {
             if (parkForWriteAndCheckInterrupt()) {
                 return;
@@ -79,10 +80,6 @@ public class PathCache {
         }
     }
 
-    public boolean containsKey(String uri) {
-        return cache.containsKey(uri);
-    }
-
     public PathConfig get(String uri) {
         if (parkForReadAndCheckInterrupt()) {
             return null;

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PathMatcher.java

@@ -1,44 +1,57 @@
 /*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
+ *  Copyright 2016 Red Hat, Inc. and/or its affiliates
+ *  and other contributors as indicated by the @author tags.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
  *
- * http://www.apache.org/licenses/LICENSE-2.0
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
  */
-package org.keycloak.common.util;
+package org.keycloak.adapters.authorization;
 
 import java.util.Arrays;
-import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+import org.keycloak.authorization.client.AuthzClient;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.resource.ProtectedResource;
+import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
-public abstract class PathMatcher<P> {
+class PathMatcher {
 
     private static final char WILDCARD = '*';
+    private final AuthzClient authzClient;
+    // TODO: make this configurable
+    private PathCache cache = new PathCache(100, 30000);
 
-    public P matches(final String targetUri) {
-        int patternCount = 0;
-        P matchingPath = null;
-        P matchingAnyPath = null;
-        P matchingAnySuffixPath = null;
+    public PathMatcher(AuthzClient authzClient) {
+        this.authzClient = authzClient;
+    }
 
-        for (P entry : getPaths()) {
-            String expectedUri = getPath(entry);
+    public PathConfig matches(final String targetUri, Map<String, PathConfig> paths) {
+        PathConfig pathConfig = paths.get(targetUri) == null ? cache.get(targetUri) : paths.get(targetUri);
 
-            if (expectedUri == null) {
-                continue;
-            }
+        if (pathConfig != null) {
+            return pathConfig;
+        }
 
+        PathConfig matchingAnyPath = null;
+        PathConfig matchingAnySuffixPath = null;
+
+        for (PathConfig entry : paths.values()) {
+            String expectedUri = entry.getPath();
             String matchingUri = null;
 
             if (exactMatch(expectedUri, targetUri, expectedUri)) {
@@ -49,17 +62,9 @@ public abstract class PathMatcher<P> {
                 String templateUri = buildUriFromTemplate(expectedUri, targetUri);
 
                 if (templateUri != null) {
-                    int length = expectedUri.split("\\/").length;
-
-                    if (exactMatch(expectedUri, targetUri, templateUri) && (patternCount == 0 || length > patternCount)) {
+                    if (exactMatch(expectedUri, targetUri, templateUri)) {
                         matchingUri = templateUri;
-                        P resolved = resolvePathConfig(entry, targetUri);
-
-                        if (resolved != null) {
-                            entry = resolved;
-                        }
-
-                        patternCount = length;
+                        entry = resolvePathConfig(entry, targetUri);
                     }
                 }
             }
@@ -85,15 +90,12 @@ public abstract class PathMatcher<P> {
                 }
 
                 if (matchingUri.equals(targetUri) || pathString.equals(targetUri)) {
-                    if (patternCount == 0) {
-                        return entry;
-                    } else {
-                        matchingPath = entry;
-                    }
+                    cache.put(targetUri, entry);
+                    return entry;
                 }
 
                 if (WILDCARD == expectedUri.charAt(expectedUri.length() - 1)) {
-                    if (matchingAnyPath == null || getPath(matchingAnyPath).length() < matchingUri.length()) {
+                    if (matchingAnyPath == null || matchingAnyPath.getPath().length() < matchingUri.length()) {
                         matchingAnyPath = entry;
                     }
                 } else {
@@ -110,21 +112,18 @@ public abstract class PathMatcher<P> {
             }
         }
 
-        if (matchingPath != null) {
-            return matchingPath;
+        if (matchingAnySuffixPath != null) {
+            cache.put(targetUri, matchingAnySuffixPath);
+            return matchingAnySuffixPath;
         }
 
-        if (matchingAnySuffixPath != null) {
-            return matchingAnySuffixPath;
+        if (matchingAnyPath != null) {
+            cache.put(targetUri, matchingAnyPath);
         }
 
         return matchingAnyPath;
     }
 
-    protected abstract String getPath(P entry);
-
-    protected abstract Collection<P> getPaths();
-
     private boolean exactMatch(String expectedUri, String targetUri, String value) {
         if (targetUri.equals(value)) {
             return value.equals(targetUri);
@@ -214,16 +213,32 @@ public abstract class PathMatcher<P> {
     }
 
     public boolean endsWithWildcard(String expectedUri) {
-        int length = expectedUri.length();
-        return length > 0 && WILDCARD == expectedUri.charAt(length - 1);
+        return WILDCARD == expectedUri.charAt(expectedUri.length() - 1);
     }
 
     private boolean isTemplate(String uri) {
         return uri.indexOf("{") != -1;
     }
 
-    protected P resolvePathConfig(P entry, String path) {
-        return entry;
+    private PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
+        if (originalConfig.hasPattern()) {
+            ProtectedResource resource = this.authzClient.protection().resource();
+            List<ResourceRepresentation> search = resource.findByUri(path);
+
+            if (!search.isEmpty()) {
+                // resource does exist on the server, cache it
+                ResourceRepresentation targetResource = search.get(0);
+                PathConfig config = PolicyEnforcer.createPathConfig(targetResource);
+
+                config.setScopes(originalConfig.getScopes());
+                config.setMethods(originalConfig.getMethods());
+                config.setParentConfig(originalConfig);
+                config.setEnforcementMode(originalConfig.getEnforcementMode());
+
+                return config;
+            }
+        }
+
+        return originalConfig;
     }
 }
-

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/PolicyEnforcer.java

@@ -17,16 +17,14 @@
  */
 package org.keycloak.adapters.authorization;
 
+import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
-import java.util.Iterator;
-import java.util.LinkedHashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
-import java.util.ServiceLoader;
 
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
@@ -36,14 +34,13 @@ import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
 import org.keycloak.authorization.client.AuthzClient;
 import org.keycloak.authorization.client.ClientAuthenticator;
 import org.keycloak.authorization.client.Configuration;
+import org.keycloak.authorization.client.representation.ResourceRepresentation;
+import org.keycloak.authorization.client.representation.ScopeRepresentation;
 import org.keycloak.authorization.client.resource.ProtectedResource;
-import org.keycloak.common.util.PathMatcher;
 import org.keycloak.representations.adapters.config.AdapterConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig;
-import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathCacheConfig;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;
-import org.keycloak.representations.idm.authorization.ResourceRepresentation;
 
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -55,9 +52,8 @@ public class PolicyEnforcer {
     private final KeycloakDeployment deployment;
     private final AuthzClient authzClient;
     private final PolicyEnforcerConfig enforcerConfig;
-    private final PathConfigMatcher pathMatcher;
     private final Map<String, PathConfig> paths;
-    private final Map<String, ClaimInformationPointProviderFactory> claimInformationPointProviderFactories = new HashMap<>();
+    private final PathMatcher pathMatcher;
 
     public PolicyEnforcer(KeycloakDeployment deployment, AdapterConfig adapterConfig) {
         this.deployment = deployment;
@@ -73,9 +69,8 @@ public class PolicyEnforcer {
                 }
             }
         });
-
-        paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
-        pathMatcher = new PathConfigMatcher(paths, enforcerConfig, authzClient);
+        this.pathMatcher = new PathMatcher(this.authzClient);
+        this.paths = configurePaths(this.authzClient.protection().resource(), this.enforcerConfig);
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Initialization complete. Path configurations:");
@@ -83,17 +78,20 @@ public class PolicyEnforcer {
                 LOGGER.debug(pathConfig);
             }
         }
-
-        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, ClaimInformationPointProviderFactory.class.getClassLoader()));
-        loadClaimInformationPointProviders(ServiceLoader.load(ClaimInformationPointProviderFactory.class, Thread.currentThread().getContextClassLoader()));
     }
 
     public AuthorizationContext enforce(OIDCHttpFacade facade) {
         if (LOGGER.isDebugEnabled()) {
-            LOGGER.debugv("Policy enforcement is enabled. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
+            LOGGER.debugv("Policy enforcement is enable. Enforcing policy decisions for path [{0}].", facade.getRequest().getURI());
         }
 
-        AuthorizationContext context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
+        AuthorizationContext context;
+
+        if (deployment.isBearerOnly()) {
+            context = new BearerTokenPolicyEnforcer(this).authorize(facade);
+        } else {
+            context = new KeycloakAdapterPolicyEnforcer(this).authorize(facade);
+        }
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debugv("Policy enforcement result for path [{0}] is : {1}", facade.getRequest().getURI(), context.isGranted() ? "GRANTED" : "DENIED");
@@ -106,11 +104,11 @@ public class PolicyEnforcer {
         return context;
     }
 
-    public PolicyEnforcerConfig getEnforcerConfig() {
+    PolicyEnforcerConfig getEnforcerConfig() {
         return enforcerConfig;
     }
 
-    public AuthzClient getClient() {
+    AuthzClient getClient() {
         return authzClient;
     }
 
@@ -118,30 +116,14 @@ public class PolicyEnforcer {
         return paths;
     }
 
-    public PathConfigMatcher getPathMatcher() {
-        return pathMatcher;
+    void addPath(PathConfig pathConfig) {
+        paths.put(pathConfig.getPath(), pathConfig);
     }
 
-    public KeycloakDeployment getDeployment() {
+    KeycloakDeployment getDeployment() {
         return deployment;
     }
 
-    public Map<String, ClaimInformationPointProviderFactory> getClaimInformationPointProviderFactories() {
-        return claimInformationPointProviderFactories;
-    }
-
-    private void loadClaimInformationPointProviders(ServiceLoader<ClaimInformationPointProviderFactory> loader) {
-        Iterator<ClaimInformationPointProviderFactory> iterator = loader.iterator();
-
-        while (iterator.hasNext()) {
-            ClaimInformationPointProviderFactory factory = iterator.next();
-
-            factory.init(this);
-
-            claimInformationPointProviderFactories.put(factory.getName(), factory);
-        }
-    }
-
     private Map<String, PathConfig> configurePaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
         boolean loadPathsFromServer = true;
 
@@ -154,11 +136,7 @@ public class PolicyEnforcer {
 
         if (loadPathsFromServer) {
             LOGGER.info("No path provided in configuration.");
-            Map<String, PathConfig> paths = configureAllPathsForResourceServer(protectedResource);
-
-            paths.putAll(configureDefinedPaths(protectedResource, enforcerConfig));
-
-            return paths;
+            return configureAllPathsForResourceServer(protectedResource);
         } else {
             LOGGER.info("Paths provided in configuration.");
             return configureDefinedPaths(protectedResource, enforcerConfig);
@@ -166,7 +144,7 @@ public class PolicyEnforcer {
     }
 
     private Map<String, PathConfig> configureDefinedPaths(ProtectedResource protectedResource, PolicyEnforcerConfig enforcerConfig) {
-        Map<String, PathConfig> paths = Collections.synchronizedMap(new LinkedHashMap<String, PathConfig>());
+        Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
 
         for (PathConfig pathConfig : enforcerConfig.getPaths()) {
             ResourceRepresentation resource;
@@ -180,10 +158,6 @@ public class PolicyEnforcer {
                 LOGGER.debugf("Trying to find resource with uri [%s] for path [%s].", path, path);
                 List<ResourceRepresentation> resources = protectedResource.findByUri(path);
 
-                if (resources.isEmpty()) {
-                    resources = protectedResource.findByMatchingUri(path);
-                }
-
                 if (resources.size() == 1) {
                     resource = resources.get(0);
                 } else if (resources.size() > 1) {
@@ -193,14 +167,41 @@ public class PolicyEnforcer {
                 }
             }
 
-            if (resource != null) {
+            if (resource == null) {
+                if (enforcerConfig.isCreateResources()) {
+                    LOGGER.debugf("Creating resource on server for path [%s].", pathConfig);
+                    ResourceRepresentation representation = new ResourceRepresentation();
+
+                    representation.setName(resourceName);
+                    representation.setType(pathConfig.getType());
+                    representation.setUri(path);
+
+                    HashSet<ScopeRepresentation> scopes = new HashSet<>();
+
+                    for (String scopeName : pathConfig.getScopes()) {
+                        ScopeRepresentation scope = new ScopeRepresentation();
+
+                        scope.setName(scopeName);
+
+                        scopes.add(scope);
+                    }
+
+                    representation.setScopes(scopes);
+
+                    ResourceRepresentation registrationResponse = protectedResource.create(representation);
+
+                    pathConfig.setId(registrationResponse.getId());
+                } else {
+                    throw new RuntimeException("Could not find matching resource on server with uri [" + path + "] or name [" + resourceName + "]. Make sure you have created a resource on the server that matches with the path configuration.");
+                }
+            } else {
                 pathConfig.setId(resource.getId());
             }
 
             PathConfig existingPath = null;
 
             for (PathConfig current : paths.values()) {
-                if (current.getPath().equals(pathConfig.getPath())) {
+                if (current.getId().equals(pathConfig.getId()) && current.getPath().equals(pathConfig.getPath())) {
                     existingPath = current;
                     break;
                 }
@@ -221,104 +222,45 @@ public class PolicyEnforcer {
         LOGGER.info("Querying the server for all resources associated with this application.");
         Map<String, PathConfig> paths = Collections.synchronizedMap(new HashMap<String, PathConfig>());
 
-        if (!enforcerConfig.getLazyLoadPaths()) {
-            for (String id : protectedResource.findAll()) {
-                ResourceRepresentation resourceDescription = protectedResource.findById(id);
+        for (String id : protectedResource.findAll()) {
+            ResourceRepresentation resourceDescription = protectedResource.findById(id);
 
-                if (resourceDescription.getUri() != null) {
-                    PathConfig pathConfig = PathConfig.createPathConfig(resourceDescription);
-                    paths.put(pathConfig.getPath(), pathConfig);
-                }
+            if (resourceDescription.getUri() != null) {
+                PathConfig pathConfig = createPathConfig(resourceDescription);
+                paths.put(pathConfig.getPath(), pathConfig);
             }
         }
 
         return paths;
     }
 
-    public class PathConfigMatcher extends PathMatcher<PathConfig> {
+    static PathConfig createPathConfig(ResourceRepresentation resourceDescription) {
+        PathConfig pathConfig = new PathConfig();
 
-        private final Map<String, PathConfig> paths;
-        private final PathCache pathCache;
-        private final AuthzClient authzClient;
-        private final PolicyEnforcerConfig enforcerConfig;
+        pathConfig.setId(resourceDescription.getId());
+        pathConfig.setName(resourceDescription.getName());
 
-        public PathConfigMatcher(Map<String, PathConfig> paths, PolicyEnforcerConfig enforcerConfig, AuthzClient authzClient) {
-            this.paths = paths;
-            this.enforcerConfig = enforcerConfig;
-            PathCacheConfig cacheConfig = enforcerConfig.getPathCacheConfig();
+        String uri = resourceDescription.getUri();
 
-            if (cacheConfig == null) {
-                cacheConfig = new PathCacheConfig();
-            }
-
-            pathCache = new PathCache(cacheConfig.getMaxEntries(), cacheConfig.getLifespan());
-            this.authzClient = authzClient;
+        if (uri == null || "".equals(uri.trim())) {
+            throw new RuntimeException("Failed to configure paths. Resource [" + resourceDescription.getName() + "] has an invalid or empty URI [" + uri + "].");
         }
 
-        @Override
-        public PathConfig matches(String targetUri) {
-            PathConfig pathConfig = pathCache.get(targetUri);
+        pathConfig.setPath(uri);
 
-            if (pathCache.containsKey(targetUri) || pathConfig != null) {
-                return pathConfig;
-            }
+        List<String> scopeNames = new ArrayList<>();
 
-            pathConfig = super.matches(targetUri);
-
-            if (enforcerConfig.getLazyLoadPaths() || enforcerConfig.getPathCacheConfig() != null) {
-                if ((pathConfig == null || (pathConfig.getPath().contains("*")))) {
-                    try {
-                        List<ResourceRepresentation> matchingResources = authzClient.protection().resource().findByMatchingUri(targetUri);
-
-                        if (!matchingResources.isEmpty()) {
-                            pathConfig = PathConfig.createPathConfig(matchingResources.get(0));
-                        }
-                    } catch (Exception cause) {
-                        LOGGER.errorf(cause, "Could not lazy load resource with path [" + targetUri + "] from server");
-                        return null;
-                    }
-                }
-            }
-
-            pathCache.put(targetUri, pathConfig);
-
-            return pathConfig;
+        for (ScopeRepresentation scope : resourceDescription.getScopes()) {
+            scopeNames.add(scope.getName());
         }
 
-        @Override
-        protected String getPath(PathConfig entry) {
-            return entry.getPath();
-        }
+        pathConfig.setScopes(scopeNames);
+        pathConfig.setType(resourceDescription.getType());
 
-        @Override
-        protected Collection<PathConfig> getPaths() {
-            return paths.values();
-        }
+        return pathConfig;
+    }
 
-        @Override
-        protected PathConfig resolvePathConfig(PathConfig originalConfig, String path) {
-            if (originalConfig.hasPattern()) {
-                ProtectedResource resource = authzClient.protection().resource();
-                List<ResourceRepresentation> search = resource.findByUri(path);
-
-                if (!search.isEmpty()) {
-                    ResourceRepresentation targetResource = search.get(0);
-                    PathConfig config = PathConfig.createPathConfig(targetResource);
-
-                    config.setScopes(originalConfig.getScopes());
-                    config.setMethods(originalConfig.getMethods());
-                    config.setParentConfig(originalConfig);
-                    config.setEnforcementMode(originalConfig.getEnforcementMode());
-
-                    return config;
-                }
-            }
-
-            return null;
-        }
-
-        public void removeFromCache(String pathConfig) {
-            pathCache.remove(pathConfig);
-        }
-    };
+    public PathMatcher getPathMatcher() {
+        return pathMatcher;
+    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProvider.java

@@ -1,76 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
-import org.keycloak.adapters.authorization.util.PlaceHolders;
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ClaimsInformationPointProvider implements ClaimInformationPointProvider {
-
-    private final Map<String, Object> config;
-
-    public ClaimsInformationPointProvider(Map<String, Object> config) {
-        this.config = config;
-    }
-
-    @Override
-    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
-        Map<String, List<String>> claims = new HashMap<>();
-
-        for (Entry<String, Object> configEntry : config.entrySet()) {
-            String claimName = configEntry.getKey();
-            Object claimValue = configEntry.getValue();
-            List<String> values = new ArrayList<>();
-
-            if (claimValue instanceof String) {
-                values = getValues(claimValue.toString(), httpFacade);
-            } else if (claimValue instanceof Collection) {
-                Iterator iterator = Collection.class.cast(claimValue).iterator();
-
-                while (iterator.hasNext()) {
-                    List<String> resolvedValues = getValues(iterator.next().toString(), httpFacade);
-
-                    if (!resolvedValues.isEmpty()) {
-                        values.addAll(resolvedValues);
-                    }
-                }
-            }
-
-            if (!values.isEmpty()) {
-                claims.put(claimName, values);
-            }
-        }
-
-        return claims;
-    }
-
-    private List<String> getValues(String value, HttpFacade httpFacade) {
-        return PlaceHolders.resolve(value, httpFacade);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/ClaimsInformationPointProviderFactory.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.Map;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class ClaimsInformationPointProviderFactory implements ClaimInformationPointProviderFactory<ClaimsInformationPointProvider> {
-
-    @Override
-    public String getName() {
-        return "claims";
-    }
-
-    @Override
-    public void init(PolicyEnforcer policyEnforcer) {
-
-    }
-
-    @Override
-    public ClaimsInformationPointProvider create(Map<String, Object> config) {
-        return new ClaimsInformationPointProvider(config);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProvider.java

@@ -1,210 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.io.BufferedInputStream;
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.Charset;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpResponse;
-import org.apache.http.StatusLine;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.methods.RequestBuilder;
-import org.apache.http.util.EntityUtils;
-import org.keycloak.adapters.authorization.ClaimInformationPointProvider;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-import org.keycloak.adapters.authorization.util.JsonUtils;
-import org.keycloak.adapters.authorization.util.PlaceHolders;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.authorization.client.util.HttpResponseException;
-import org.keycloak.common.util.StreamUtil;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class HttpClaimInformationPointProvider implements ClaimInformationPointProvider {
-
-    private final Map<String, Object> config;
-    private final HttpClient httpClient;
-
-    public HttpClaimInformationPointProvider(Map<String, Object> config, PolicyEnforcer policyEnforcer) {
-        this.config = config;
-        this.httpClient = policyEnforcer.getDeployment().getClient();
-    }
-
-    @Override
-    public Map<String, List<String>> resolve(HttpFacade httpFacade) {
-        try {
-            InputStream responseStream = executeRequest(httpFacade);
-
-            try (InputStream inputStream = new BufferedInputStream(responseStream)) {
-                JsonNode jsonNode = JsonSerialization.mapper.readTree(inputStream);
-                Map<String, List<String>> claims = new HashMap<>();
-                Map<String, Object> claimsDef = (Map<String, Object>) config.get("claims");
-
-                if (claimsDef == null) {
-                    Iterator<String> nodeNames = jsonNode.fieldNames();
-
-                    while (nodeNames.hasNext()) {
-                        String nodeName = nodeNames.next();
-                        claims.put(nodeName, JsonUtils.getValues(jsonNode.get(nodeName)));
-                    }
-                } else {
-                    for (Entry<String, Object> claimDef : claimsDef.entrySet()) {
-                        List<String> jsonPaths = new ArrayList<>();
-
-                        if (claimDef.getValue() instanceof Collection) {
-                            jsonPaths.addAll(Collection.class.cast(claimDef.getValue()));
-                        } else {
-                            jsonPaths.add(claimDef.getValue().toString());
-                        }
-
-                        List<String> claimValues = new ArrayList<>();
-
-                        for (String path : jsonPaths) {
-                            claimValues.addAll(JsonUtils.getValues(jsonNode, path));
-                        }
-
-                        claims.put(claimDef.getKey(), claimValues);
-                    }
-                }
-
-                return claims;
-            }
-        } catch (IOException cause) {
-            throw new RuntimeException("Could not obtain claims from http claim information point [" + config.get("url") + "] response", cause);
-        }
-    }
-
-    private InputStream executeRequest(HttpFacade httpFacade) {
-        String method = config.get("method").toString();
-
-        if (method == null) {
-            method = "GET";
-        }
-
-        RequestBuilder builder = null;
-
-        if ("GET".equalsIgnoreCase(method)) {
-            builder = RequestBuilder.get();
-        } else {
-            builder = RequestBuilder.post();
-        }
-
-        builder.setUri(config.get("url").toString());
-
-        byte[] bytes = new byte[0];
-
-        try {
-            setParameters(builder, httpFacade);
-
-            if (config.containsKey("headers")) {
-                setHeaders(builder, httpFacade);
-            }
-
-            HttpResponse response = httpClient.execute(builder.build());
-            HttpEntity entity = response.getEntity();
-
-            if (entity != null) {
-                bytes = EntityUtils.toByteArray(entity);
-            }
-
-            StatusLine statusLine = response.getStatusLine();
-            int statusCode = statusLine.getStatusCode();
-
-            if (statusCode < 200 || statusCode >= 300) {
-                throw new HttpResponseException("Unexpected response from server: " + statusCode + " / " + statusLine.getReasonPhrase(), statusCode, statusLine.getReasonPhrase(), bytes);
-            }
-
-            return new ByteArrayInputStream(bytes);
-        } catch (Exception cause) {
-            try {
-                throw new RuntimeException("Error executing http method [" + builder + "]. Response : " + StreamUtil.readString(new ByteArrayInputStream(bytes), Charset.forName("UTF-8")), cause);
-            } catch (Exception e) {
-                throw new RuntimeException("Error executing http method [" + builder + "]", cause);
-            }
-        }
-    }
-
-    private void setHeaders(RequestBuilder builder, HttpFacade httpFacade) {
-        Object headersDef = config.get("headers");
-
-        if (headersDef != null) {
-            Map<String, Object> headers = Map.class.cast(headersDef);
-
-            for (Entry<String, Object> header : headers.entrySet()) {
-                Object value = header.getValue();
-                List<String> headerValues = new ArrayList<>();
-
-                if (value instanceof Collection) {
-                    Collection values = Collection.class.cast(value);
-                    Iterator iterator = values.iterator();
-
-                    while (iterator.hasNext()) {
-                        headerValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
-                    }
-                } else {
-                    headerValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
-                }
-
-                for (String headerValue : headerValues) {
-                    builder.addHeader(header.getKey(), headerValue);
-                }
-            }
-        }
-    }
-
-    private void setParameters(RequestBuilder builder, HttpFacade httpFacade) {
-        Object config = this.config.get("parameters");
-
-        if (config != null) {
-            Map<String, Object> paramsDef = Map.class.cast(config);
-
-            for (Entry<String, Object> paramDef : paramsDef.entrySet()) {
-                Object value = paramDef.getValue();
-                List<String> paramValues = new ArrayList<>();
-
-                if (value instanceof Collection) {
-                    Collection values = Collection.class.cast(value);
-                    Iterator iterator = values.iterator();
-
-                    while (iterator.hasNext()) {
-                        paramValues.addAll(PlaceHolders.resolve(iterator.next().toString(), httpFacade));
-                    }
-                } else {
-                    paramValues.addAll(PlaceHolders.resolve(value.toString(), httpFacade));
-                }
-
-                for (String paramValue : paramValues) {
-                    builder.addParameter(paramDef.getKey(), paramValue);
-                }
-            }
-        }
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/cip/HttpClaimInformationPointProviderFactory.java

@@ -1,45 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.cip;
-
-import java.util.Map;
-
-import org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory;
-import org.keycloak.adapters.authorization.PolicyEnforcer;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class HttpClaimInformationPointProviderFactory implements ClaimInformationPointProviderFactory<HttpClaimInformationPointProvider> {
-
-    private PolicyEnforcer policyEnforcer;
-
-    @Override
-    public String getName() {
-        return "http";
-    }
-
-    @Override
-    public void init(PolicyEnforcer policyEnforcer) {
-        this.policyEnforcer = policyEnforcer;
-    }
-
-    @Override
-    public HttpClaimInformationPointProvider create(Map<String, Object> config) {
-        return new HttpClaimInformationPointProvider(config, policyEnforcer);
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/JsonUtils.java

@@ -1,58 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class JsonUtils {
-
-    public static List<String> getValues(JsonNode jsonNode, String path) {
-        return getValues(jsonNode.at(path));
-    }
-
-    public static List<String> getValues(JsonNode jsonNode) {
-        List<String> values = new ArrayList<>();
-
-        if (jsonNode.isArray()) {
-            Iterator<JsonNode> iterator = jsonNode.iterator();
-
-            while (iterator.hasNext()) {
-                String value = iterator.next().textValue();
-
-                if (value != null) {
-                    values.add(value);
-                }
-            }
-        } else {
-            String value = jsonNode.textValue();
-
-            if (value != null) {
-                values.add(value);
-            }
-        }
-
-        return values;
-    }
-
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/KeycloakSecurityContextPlaceHolderResolver.java

@@ -1,67 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
-
-import java.util.Arrays;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakSecurityContextPlaceHolderResolver implements PlaceHolderResolver {
-
-    public static final String NAME = "keycloak";
-
-    @Override
-    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
-        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
-        OIDCHttpFacade oidcHttpFacade = OIDCHttpFacade.class.cast(httpFacade);
-        KeycloakSecurityContext securityContext = oidcHttpFacade.getSecurityContext();
-
-        if (securityContext == null) {
-            return null;
-        }
-
-        if (source.endsWith("access_token")) {
-            return Arrays.asList(securityContext.getTokenString());
-        }
-
-        if (source.endsWith("id_token")) {
-            return Arrays.asList(securityContext.getIdTokenString());
-        }
-
-        JsonNode jsonNode;
-
-        if (source.startsWith("access_token[")) {
-            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getToken());
-        } else if (source.startsWith("id_token[")) {
-            jsonNode = JsonSerialization.mapper.valueToTree(securityContext.getIdToken());
-        } else {
-            throw new RuntimeException("Invalid placeholder [" + placeHolder + "]");
-        }
-
-        return JsonUtils.getValues(jsonNode, getParameter(source, "Invalid placeholder [" + placeHolder + "]"));
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/PlaceHolderResolver.java

@@ -1,30 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import java.util.List;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public interface PlaceHolderResolver {
-
-    List<String> resolve(String placeHolder, HttpFacade httpFacade);
-
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/PlaceHolders.java

@@ -1,107 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class PlaceHolders {
-
-    private static Map<String, PlaceHolderResolver> resolvers = new HashMap<>();
-
-    static {
-        resolvers.put(RequestPlaceHolderResolver.NAME, new RequestPlaceHolderResolver());
-        resolvers.put(KeycloakSecurityContextPlaceHolderResolver.NAME, new KeycloakSecurityContextPlaceHolderResolver());
-    }
-
-    private static Pattern PLACEHOLDER_PATTERN = Pattern.compile("\\{(.+?)\\}");
-    private static Pattern PLACEHOLDER_PARAM_PATTERN = Pattern.compile("\\[(.+?)\\]");
-
-    public static List<String> resolve(String value, HttpFacade httpFacade) {
-        Map<String, List<String>> placeHolders = parsePlaceHolders(value, httpFacade);
-
-        if (!placeHolders.isEmpty()) {
-            value = formatPlaceHolder(value);
-
-            for (Entry<String, List<String>> entry : placeHolders.entrySet()) {
-                List<String> values = entry.getValue();
-
-                if (values.isEmpty() || values.size() > 1) {
-                    return values;
-                }
-
-                value = value.replaceAll(entry.getKey(), values.get(0)).trim();
-            }
-        }
-
-        return Arrays.asList(value);
-    }
-
-    static String getParameter(String source, String messageIfNotFound) {
-        Matcher matcher = PLACEHOLDER_PARAM_PATTERN.matcher(source);
-
-        while (matcher.find()) {
-            return matcher.group(1).replaceAll("'", "");
-        }
-
-        if (messageIfNotFound != null) {
-            throw new RuntimeException(messageIfNotFound);
-        }
-
-        return null;
-    }
-
-    private static Map<String, List<String>> parsePlaceHolders(String value, HttpFacade httpFacade) {
-        Map<String, List<String>> placeHolders = new HashMap<>();
-        Matcher matcher = PLACEHOLDER_PATTERN.matcher(value);
-
-        while (matcher.find()) {
-            String placeHolder = matcher.group(1);
-            int resolverNameIdx = placeHolder.indexOf('.');
-
-            if (resolverNameIdx == -1) {
-                throw new RuntimeException("Invalid placeholder [" + value + "]. Could not find resolver name.");
-            }
-
-            PlaceHolderResolver resolver = resolvers.get(placeHolder.substring(0, resolverNameIdx));
-
-            if (resolver != null) {
-                List<String> resolved = resolver.resolve(placeHolder, httpFacade);
-
-                if (resolved != null) {
-                    placeHolders.put(formatPlaceHolder(placeHolder), resolved);
-                }
-            }
-        }
-
-        return placeHolders;
-    }
-
-    private static String formatPlaceHolder(String placeHolder) {
-        return placeHolder.replaceAll("\\{", "").replace("}", "").replace("[", "").replace("]", "").replace("[", "").replace("]", "");
-    }
-}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/util/RequestPlaceHolderResolver.java

@@ -1,175 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.authorization.util;
-
-import static org.keycloak.adapters.authorization.util.PlaceHolders.getParameter;
-
-import java.io.BufferedInputStream;
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.spi.HttpFacade.Cookie;
-import org.keycloak.adapters.spi.HttpFacade.Request;
-import org.keycloak.util.JsonSerialization;
-
-/**
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class RequestPlaceHolderResolver implements PlaceHolderResolver {
-
-    static String NAME = "request";
-
-    @Override
-    public List<String> resolve(String placeHolder, HttpFacade httpFacade) {
-        String source = placeHolder.substring(placeHolder.indexOf('.') + 1);
-        Request request = httpFacade.getRequest();
-
-        if (source.startsWith("parameter")) {
-            String parameterName = getParameter(source, "Could not obtain parameter name from placeholder [" + source + "]");
-            String parameterValue = request.getQueryParamValue(parameterName);
-
-            if (parameterValue == null) {
-                parameterValue = request.getFirstParam(parameterName);
-            }
-
-            if (parameterValue != null) {
-                return Arrays.asList(parameterValue);
-            }
-        } else if (source.startsWith("header")) {
-            String headerName = getParameter(source, "Could not obtain header name from placeholder [" + source + "]");
-            List<String> headerValue = request.getHeaders(headerName);
-
-            if (headerValue != null) {
-                return headerValue;
-            }
-        } else if (source.startsWith("cookie")) {
-            String cookieName = getParameter(source, "Could not obtain cookie name from placeholder [" + source + "]");
-            Cookie cookieValue = request.getCookie(cookieName);
-
-            if (cookieValue != null) {
-                return Arrays.asList(cookieValue.getValue());
-            }
-        } else if (source.startsWith("remoteAddr")) {
-            String value = request.getRemoteAddr();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("method")) {
-            String value = request.getMethod();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("uri")) {
-            String value = request.getURI();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("relativePath")) {
-            String value = request.getRelativePath();
-
-            if (value != null) {
-                return Arrays.asList(value);
-            }
-        } else if (source.startsWith("secure")) {
-            return Arrays.asList(String.valueOf(request.isSecure()));
-        } else if (source.startsWith("body")) {
-            String contentType = request.getHeader("Content-Type");
-
-            if (contentType == null) {
-                contentType = "";
-            }
-
-            InputStream body = request.getInputStream(true);
-
-            try {
-                if (body == null || body.available() == 0) {
-                    return Collections.emptyList();
-                }
-            } catch (IOException cause) {
-                throw new RuntimeException("Failed to check available bytes in request input stream", cause);
-            }
-
-            if (body.markSupported()) {
-                body.mark(0);
-            }
-
-            List<String> values = new ArrayList<>();
-
-            try {
-                switch (contentType) {
-                    case "application/json":
-                        try {
-                            JsonNode jsonNode = JsonSerialization.mapper.readTree(new BufferedInputStream(body) {
-                                @Override
-                                public void close() {
-                                    // we can't close the stream because it may be used later by the application
-                                }
-                            });
-                            String path = getParameter(source, null);
-
-                            if (path == null) {
-                                values.addAll(JsonUtils.getValues(jsonNode));
-                            } else {
-                                values.addAll(JsonUtils.getValues(jsonNode, path));
-                            }
-                        } catch (IOException cause) {
-                            throw new RuntimeException("Could not extract claim from request JSON body", cause);
-                        }
-                        break;
-                    default:
-                        StringBuilder value = new StringBuilder();
-                        BufferedReader reader = new BufferedReader(new InputStreamReader(body));
-
-                        try {
-                            int ch;
-
-                            while ((ch = reader.read()) != -1) {
-                                value.append((char) ch);
-                            }
-                        } catch (IOException cause) {
-                            throw new RuntimeException("Could not extract claim from request body", cause);
-                        }
-
-                        values.add(value.toString());
-                }
-            } finally {
-                if (body.markSupported()) {
-                    try {
-                        body.reset();
-                    } catch (IOException cause) {
-                        throw new RuntimeException("Failed to reset request input stream", cause);
-                    }
-                }
-            }
-
-            return values;
-        }
-
-        return Collections.emptyList();
-    }
-}

adapters/oidc/adapter-core/src/main/resources/META-INF/services/org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory

@@ -1,19 +0,0 @@
-#
-# * Copyright 2018 Red Hat, Inc. and/or its affiliates
-# * and other contributors as indicated by the @author tags.
-# *
-# * Licensed under the Apache License, Version 2.0 (the "License");
-# * you may not use this file except in compliance with the License.
-# * You may obtain a copy of the License at
-# *
-# * http://www.apache.org/licenses/LICENSE-2.0
-# *
-# * Unless required by applicable law or agreed to in writing, software
-# * distributed under the License is distributed on an "AS IS" BASIS,
-# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# * See the License for the specific language governing permissions and
-# * limitations under the License.
-#
-
-org.keycloak.adapters.authorization.cip.ClaimsInformationPointProviderFactory
-org.keycloak.adapters.authorization.cip.HttpClaimInformationPointProviderFactory

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>

adapters/oidc/cli-sso/login.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+export KC_AUTH_SERVER=http://localhost:8080/auth
+export KC_REALM=master
+export KC_CLIENT=cli
+
+export KC_ACCESS_TOKEN=`java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar login`
+
+
+
+

adapters/oidc/cli-sso/logout.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+java -DKEYCLOAK_AUTH_SERVER=$KC_AUTH_SERVER -DKEYCLOAK_REALM=$KC_REALM -DKEYCLOAK_CLIENT=$KC_CLIENT -jar target/keycloak-cli-sso-3.3.0.CR1-SNAPSHOT.jar logout
+
+unset KC_ACCESS_TOKEN
+
+
+
+

adapters/oidc/cli-sso/pom.xml

@@ -21,12 +21,12 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
-    <artifactId>kcinit</artifactId>
+    <artifactId>keycloak-cli-sso</artifactId>
     <name>Keycloak CLI SSO Framework</name>
     <description/>
 
@@ -54,7 +54,7 @@
                 <configuration>
                     <transformers>
                         <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-                            <mainClass>org.keycloak.adapters.KcinitMain</mainClass>
+                            <mainClass>org.keycloak.adapters.KeycloakCliSsoMain</mainClass>
                         </transformer>
                     </transformers>
 

adapters/oidc/cli-sso/src/main/java/org/keycloak/adapters/KeycloakCliSsoMain.java

@@ -16,15 +16,30 @@
  */
 package org.keycloak.adapters;
 
-import org.keycloak.adapters.installed.KcinitDriver;
+import org.keycloak.adapters.installed.KeycloakCliSso;
+import org.keycloak.adapters.installed.KeycloakInstalled;
+import org.keycloak.common.util.Time;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-public class KcinitMain extends KcinitDriver {
+public class KeycloakCliSsoMain extends KeycloakCliSso {
 
     public static void main(String[] args) throws Exception {
-        new KcinitMain().mainCmd(args);
+        new KeycloakCliSsoMain().mainCmd(args);
     }
 }

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KcinitDriver.java

@@ -1,702 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.installed;
-
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.KeycloakDeploymentBuilder;
-import org.keycloak.adapters.ServerRequest;
-import org.keycloak.common.util.Base64;
-import org.keycloak.common.util.Time;
-import org.keycloak.jose.jwe.*;
-import org.keycloak.representations.AccessTokenResponse;
-import org.keycloak.representations.adapters.config.AdapterConfig;
-import org.keycloak.representations.idm.OAuth2ErrorRepresentation;
-import org.keycloak.util.JsonSerialization;
-
-import javax.crypto.SecretKey;
-import javax.crypto.SecretKeyFactory;
-import javax.crypto.spec.PBEKeySpec;
-import javax.crypto.spec.SecretKeySpec;
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.io.*;
-import java.nio.file.Paths;
-import java.security.NoSuchAlgorithmException;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.KeySpec;
-import java.util.*;
-
-/**
- * All kcinit commands that take input ask for
- * <p>
- * 1. . kcinit
- * - setup and export KC_SESSION_KEY env var if not set.
- * - checks to see if master token valid, refresh is possible, exit if token valid
- * - performs command line login
- * - stores master token for master client
- * 2. app.sh is a wrapper for app cli.
- * - token=`kcinit token app`
- * - checks to see if token for app client has been fetched, refresh if valid, output token to sys.out if exists
- * - if no token, login.  Prompts go to stderr.
- * - pass token as cmd line param to app or as environment variable.
- * <p>
- * 3. kcinit password {password}
- * - outputs password key that is used for encryption.
- * - can be used in .bashrc as export KC_SESSSION_KEY=`kcinit password {password}` or just set it in .bat file
- * <p>
- *
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-public class KcinitDriver {
-
-    public static final String KC_SESSION_KEY = "KC_SESSION_KEY";
-    public static final String KC_LOGIN_CONFIG_PATH = "KC_LOGIN_CONFIG_PATH";
-    protected Map<String, String> config;
-    protected boolean debug = true;
-
-    protected static byte[] salt = new byte[]{-4, 88, 66, -101, 78, -94, 21, 105};
-
-    String[] args = null;
-
-    protected boolean forceLogin;
-    protected boolean browserLogin;
-
-    public void mainCmd(String[] args) throws Exception {
-
-        this.args = args;
-
-
-        if (args.length == 0) {
-            printHelp();
-            return;
-        }
-
-        if (args[0].equalsIgnoreCase("token")) {
-            //System.err.println("executing token");
-            token();
-        } else if (args[0].equalsIgnoreCase("login")) {
-            login();
-        } else if (args[0].equalsIgnoreCase("logout")) {
-            logout();
-        } else if (args[0].equalsIgnoreCase("env")) {
-            System.out.println(System.getenv().toString());
-        } else if (args[0].equalsIgnoreCase("install")) {
-            install();
-        } else if (args[0].equalsIgnoreCase("uninstall")) {
-            uninstall();
-        } else if (args[0].equalsIgnoreCase("password")) {
-            passwordKey();
-        } else {
-            KeycloakInstalled.console().writer().println("Unknown command: " + args[0]);
-            KeycloakInstalled.console().writer().println();
-            printHelp();
-        }
-    }
-
-    public String getHome() {
-        String home = System.getenv("HOME");
-        if (home == null) {
-            home = System.getProperty("HOME");
-            if (home == null) {
-                home = Paths.get("").toAbsolutePath().normalize().toString();
-            }
-        }
-        return home;
-    }
-
-    public void passwordKey() {
-        if (args.length < 2) {
-            printHelp();
-            System.exit(1);
-        }
-        String password = args[1];
-        try {
-            String encodedKey = generateEncryptionKey(password);
-            System.out.printf(encodedKey);
-        } catch (Exception e) {
-            e.printStackTrace();
-            System.exit(1);
-        }
-    }
-
-    protected String generateEncryptionKey(String password) throws NoSuchAlgorithmException, InvalidKeySpecException {
-        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
-        KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 100, 128);
-        SecretKey tmp = factory.generateSecret(spec);
-        byte[] aeskey = tmp.getEncoded();
-        return Base64.encodeBytes(aeskey);
-    }
-
-    public JWE createJWE() {
-        String key = getEncryptionKey();
-        if (key == null) {
-            throw new RuntimeException(KC_SESSION_KEY + " env var not set");
-        }
-        byte[] aesKey = null;
-        try {
-            aesKey = Base64.decode(key.getBytes("UTF-8"));
-        } catch (IOException e) {
-            throw new RuntimeException("invalid " + KC_SESSION_KEY + "env var");
-        }
-
-        JWE jwe = new JWE();
-        final SecretKey aesSecret = new SecretKeySpec(aesKey, "AES");
-        jwe.getKeyStorage()
-                .setEncryptionKey(aesSecret);
-        return jwe;
-    }
-
-    protected String encryptionKey;
-
-    protected String getEncryptionKey() {
-        if (encryptionKey != null) return encryptionKey;
-        return System.getenv(KC_SESSION_KEY);
-    }
-
-    public String encrypt(String payload) {
-        JWE jwe = createJWE();
-        JWEHeader jweHeader = new JWEHeader(JWEConstants.A128KW, JWEConstants.A128CBC_HS256, null);
-        try {
-            jwe.header(jweHeader).content(payload.getBytes("UTF-8"));
-        } catch (UnsupportedEncodingException e) {
-            throw new RuntimeException("cannot encode payload as UTF-8");
-        }
-        try {
-            return jwe.encodeJwe();
-        } catch (JWEException e) {
-            throw new RuntimeException("cannot encrypt payload", e);
-        }
-    }
-
-    public String decrypt(String encoded) {
-        JWE jwe = createJWE();
-        try {
-            jwe.verifyAndDecodeJwe(encoded);
-            byte[] content = jwe.getContent();
-            if (content == null) return null;
-            return new String(content, "UTF-8");
-        } catch (Exception ex) {
-            throw new RuntimeException("cannot decrypt payload", ex);
-
-        }
-
-    }
-
-    public static String getenv(String name, String defaultValue) {
-        String val = System.getenv(name);
-        return val == null ? defaultValue : val;
-    }
-
-    public File getConfigDirectory() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit").toFile();
-    }
-
-
-    public File getConfigFile() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "config.json").toFile();
-    }
-
-    public File getTokenFilePath(String client) {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens", client).toFile();
-    }
-
-    public File getTokenDirectory() {
-        return Paths.get(getHome(), getenv(KC_LOGIN_CONFIG_PATH, ".keycloak"), "kcinit", "tokens").toFile();
-    }
-
-    protected boolean encrypted = false;
-
-    protected void checkEnv() {
-        File configFile = getConfigFile();
-        if (!configFile.exists()) {
-            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-        }
-        byte[] data = new byte[0];
-        try {
-            data = readFileRaw(configFile);
-        } catch (IOException e) {
-
-        }
-        if (data == null) {
-            KeycloakInstalled.console().writer().println("Config file unreadable.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-
-        }
-        String encodedJwe = null;
-        try {
-            encodedJwe = new String(data, "UTF-8");
-        } catch (UnsupportedEncodingException e) {
-            e.printStackTrace();
-        }
-
-        if (encodedJwe.contains("realm")) {
-            encrypted = false;
-            return;
-        } else {
-            encrypted = true;
-        }
-
-        if (System.getenv(KC_SESSION_KEY) == null) {
-            promptLocalPassword();
-        }
-    }
-
-    protected void promptLocalPassword() {
-        String password = KeycloakInstalled.console().passwordPrompt("Enter password to unlock kcinit config files: ");
-        try {
-            encryptionKey = generateEncryptionKey(password);
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-
-    protected String readFile(File fp) {
-        try {
-            byte[] data = readFileRaw(fp);
-            if (data == null) return null;
-            String file = new String(data, "UTF-8");
-            if (!encrypted) {
-                return file;
-            }
-            String decrypted = decrypt(file);
-            if (decrypted == null)
-                throw new RuntimeException("Unable to decrypt file.  Did you set your local password correctly?");
-            return decrypted;
-        } catch (IOException e) {
-            throw new RuntimeException("failed to decrypt file: " + fp.getAbsolutePath() + " Did you set your local password correctly?", e);
-        }
-
-
-    }
-
-    protected byte[] readFileRaw(File fp) throws IOException {
-        if (!fp.exists()) return null;
-        FileInputStream fis = new FileInputStream(fp);
-        byte[] data = new byte[(int) fp.length()];
-        fis.read(data);
-        fis.close();
-        return data;
-    }
-
-    protected void writeFile(File fp, String payload) {
-        try {
-            String data = payload;
-            if (encrypted) data = encrypt(payload);
-            FileOutputStream fos = new FileOutputStream(fp);
-            fos.write(data.getBytes("UTF-8"));
-            fos.flush();
-            fos.close();
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-
-    public void install() {
-        if (getEncryptionKey() == null) {
-            if (KeycloakInstalled.console().confirm("Do you want to protect tokens stored locally with a password? (y/n): ")) {
-                String password = "p";
-                String confirm = "c";
-                do {
-                    password = KeycloakInstalled.console().passwordPrompt("Enter local password: ");
-                    confirm = KeycloakInstalled.console().passwordPrompt("Confirm local password: ");
-                    if (!password.equals(confirm)) {
-                        KeycloakInstalled.console().writer().println();
-                        KeycloakInstalled.console().writer().println("Confirmation does not match.  Try again.");
-                        KeycloakInstalled.console().writer().println();
-                    }
-                } while (!password.equals(confirm));
-                try {
-                    this.encrypted = true;
-                    this.encryptionKey = generateEncryptionKey(password);
-                } catch (Exception e) {
-                    e.printStackTrace();
-                    System.exit(1);
-                }
-            }
-        } else {
-            if (!KeycloakInstalled.console().confirm("KC_SESSION_KEY env var already set.  Do you want to use this as your local encryption key? (y/n): ")) {
-                KeycloakInstalled.console().writer().println("Unset KC_SESSION_KEY env var and run again");
-                System.exit(1);
-            }
-            this.encrypted = true;
-            this.encryptionKey = getEncryptionKey();
-        }
-        String server = KeycloakInstalled.console().readLine("Authentication server URL [http://localhost:8080/auth]: ").trim();
-        String realm = KeycloakInstalled.console().readLine("Name of realm [master]: ").trim();
-        String client = KeycloakInstalled.console().readLine("CLI client id [kcinit]: ").trim();
-        String secret = KeycloakInstalled.console().readLine("CLI client secret [none]: ").trim();
-        if (server.equals("")) {
-            server = "http://localhost:8080/auth";
-        }
-        if (realm.equals("")) {
-            realm = "master";
-        }
-        if (client.equals("")) {
-            client = "kcinit";
-        }
-        File configDir = getTokenDirectory();
-        configDir.mkdirs();
-
-        File configFile = getConfigFile();
-        Map<String, String> props = new HashMap<>();
-        props.put("server", server);
-        props.put("realm", realm);
-        props.put("client", client);
-        props.put("secret", secret);
-
-        try {
-            String json = JsonSerialization.writeValueAsString(props);
-            writeFile(configFile, json);
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-
-        KeycloakInstalled.console().writer().println();
-        KeycloakInstalled.console().writer().println("Installation complete!");
-        KeycloakInstalled.console().writer().println();
-    }
-
-
-    public void printHelp() {
-        KeycloakInstalled.console().writer().println("Commands:");
-        KeycloakInstalled.console().writer().println("  login [-f] -f forces login");
-        KeycloakInstalled.console().writer().println("  logout");
-        KeycloakInstalled.console().writer().println("  token [client] - print access token of desired client.  Defaults to default master client.  Will print either 'error', 'not-allowed',  or 'login-required' on error.");
-        KeycloakInstalled.console().writer().println("  install - Install this utility.  Will store in $HOME/.keycloak/kcinit unless " + KC_LOGIN_CONFIG_PATH + " env var is set");
-        System.exit(1);
-    }
-
-
-    public AdapterConfig getConfig() {
-        File configFile = getConfigFile();
-        if (!configFile.exists()) {
-            KeycloakInstalled.console().writer().println("You have not configured kcinit.  Please run 'kcinit install' to configure.");
-            System.exit(1);
-            return null;
-        }
-
-        AdapterConfig config = new AdapterConfig();
-        config.setAuthServerUrl((String) getConfigProperties().get("server"));
-        config.setRealm((String) getConfigProperties().get("realm"));
-        config.setResource((String) getConfigProperties().get("client"));
-        config.setSslRequired("external");
-        String secret = (String) getConfigProperties().get("secret");
-        if (secret != null && !secret.trim().equals("")) {
-            Map<String, Object> creds = new HashMap<>();
-            creds.put("secret", secret);
-            config.setCredentials(creds);
-        } else {
-            config.setPublicClient(true);
-        }
-        return config;
-    }
-
-    private Map<String, String> getConfigProperties() {
-        if (this.config != null) return this.config;
-        if (!getConfigFile().exists()) {
-            KeycloakInstalled.console().writer().println();
-            KeycloakInstalled.console().writer().println(("Config file does not exist.  Run kcinit install to set it up."));
-            System.exit(1);
-        }
-        String json = readFile(getConfigFile());
-        try {
-            Map map = JsonSerialization.readValue(json, Map.class);
-            config = (Map<String, String>) map;
-        } catch (IOException e) {
-            throw new RuntimeException(e);
-        }
-        return this.config;
-    }
-
-    public String readToken(String client) throws Exception {
-        String json = getTokenResponse(client);
-        if (json == null) return null;
-
-
-        if (json != null) {
-            try {
-                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                if (Time.currentTime() < tokenResponse.getExpiresIn()) {
-                    return tokenResponse.getToken();
-                }
-                AdapterConfig config = getConfig();
-                KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-                installed.refreshToken(tokenResponse.getRefreshToken());
-                processResponse(installed, client);
-                return tokenResponse.getToken();
-            } catch (Exception e) {
-                File tokenFile = getTokenFilePath(client);
-                if (tokenFile.exists()) {
-                    tokenFile.delete();
-                }
-
-                return null;
-            }
-        }
-        return null;
-
-    }
-
-    public String readRefreshToken(String client) throws Exception {
-        String json = getTokenResponse(client);
-        if (json == null) return null;
-
-
-        if (json != null) {
-            try {
-                AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-                return tokenResponse.getRefreshToken();
-            } catch (Exception e) {
-                if (debug) {
-                    e.printStackTrace();
-                }
-                File tokenFile = getTokenFilePath(client);
-                if (tokenFile.exists()) {
-                    tokenFile.delete();
-                }
-
-                return null;
-            }
-        }
-        return null;
-
-    }
-
-
-    private String getTokenResponse(String client) throws IOException {
-        File tokenFile = getTokenFilePath(client);
-        try {
-            return readFile(tokenFile);
-        } catch (Exception e) {
-            if (debug) {
-                System.err.println("Failed to read encrypted file");
-                e.printStackTrace();
-            }
-            if (tokenFile.exists()) tokenFile.delete();
-            return null;
-        }
-    }
-
-
-    public void token() throws Exception {
-        KeycloakInstalled.console().stderrOutput();
-
-        checkEnv();
-        String masterClient = getMasterClient();
-        String client = masterClient;
-        if (args.length > 1) {
-            client = args[1];
-        }
-        //System.err.println("readToken: " + client);
-        String token = readToken(client);
-        if (token != null) {
-            System.out.print(token);
-            return;
-        }
-        if (token == null && client.equals(masterClient)) {
-            //System.err.println("not logged in, logging in.");
-            doConsoleLogin();
-            token = readToken(client);
-            if (token != null) {
-                System.out.print(token);
-                return;
-            }
-
-        }
-        String masterToken = readToken(masterClient);
-        if (masterToken == null) {
-            //System.err.println("not logged in, logging in.");
-            doConsoleLogin();
-            masterToken = readToken(masterClient);
-            if (masterToken == null) {
-                System.err.println("Login failed.  Cannot retrieve token");
-                System.exit(1);
-            }
-        }
-
-        //System.err.println("exchange: " + client);
-        Client httpClient = getHttpClient();
-
-        WebTarget exchangeUrl = httpClient.target(getServer())
-                .path("/realms")
-                .path(getRealm())
-                .path("protocol/openid-connect/token");
-
-        Form form = new Form()
-                .param(OAuth2Constants.GRANT_TYPE, OAuth2Constants.TOKEN_EXCHANGE_GRANT_TYPE)
-                .param(OAuth2Constants.CLIENT_ID, masterClient)
-                .param(OAuth2Constants.SUBJECT_TOKEN, masterToken)
-                .param(OAuth2Constants.SUBJECT_TOKEN_TYPE, OAuth2Constants.ACCESS_TOKEN_TYPE)
-                .param(OAuth2Constants.REQUESTED_TOKEN_TYPE, OAuth2Constants.REFRESH_TOKEN_TYPE)
-                .param(OAuth2Constants.AUDIENCE, client);
-        if (getMasterClientSecret() != null) {
-            form.param(OAuth2Constants.CLIENT_SECRET, getMasterClientSecret());
-        }
-        Response response = exchangeUrl.request().post(Entity.form(
-                form
-        ));
-
-        if (response.getStatus() == 401 || response.getStatus() == 403) {
-            response.close();
-            System.err.println("Not allowed to exchange for client token");
-            System.exit(1);
-        }
-
-        if (response.getStatus() != 200) {
-            if (response.getMediaType() != null && response.getMediaType().equals(MediaType.APPLICATION_JSON_TYPE)) {
-                try {
-                    String json = response.readEntity(String.class);
-                    OAuth2ErrorRepresentation error = JsonSerialization.readValue(json, OAuth2ErrorRepresentation.class);
-                    System.err.println("Failed to exchange token: " + error.getError() + ". " + error.getErrorDescription());
-                    System.exit(1);
-                } catch (Exception ignore) {
-                    ignore.printStackTrace();
-
-                }
-            }
-
-            response.close();
-            System.err.println("Unknown error exchanging for client token: " + response.getStatus());
-            System.exit(1);
-        }
-
-        String json = response.readEntity(String.class);
-        response.close();
-        AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
-        if (tokenResponse.getToken() != null) {
-            getTokenDirectory().mkdirs();
-            tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
-            tokenResponse.setIdToken(null);
-            json = JsonSerialization.writeValueAsString(tokenResponse);
-            writeFile(getTokenFilePath(client), json);
-            System.out.printf(tokenResponse.getToken());
-        } else {
-            System.err.println("Error processing token");
-            System.exit(1);
-        }
-    }
-
-    protected String getMasterClientSecret() {
-        return getProperty("secret");
-    }
-
-    protected String getServer() {
-        return getProperty("server");
-    }
-
-    protected String getRealm() {
-        return getProperty("realm");
-    }
-
-    public String getProperty(String name) {
-        return (String) getConfigProperties().get(name);
-    }
-
-    protected boolean forceLogin() {
-        return args.length > 0 && args[0].equals("-f");
-
-    }
-
-    public Client getHttpClient() {
-        return new ResteasyClientBuilder().disableTrustManager().build();
-    }
-
-    public void login() throws Exception {
-        checkEnv();
-        this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-        for (String arg : args) {
-            if (arg.equals("-f") || arg.equals("-force")) {
-                forceLogin = true;
-                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-            } else if (arg.equals("-browser") || arg.equals("-b")) {
-                browserLogin = true;
-                this.args = Arrays.copyOfRange(this.args, 1, this.args.length);
-            } else {
-                System.err.println("Illegal argument: " + arg);
-                printHelp();
-                System.exit(1);
-            }
-        }
-
-        String masterClient = getMasterClient();
-        if (!forceLogin && readToken(masterClient) != null) {
-            KeycloakInstalled.console().writer().println("Already logged in.  `kcinit -f` to force relogin");
-            return;
-        }
-        doConsoleLogin();
-        KeycloakInstalled.console().writer().println("Login successful!");
-    }
-
-    public void doConsoleLogin() throws Exception {
-        String masterClient = getMasterClient();
-        AdapterConfig config = getConfig();
-        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
-        //System.err.println("calling loginCommandLine");
-        if (!installed.loginCommandLine()) {
-            System.exit(1);
-        }
-        processResponse(installed, masterClient);
-    }
-
-    private String getMasterClient() {
-        return getProperty("client");
-    }
-
-    private void processResponse(KeycloakInstalled installed, String client) throws IOException {
-        AccessTokenResponse tokenResponse = installed.getTokenResponse();
-        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
-        tokenResponse.setIdToken(null);
-        String json = JsonSerialization.writeValueAsString(tokenResponse);
-        getTokenDirectory().mkdirs();
-        writeFile(getTokenFilePath(client), json);
-    }
-
-    public void logout() throws Exception {
-        String token = readRefreshToken(getMasterClient());
-        if (token != null) {
-            try {
-                KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(getConfig());
-                ServerRequest.invokeLogout(deployment, token);
-            } catch (Exception e) {
-                if (debug) {
-                    e.printStackTrace();
-                }
-            }
-
-        }
-        if (getTokenDirectory().exists()) {
-            for (File fp : getTokenDirectory().listFiles()) fp.delete();
-        }
-    }
-    public void uninstall() throws Exception {
-        File configFile = getConfigFile();
-        if (configFile.exists()) configFile.delete();
-        if (getTokenDirectory().exists()) {
-            for (File fp : getTokenDirectory().listFiles()) fp.delete();
-        }
-    }
-}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakCliSso.java

@@ -0,0 +1,281 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.installed;
+
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.KeycloakDeploymentBuilder;
+import org.keycloak.adapters.ServerRequest;
+import org.keycloak.common.util.Time;
+import org.keycloak.representations.AccessTokenResponse;
+import org.keycloak.representations.adapters.config.AdapterConfig;
+import org.keycloak.util.JsonSerialization;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ *
+ *
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class KeycloakCliSso {
+
+    public void mainCmd(String[] args) throws Exception {
+        if (args.length != 1) {
+            printHelp();
+            return;
+        }
+
+        if (args[0].equalsIgnoreCase("login")) {
+            login();
+        } else if (args[0].equalsIgnoreCase("login-manual")) {
+            loginManual();
+        }
+        /*
+        else if (args[0].equalsIgnoreCase("login-cli")) {
+            loginCli();
+        }
+        */
+        else if (args[0].equalsIgnoreCase("token")) {
+            token();
+        } else if (args[0].equalsIgnoreCase("logout")) {
+            logout();
+        } else if (args[0].equalsIgnoreCase("env")) {
+            System.out.println(System.getenv().toString());
+        } else {
+            printHelp();
+        }
+    }
+
+
+    public void printHelp() {
+        System.err.println("Commands:");
+        System.err.println("  login - login with desktop browser if available, otherwise do manual login.  Output is access token.");
+        System.err.println("  login-manual - manual login");
+        //System.err.println("  login-cli - attempt Keycloak proprietary cli protocol.  Otherwise do normal login");
+        System.err.println("  token - print access token if logged in");
+        System.err.println("  logout - logout.");
+        System.exit(1);
+    }
+
+    public AdapterConfig getConfig() {
+        String url = System.getProperty("KEYCLOAK_AUTH_SERVER");
+        if (url == null) {
+            System.err.println("KEYCLOAK_AUTH_SERVER property not set");
+            System.exit(1);
+        }
+        String realm = System.getProperty("KEYCLOAK_REALM");
+        if (realm == null) {
+            System.err.println("KEYCLOAK_REALM property not set");
+            System.exit(1);
+
+        }
+        String client = System.getProperty("KEYCLOAK_CLIENT");
+        if (client == null) {
+            System.err.println("KEYCLOAK_CLIENT property not set");
+            System.exit(1);
+        }
+        String secret = System.getProperty("KEYCLOAK_CLIENT_SECRET");
+
+
+
+        AdapterConfig config = new AdapterConfig();
+        config.setAuthServerUrl(url);
+        config.setRealm(realm);
+        config.setResource(client);
+        config.setSslRequired("external");
+        if (secret != null) {
+            Map<String, Object> creds = new HashMap<>();
+            creds.put("secret", secret);
+            config.setCredentials(creds);
+        } else {
+            config.setPublicClient(true);
+        }
+        return config;
+    }
+
+    public boolean checkToken(boolean outputToken) throws Exception {
+        String token = getTokenResponse();
+        if (token == null) return false;
+
+
+        if (token != null) {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
+                        return true;
+                    }
+                    AdapterConfig config = getConfig();
+                    KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+                    installed.refreshToken(tokenResponse.getRefreshToken());
+                    processResponse(installed, outputToken);
+                    return true;
+                } catch (Exception e) {
+                    System.err.println("Error processing existing token");
+                    e.printStackTrace();
+                }
+
+            }
+        }
+        return false;
+
+    }
+
+    private String getTokenResponse() throws IOException {
+        String token = null;
+        File tokenFile = getTokenFilePath();
+        if (tokenFile.exists()) {
+            FileInputStream fis = new FileInputStream(tokenFile);
+            byte[] data = new byte[(int) tokenFile.length()];
+            fis.read(data);
+            fis.close();
+            token = new String(data, "UTF-8");
+        }
+        return token;
+    }
+
+    public void token() throws Exception {
+        String token = getTokenResponse();
+        if (token == null) {
+            System.err.println("There is no token for client");
+            System.exit(1);
+        } else {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() < tokenResponse.getExpiresIn()) {
+                        System.out.println(tokenResponse.getToken());
+                        return;
+                    } else {
+                        System.err.println("token in response file is expired");
+                        System.exit(1);
+                    }
+                } catch (Exception e) {
+                    System.err.println("Failure processing token response file");
+                    e.printStackTrace();
+                    System.exit(1);
+                }
+            } else {
+                System.err.println("Could not find json within token response file");
+                System.exit(1);
+            }
+        }
+    }
+
+    public void login() throws Exception {
+        if (checkToken(true)) return;
+        AdapterConfig config = getConfig();
+        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+        installed.login();
+        processResponse(installed, true);
+    }
+
+    public void loginCli() throws Exception {
+        if (checkToken(false)) return;
+        AdapterConfig config = getConfig();
+        KeycloakInstalled installed = new KeycloakInstalled(KeycloakDeploymentBuilder.build(config));
+        if (!installed.loginCommandLine()) installed.login();
+        processResponse(installed, false);
+    }
+
+    public String getHome() {
+        String home = System.getenv("HOME");
+        if (home == null) {
+            home = System.getProperty("HOME");
+            if (home == null) {
+                home = Paths.get("").toAbsolutePath().normalize().toString();
+            }
+        }
+        return home;
+    }
+
+    public File getTokenDirectory() {
+        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM")).toFile();
+    }
+
+    public File getTokenFilePath() {
+        return Paths.get(getHome(), System.getProperty("basepath", ".keycloak-sso"), System.getProperty("KEYCLOAK_REALM"), System.getProperty("KEYCLOAK_CLIENT") + ".json").toFile();
+    }
+
+    private void processResponse(KeycloakInstalled installed, boolean outputToken) throws IOException {
+        AccessTokenResponse tokenResponse = installed.getTokenResponse();
+        tokenResponse.setExpiresIn(Time.currentTime() + tokenResponse.getExpiresIn());
+        tokenResponse.setIdToken(null);
+        String output = JsonSerialization.writeValueAsString(tokenResponse);
+        getTokenDirectory().mkdirs();
+        FileOutputStream fos = new FileOutputStream(getTokenFilePath());
+        fos.write(output.getBytes("UTF-8"));
+        fos.flush();
+        fos.close();
+        if (outputToken) System.out.println(tokenResponse.getToken());
+    }
+
+    public void loginManual() throws Exception {
+        if (checkToken(true)) return;
+        AdapterConfig config = getConfig();
+        KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
+        KeycloakInstalled installed = new KeycloakInstalled(deployment);
+        installed.loginManual();
+        processResponse(installed, true);
+    }
+
+    public void logout() throws Exception {
+        String token = getTokenResponse();
+        if (token != null) {
+            Matcher m = Pattern.compile("\\{.*\\}\\z").matcher(token);
+            if (m.find()) {
+                String json = m.group(0);
+                try {
+                    AccessTokenResponse tokenResponse = JsonSerialization.readValue(json, AccessTokenResponse.class);
+                    if (Time.currentTime() > tokenResponse.getExpiresIn()) {
+                        System.err.println("Login is expired");
+                        System.exit(1);
+                    }
+                    AdapterConfig config = getConfig();
+                    KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(config);
+                    ServerRequest.invokeLogout(deployment, tokenResponse.getRefreshToken());
+                    for (File fp : getTokenDirectory().listFiles()) fp.delete();
+                    System.out.println("logout complete");
+                } catch (Exception e) {
+                    System.err.println("Failure processing token response file");
+                    e.printStackTrace();
+                    System.exit(1);
+                }
+            } else {
+                System.err.println("Could not find json within token response file");
+                System.exit(1);
+            }
+        } else {
+            System.err.println("Not logged in");
+            System.exit(1);
+        }
+    }
+}

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakInstalled.java

@@ -39,7 +39,15 @@ import javax.ws.rs.core.Form;
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.Response;
 import java.awt.*;
-import java.io.*;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.PrintStream;
+import java.io.PrintWriter;
+import java.io.PushbackInputStream;
+import java.io.Reader;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.URI;
@@ -57,7 +65,6 @@ public class KeycloakInstalled {
 
     public interface HttpResponseWriter {
         void success(PrintWriter pw, KeycloakInstalled ki);
-
         void failure(PrintWriter pw, KeycloakInstalled ki);
     }
 
@@ -79,12 +86,12 @@ public class KeycloakInstalled {
     private Locale locale;
     private HttpResponseWriter loginResponseWriter;
     private HttpResponseWriter logoutResponseWriter;
-    private ResteasyClient resteasyClient;
     Pattern callbackPattern = Pattern.compile("callback\\s*=\\s*\"([^\"]+)\"");
     Pattern paramPattern = Pattern.compile("param=\"([^\"]+)\"\\s+label=\"([^\"]+)\"\\s+mask=(\\S+)");
     Pattern codePattern = Pattern.compile("code=([^&]+)");
 
 
+
     public KeycloakInstalled() {
         InputStream config = Thread.currentThread().getContextClassLoader().getResourceAsStream(KEYCLOAK_JSON);
         deployment = KeycloakDeploymentBuilder.build(config);
@@ -98,12 +105,70 @@ public class KeycloakInstalled {
         this.deployment = deployment;
     }
 
+    private static HttpResponseWriter defaultLoginWriter = new HttpResponseWriter() {
+        @Override
+        public void success(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Login completed.</h1><div>");
+            pw.println("This browser will remain logged in until you close it, logout, or the session expires.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+
+        @Override
+        public void failure(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Login attempt failed.</h1><div>");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+    };
+    private static HttpResponseWriter defaultLogoutWriter = new HttpResponseWriter() {
+        @Override
+        public void success(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Logout completed.</h1><div>");
+            pw.println("You may close this browser tab.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+
+        @Override
+        public void failure(PrintWriter pw, KeycloakInstalled ki) {
+            pw.println("HTTP/1.1 200 OK");
+            pw.println("Content-Type: text/html");
+            pw.println();
+            pw.println("<html><h1>Logout failed.</h1><div>");
+            pw.println("You may close this browser tab.");
+            pw.println("</div></html>");
+            pw.flush();
+
+        }
+    };
+
     public HttpResponseWriter getLoginResponseWriter() {
-        return null;
+        if (loginResponseWriter == null) {
+            return defaultLoginWriter;
+        } else {
+            return loginResponseWriter;
+        }
     }
 
     public HttpResponseWriter getLogoutResponseWriter() {
-        return null;
+        if (logoutResponseWriter == null) {
+            return defaultLogoutWriter;
+        } else {
+            return logoutResponseWriter;
+        }
     }
 
     public void setLoginResponseWriter(HttpResponseWriter loginResponseWriter) {
@@ -114,10 +179,6 @@ public class KeycloakInstalled {
         this.logoutResponseWriter = logoutResponseWriter;
     }
 
-    public void setResteasyClient(ResteasyClient resteasyClient) {
-        this.resteasyClient = resteasyClient;
-    }
-
     public Locale getLocale() {
         return locale;
     }
@@ -241,139 +302,6 @@ public class KeycloakInstalled {
         status = Status.LOGGED_MANUAL;
     }
 
-    public static class Console {
-        protected java.io.Console console = System.console();
-        protected PrintWriter writer;
-        protected BufferedReader reader;
-
-        static Console SINGLETON = new Console();
-
-        private Console() {
-        }
-
-
-        public PrintWriter writer() {
-            if (console == null) {
-                if (writer == null) {
-                    writer = new PrintWriter(System.err, true);
-                }
-                return writer;
-            }
-            return console.writer();
-        }
-
-        public Reader reader() {
-            if (console == null) {
-                return getReader();
-            }
-            return console.reader();
-        }
-
-        protected BufferedReader getReader() {
-            if (reader != null) return reader;
-            reader = new BufferedReader(new BufferedReader(new InputStreamReader(System.in)));
-            return reader;
-        }
-
-        public Console format(String fmt, Object... args) {
-            if (console == null) {
-                writer().format(fmt, args);
-                return this;
-            }
-            console.format(fmt, args);
-            return this;
-        }
-
-        public Console printf(String format, Object... args) {
-            if (console == null) {
-                writer().printf(format, args);
-                return this;
-            }
-            console.printf(format, args);
-            return this;
-        }
-
-        public String readLine(String fmt, Object... args) {
-            if (console == null) {
-                format(fmt, args);
-                return readLine();
-            }
-            return console.readLine(fmt, args);
-        }
-
-        public boolean confirm(String fmt, Object... args) {
-            String prompt = "";
-            while (!"y".equals(prompt) && !"n".equals(prompt)) {
-                prompt = readLine(fmt, args);
-            }
-            return "y".equals(prompt);
-
-        }
-
-        public String prompt(String fmt, Object... args) {
-            String prompt = "";
-            while (prompt.equals("")) {
-                prompt = readLine(fmt, args).trim();
-            }
-            return prompt;
-
-        }
-
-        public String passwordPrompt(String fmt, Object... args) {
-            String prompt = "";
-            while (prompt.equals("")) {
-                char[] val = readPassword(fmt, args);
-                prompt = new String(val);
-                prompt = prompt.trim();
-            }
-            return prompt;
-
-        }
-
-        public String readLine() {
-            if (console == null) {
-                try {
-                    return getReader().readLine();
-                } catch (IOException e) {
-                    throw new RuntimeException(e);
-                }
-            }
-            return console.readLine();
-        }
-
-        public char[] readPassword(String fmt, Object... args) {
-            if (console == null) {
-                return readLine(fmt, args).toCharArray();
-
-            }
-            return console.readPassword(fmt, args);
-        }
-
-        public char[] readPassword() {
-            if (console == null) {
-                return readLine().toCharArray();
-            }
-            return console.readPassword();
-        }
-
-        public void flush() {
-            if (console == null) {
-                System.err.flush();
-                return;
-            }
-            console.flush();
-        }
-
-        public void stderrOutput() {
-            //System.err.println("not using System.console()");
-            console = null;
-        }
-    }
-
-    public static Console console() {
-        return Console.SINGLETON;
-    }
-
     public boolean loginCommandLine() throws IOException, ServerRequest.HttpFailure, VerificationException {
         String redirectUri = "urn:ietf:wg:oauth:2.0:oob";
 
@@ -381,6 +309,7 @@ public class KeycloakInstalled {
     }
 
 
+
     /**
      * Experimental proprietary WWW-Authentication challenge protocol.
      * WWW-Authentication: X-Text-Form-Challenge callback="{url}" param="{param-name}" label="{param-display-label}"
@@ -396,116 +325,62 @@ public class KeycloakInstalled {
                 .queryParam(OAuth2Constants.RESPONSE_TYPE, OAuth2Constants.CODE)
                 .queryParam(OAuth2Constants.CLIENT_ID, deployment.getResourceName())
                 .queryParam(OAuth2Constants.REDIRECT_URI, redirectUri)
-                .queryParam("display", "console")
                 .queryParam(OAuth2Constants.SCOPE, OAuth2Constants.SCOPE_OPENID)
                 .build().toString();
-        ResteasyClient client = createResteasyClient();
+        ResteasyClient client = new ResteasyClientBuilder().disableTrustManager().build();
         try {
-            //System.err.println("initial request");
             Response response = client.target(authUrl).request().get();
+            if (response.getStatus() != 401) {
+                return false;
+            }
             while (true) {
-                if (response.getStatus() == 403) {
-                    if (response.getMediaType() != null) {
-                        String splash = response.readEntity(String.class);
-                        console().writer().println(splash);
-                    } else {
-                        System.err.println("Forbidden to login");
-                    }
-                    return false;
-                } else if (response.getStatus() == 401) {
-                    String authenticationHeader = response.getHeaderString(HttpHeaders.WWW_AUTHENTICATE);
-                    if (authenticationHeader == null) {
-                        System.err.println("Failure:  Invalid protocol.  No WWW-Authenticate header");
-                        return false;
-                    }
-                    //System.err.println("got header: " + authenticationHeader);
-                    if (!authenticationHeader.contains("X-Text-Form-Challenge")) {
-                        System.err.println("Failure:  Invalid WWW-Authenticate header.");
-                        return false;
-                    }
-                    if (response.getMediaType() != null) {
-                        String splash = response.readEntity(String.class);
-                        console().writer().println(splash);
-                    } else {
-                        response.close();
-                    }
-                    Matcher m = callbackPattern.matcher(authenticationHeader);
-                    if (!m.find()) {
-                        System.err.println("Failure: Invalid WWW-Authenticate header.");
-                        return false;
-                    }
-                    String callback = m.group(1);
-                    //System.err.println("callback: " + callback);
-                    m = paramPattern.matcher(authenticationHeader);
-                    Form form = new Form();
-                    while (m.find()) {
-                        String param = m.group(1);
-                        String label = m.group(2);
-                        String mask = m.group(3).trim();
-                        boolean maskInput = mask.equals("true");
-                        String value = null;
-                        if (maskInput) {
-                            char[] txt = console().readPassword(label);
-                            value = new String(txt);
-                        } else {
-                            value = console().readLine(label);
-                        }
-                        form.param(param, value);
-                    }
-                    response.close();
-                    client.close();
-                    client = createResteasyClient();
-                    response = client.target(callback).request().post(Entity.form(form));
-                } else if (response.getStatus() == 302) {
-                    int redirectCount = 0;
-                    do {
-                        String location = response.getLocation().toString();
-                        Matcher m = codePattern.matcher(location);
-                        if (!m.find()) {
-                            response.close();
-                            client.close();
-                            client = createResteasyClient();
-                            response = client.target(location).request().get();
-                        } else {
-                            response.close();
-                            client.close();
-                            String code = m.group(1);
-                            processCode(code, redirectUri);
-                            return true;
-                        }
-                        if (response.getStatus() == 302 && redirectCount++ > 4) {
-                            System.err.println("Too many redirects.  Aborting");
-                            return false;
-                        }
-                    } while (response.getStatus() == 302);
-                } else {
-                    System.err.println("Unknown response from server: " + response.getStatus());
+                String authenticationHeader = response.getHeaderString(HttpHeaders.WWW_AUTHENTICATE);
+                if (authenticationHeader == null) {
                     return false;
                 }
+                if (!authenticationHeader.contains("X-Text-Form-Challenge")) {
+                    return false;
+                }
+                if (response.getMediaType() != null) {
+                    String splash = response.readEntity(String.class);
+                    System.console().writer().println(splash);
+                }
+                Matcher m = callbackPattern.matcher(authenticationHeader);
+                if (!m.find()) return false;
+                String callback = m.group(1);
+                //System.err.println("callback: " + callback);
+                m = paramPattern.matcher(authenticationHeader);
+                Form form = new Form();
+                while (m.find()) {
+                    String param = m.group(1);
+                    String label = m.group(2);
+                    String mask = m.group(3).trim();
+                    boolean maskInput = mask.equals("true");
+                    String value = null;
+                    if (maskInput) {
+                        char[] txt = System.console().readPassword(label);
+                        value = new String(txt);
+                    } else {
+                        value = System.console().readLine(label);
+                    }
+                    form.param(param, value);
+                }
+                response = client.target(callback).request().post(Entity.form(form));
+                if (response.getStatus() == 401) continue;
+                if (response.getStatus() != 302) return false;
+                String location = response.getLocation().toString();
+                m = codePattern.matcher(location);
+                if (!m.find()) return false;
+                String code = m.group(1);
+                processCode(code, redirectUri);
+                return true;
             }
-        } catch (Exception ex) {
-            throw ex;
         } finally {
             client.close();
 
         }
     }
 
-    protected ResteasyClient getResteasyClient() {
-        if (this.resteasyClient == null) {
-            this.resteasyClient = createResteasyClient();
-        }
-        return this.resteasyClient;
-    }
-
-    protected ResteasyClient createResteasyClient() {
-        return new ResteasyClientBuilder()
-                .connectionCheckoutTimeout(1, TimeUnit.HOURS)
-                .connectionTTL(1, TimeUnit.HOURS)
-                .socketTimeout(1, TimeUnit.HOURS)
-                .disableTrustManager().build();
-    }
-
 
     public String getTokenString() throws VerificationException, IOException, ServerRequest.HttpFailure {
         return tokenString;
@@ -525,7 +400,7 @@ public class KeycloakInstalled {
         parseAccessToken(tokenResponse);
     }
 
-    public void refreshToken(String refreshToken) throws IOException, ServerRequest.HttpFailure, VerificationException {
+    public void refreshToken(String refreshToken)  throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeRefresh(deployment, refreshToken);
         parseAccessToken(tokenResponse);
 
@@ -577,6 +452,7 @@ public class KeycloakInstalled {
     }
 
 
+
     private void processCode(String code, String redirectUri) throws IOException, ServerRequest.HttpFailure, VerificationException {
         AccessTokenResponse tokenResponse = ServerRequest.invokeAccessCodeToToken(deployment, code, redirectUri, null);
         parseAccessToken(tokenResponse);
@@ -598,6 +474,86 @@ public class KeycloakInstalled {
         return sb.toString();
     }
 
+    public static class MaskingThread extends Thread {
+        private volatile boolean stop;
+        private char echochar = '*';
+
+        public MaskingThread() {
+        }
+
+        /**
+         * Begin masking until asked to stop.
+         */
+        public void run() {
+
+            int priority = Thread.currentThread().getPriority();
+            Thread.currentThread().setPriority(Thread.MAX_PRIORITY);
+
+            try {
+                stop = true;
+                while(stop) {
+                    System.out.print("\010" + echochar);
+                    try {
+                        // attempt masking at this rate
+                        Thread.currentThread().sleep(1);
+                    }catch (InterruptedException iex) {
+                        Thread.currentThread().interrupt();
+                        return;
+                    }
+                }
+            } finally { // restore the original priority
+                Thread.currentThread().setPriority(priority);
+            }
+        }
+
+        /**
+         * Instruct the thread to stop masking.
+         */
+        public void stopMasking() {
+            this.stop = false;
+        }
+    }
+
+    public static String readMasked(Reader reader) {
+        MaskingThread et = new MaskingThread();
+        Thread mask = new Thread(et);
+        mask.start();
+
+        BufferedReader in = new BufferedReader(reader);
+        String password = "";
+
+        try {
+            password = in.readLine();
+        } catch (IOException ioe) {
+            ioe.printStackTrace();
+        }
+        // stop masking
+        et.stopMasking();
+        // return the password entered by the user
+        return password;
+    }
+
+    private String readLine(Reader reader, boolean mask) throws IOException {
+        if (mask) {
+            System.out.print(" ");
+            return readMasked(reader);
+        }
+
+        StringBuilder sb = new StringBuilder();
+
+        char cb[] = new char[1];
+        while (reader.read(cb) != -1) {
+            char c = cb[0];
+            if ((c == '\n') || (c == '\r')) {
+                break;
+            } else {
+                sb.append(c);
+            }
+        }
+
+        return sb.toString();
+    }
+
 
     public class CallbackListener extends Thread {
 
@@ -651,26 +607,11 @@ public class KeycloakInstalled {
 
                 OutputStreamWriter out = new OutputStreamWriter(socket.getOutputStream());
                 PrintWriter pw = new PrintWriter(out);
-                if (writer != null) {
-                    System.err.println("Using a writer is deprecated.  Please remove its usage.  This is now handled by endpoint on server");
-                }
 
                 if (error == null) {
-                     if (writer != null) {
-                         writer.success(pw, KeycloakInstalled.this);
-                     } else {
-                         pw.println("HTTP/1.1 302 Found");
-                         pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated"));
-
-                     }
+                    writer.success(pw, KeycloakInstalled.this);
                 } else {
-                    if (writer != null) {
-                        writer.failure(pw, KeycloakInstalled.this);
-                    } else {
-                        pw.println("HTTP/1.1 302 Found");
-                        pw.println("Location: " + deployment.getTokenUrl().replace("/token", "/delegated?error=true"));
-
-                    }
+                    writer.failure(pw, KeycloakInstalled.this);
                 }
                 pw.flush();
                 socket.close();

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jaxrs-oauth-client/src/main/java/org/keycloak/jaxrs/JaxrsHttpFacade.java

@@ -27,9 +27,6 @@ import javax.security.cert.X509Certificate;
 import javax.ws.rs.container.ContainerRequestContext;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.SecurityContext;
-
-import java.io.BufferedInputStream;
-import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.util.List;
@@ -54,8 +51,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
     protected class RequestFacade implements OIDCHttpFacade.Request {
 
-        private InputStream inputStream;
-
         @Override
         public String getFirstParam(String param) {
             throw new RuntimeException("NOT IMPLEMENTED");
@@ -113,19 +108,6 @@ public class JaxrsHttpFacade implements OIDCHttpFacade {
 
         @Override
         public InputStream getInputStream() {
-            return getInputStream(false);
-        }
-
-        @Override
-        public InputStream getInputStream(boolean buffered) {
-            if (inputStream != null) {
-                return inputStream;
-            }
-
-            if (buffered) {
-                return inputStream = new BufferedInputStream(requestContext.getEntityStream());
-            }
-
             return requestContext.getEntityStream();
         }
 

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Jetty Integration</name>

adapters/oidc/js/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/js/src/main/resources/keycloak.d.ts

@@ -1,495 +1,483 @@
-/*
- * MIT License
- *
- * Copyright 2017 Brett Epps <https://github.com/eppsilon>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
- * associated documentation files (the "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
- * following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all copies or substantial
- * portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
- * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
- * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
- * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
-export as namespace Keycloak;
-
-export = Keycloak;
-
-/**
- * Creates a new Keycloak client instance.
- * @param config Path to a JSON config file or a plain config object.
- */
-declare function Keycloak(config?: string|{}): Keycloak.KeycloakInstance;
-
-declare namespace Keycloak {
-	type KeycloakAdapterName = 'cordova'|'default' | any;
-	type KeycloakOnLoad = 'login-required'|'check-sso';
-	type KeycloakResponseMode = 'query'|'fragment';
-	type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
-	type KeycloakFlow = 'standard'|'implicit'|'hybrid';
-
-	interface KeycloakInitOptions {
-		/**
-		 * @private Undocumented.
-		 */
-		useNonce?: boolean;
-
-		/**
-		 * Allows to use different adapter:
-		 * 
-		 * - {string} default - using browser api for redirects
-		 * - {string} cordova - using cordova plugins 
-		 * - {function} - allows to provide custom function as adapter.
-		 */
-		adapter?: KeycloakAdapterName;
-		
-		/**
-		 * Specifies an action to do on load.
-		 */
-		onLoad?: KeycloakOnLoad;
-
-		/**
-		 * Set an initial value for the token.
-		 */
-		token?: string;
-
-		/**
-		 * Set an initial value for the refresh token.
-		 */
-		refreshToken?: string;
-
-		/**
-		 * Set an initial value for the id token (only together with `token` or
-		 * `refreshToken`).
-		 */
-		idToken?: string;
-
-		/**
-		 * Set an initial value for skew between local time and Keycloak server in
-		 * seconds (only together with `token` or `refreshToken`).
-		 */
-		timeSkew?: number;
-
-		/**
-		 * Set to enable/disable monitoring login state.
-		 * @default true
-		 */
-		checkLoginIframe?: boolean;
-
-		/**
-		 * Set the interval to check login state (in seconds).
-		 * @default 5
-		 */
-		checkLoginIframeInterval?: number;
-
-		/**
-		 * Set the OpenID Connect response mode to send to Keycloak upon login.
-		 * @default fragment After successful authentication Keycloak will redirect
-		 *                   to JavaScript application with OpenID Connect parameters
-		 *                   added in URL fragment. This is generally safer and
-		 *                   recommended over query.
-		 */
-		responseMode?: KeycloakResponseMode;
-
-		/**
-		 * Set the OpenID Connect flow.
-		 * @default standard
-		 */
-		flow?: KeycloakFlow;
-	}
-
-	interface KeycloakLoginOptions {
-		/**
-		 * @private Undocumented.
-		 */
-		scope?: string;
-
-		/**
-		 * Specifies the uri to redirect to after login.
-		 */
-		redirectUri?: string;
-
-		/**
-		 * By default the login screen is displayed if the user is not logged into
-		 * Keycloak. To only authenticate to the application if the user is already
-		 * logged in and not display the login page if the user is not logged in, set
-		 * this option to `'none'`. To always require re-authentication and ignore
-		 * SSO, set this option to `'login'`.
-		 */
-		prompt?: 'none'|'login';
-
-		/**
-		 * If value is `'register'` then user is redirected to registration page,
-		 * otherwise to login page.
-		 */
-		action?: 'register';
-
-		/**
-		 * Used just if user is already authenticated. Specifies maximum time since
-		 * the authentication of user happened. If user is already authenticated for
-		 * longer time than `'maxAge'`, the SSO is ignored and he will need to
-		 * authenticate again.
-		 */
-		maxAge?: number;
-
-		/**
-		 * Used to pre-fill the username/email field on the login form.
-		 */
-		loginHint?: string;
-
-		/**
-		 * Used to tell Keycloak which IDP the user wants to authenticate with.
-		 */
-		idpHint?: string;
-
-	        /**
-		 * Sets the 'ui_locales' query param in compliance with section 3.1.2.1
-                 * of the OIDC 1.0 specification.
-		 */
-		locale?: string;
-                
-                /**
-		 * Specifies the desired Keycloak locale for the UI.  This differs from
-                 * the locale param in that it tells the Keycloak server to set a cookie and update
-                 * the user's profile to a new preferred locale.
-		 */
-		kcLocale?: string;
-	}
-
-	type KeycloakPromiseCallback<T> = (result: T) => void;
-
-	interface KeycloakPromise<TSuccess, TError> {
-		/**
-		 * Function to call if the promised action succeeds.
-		 */
-		success(callback: KeycloakPromiseCallback<TSuccess>): KeycloakPromise<TSuccess, TError>;
-
-		/**
-		 * Function to call if the promised action throws an error.
-		 */
-		error(callback: KeycloakPromiseCallback<TError>): KeycloakPromise<TSuccess, TError>;
-	}
-
-	interface KeycloakError {
-		error: string;
-		error_description: string;
-	}
-
-	interface KeycloakAdapter {
-		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-		logout(options?: any): KeycloakPromise<void, void>;
-		register(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-		accountManagement(): KeycloakPromise<void, void>;
-		redirectUri(options: { redirectUri: string; }, encodeHash: boolean): string;
-	}
-
-	interface KeycloakProfile {
-		id?: string;
-		username?: string;
-		email?: string;
-		firstName?: string;
-		lastName?: string;
-		enabled?: boolean;
-		emailVerified?: boolean;
-		totp?: boolean;
-		createdTimestamp?: number;
-	}
-
-	// export interface KeycloakUserInfo {}
-
-	/**
-	 * A client for the Keycloak authentication server.
-	 * @see {@link https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html|Keycloak JS adapter documentation}
-	 */
-	interface KeycloakInstance {
-		/**
-		 * Is true if the user is authenticated, false otherwise.
-		 */
-		authenticated?: boolean;
-
-		/**
-		 * The user id.
-		 */
-		subject?: string;
-
-		/**
-		 * Response mode passed in init (default value is `'fragment'`).
-		 */
-		responseMode?: KeycloakResponseMode;
-
-		/**
-		 * Response type sent to Keycloak with login requests. This is determined
-		 * based on the flow value used during initialization, but can be overridden
-		 * by setting this value.
-		 */
-		responseType?: KeycloakResponseType;
-
-		/**
-		 * Flow passed in init.
-		 */
-		flow?: KeycloakFlow;
-
-		/**
-		 * The realm roles associated with the token.
-		 */
-		realmAccess?: { roles: string[] };
-
-		/**
-		 * The resource roles associated with the token.
-		 */
-		resourceAccess?: string[];
-
-		/**
-		 * The base64 encoded token that can be sent in the Authorization header in
-		 * requests to services.
-		 */
-		token?: string;
-
-		/**
-		 * The parsed token as a JavaScript object.
-		 */
-		tokenParsed?: {
-			exp?: number;
-			iat?: number;
-			nonce?: string;
-			sub?: string;
-			session_state?: string;
-			realm_access?: { roles: string[] };
-			resource_access?: string[];
-		};
-
-		/**
-		 * The base64 encoded refresh token that can be used to retrieve a new token.
-		 */
-		refreshToken?: string;
-
-		/**
-		 * The parsed refresh token as a JavaScript object.
-		 */
-		refreshTokenParsed?: { nonce?: string };
-
-		/**
-		 * The base64 encoded ID token.
-		 */
-		idToken?: string;
-
-		/**
-		 * The parsed id token as a JavaScript object.
-		 */
-		idTokenParsed?: { nonce?: string };
-
-		/**
-		 * The estimated time difference between the browser time and the Keycloak
-		 * server in seconds. This value is just an estimation, but is accurate
-		 * enough when determining if a token is expired or not.
-		 */
-		timeSkew?: number;
-
-		/**
-		 * @private Undocumented.
-		 */
-		loginRequired?: boolean;
-
-		/**
-		 * @private Undocumented.
-		 */
-		authServerUrl?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		realm?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		clientId?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		clientSecret?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		redirectUri?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		sessionId?: string;
-
-		/**
-		 * @private Undocumented.
-		 */
-		profile?: KeycloakProfile;
-
-		/**
-		 * @private Undocumented.
-		 */
-		userInfo?: {}; // KeycloakUserInfo;
-
-		/**
-		 * Called when the adapter is initialized.
-		 */
-		onReady?(authenticated?: boolean): void;
-
-		/**
-		 * Called when a user is successfully authenticated.
-		 */
-		onAuthSuccess?(): void;
-
-		/**
-		 * Called if there was an error during authentication.
-		 */
-		onAuthError?(errorData: KeycloakError): void;
-
-		/**
-		 * Called when the token is refreshed.
-		 */
-		onAuthRefreshSuccess?(): void;
-
-		/**
-		 * Called if there was an error while trying to refresh the token.
-		 */
-		onAuthRefreshError?(): void;
-
-		/**
-		 * Called if the user is logged out (will only be called if the session
-		 * status iframe is enabled, or in Cordova mode).
-		 */
-		onAuthLogout?(): void;
-
-		/**
-		 * Called when the access token is expired. If a refresh token is available
-		 * the token can be refreshed with Keycloak#updateToken, or in cases where
-		 * it's not (ie. with implicit flow) you can redirect to login screen to
-		 * obtain a new access token.
-		 */
-		onTokenExpired?(): void;
-
-		/**
-		 * Called to initialize the adapter.
-		 * @param initOptions Initialization options.
-		 * @returns A promise to set functions to be invoked on success or error.
-		 */
-		init(initOptions: KeycloakInitOptions): KeycloakPromise<boolean, KeycloakError>;
-
-		/**
-		 * Redirects to login form.
-		 * @param options Login options.
-		 */
-		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to logout.
-		 * @param options Logout options.
-		 * @param options.redirectUri Specifies the uri to redirect to after logout.
-		 */
-		logout(options?: any): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to registration form.
-		 * @param options Supports same options as Keycloak#login but `action` is
-		 *                set to `'register'`.
-		 */
-		register(options?: any): KeycloakPromise<void, void>;
-
-		/**
-		 * Redirects to the Account Management Console.
-		 */
-		accountManagement(): KeycloakPromise<void, void>;
-
-		/**
-		 * Returns the URL to login form.
-		 * @param options Supports same options as Keycloak#login.
-		 */
-		createLoginUrl(options?: KeycloakLoginOptions): string;
-
-		/**
-		 * Returns the URL to logout the user.
-		 * @param options Logout options.
-		 * @param options.redirectUri Specifies the uri to redirect to after logout.
-		 */
-		createLogoutUrl(options?: any): string;
-
-		/**
-		 * Returns the URL to registration page.
-		 * @param options Supports same options as Keycloak#createLoginUrl but
-		 *                `action` is set to `'register'`.
-		 */
-		createRegisterUrl(options?: KeycloakLoginOptions): string;
-
-		/**
-		 * Returns the URL to the Account Management Console.
-		 */
-		createAccountUrl(): string;
-
-		/**
-		 * Returns true if the token has less than `minValidity` seconds left before
-		 * it expires.
-		 * @param minValidity If not specified, `0` is used.
-		 */
-		isTokenExpired(minValidity?: number): boolean;
-
-		/**
-		 * If the token expires within `minValidity` seconds, the token is refreshed.
-		 * If the session status iframe is enabled, the session status is also
-		 * checked.
-		 * @returns A promise to set functions that can be invoked if the token is
-		 *          still valid, or if the token is no longer valid.
-		 * @example
-		 * ```js
-		 * keycloak.updateToken(5).success(function(refreshed) {
-		 *   if (refreshed) {
-		 *     alert('Token was successfully refreshed');
-		 *   } else {
-		 *     alert('Token is still valid');
-		 *   }
-		 * }).error(function() {
-		 *   alert('Failed to refresh the token, or the session has expired');
-		 * });
-		 */
-		updateToken(minValidity: number): KeycloakPromise<boolean, boolean>;
-
-		/**
-		 * Clears authentication state, including tokens. This can be useful if
-		 * the application has detected the session was expired, for example if
-		 * updating token fails. Invoking this results in Keycloak#onAuthLogout
-		 * callback listener being invoked.
-		 */
-		clearToken(): void;
-
-		/**
-		 * Returns true if the token has the given realm role.
-		 * @param role A realm role name.
-		 */
-		hasRealmRole(role: string): boolean;
-
-		/**
-		 * Returns true if the token has the given role for the resource.
-		 * @param role A role name.
-		 * @param resource If not specified, `clientId` is used.
-		 */
-		hasResourceRole(role: string, resource?: string): boolean;
-
-		/**
-		 * Loads the user's profile.
-		 * @returns A promise to set functions to be invoked on success or error.
-		 */
-		loadUserProfile(): KeycloakPromise<KeycloakProfile, void>;
-
-		/**
-		 * @private Undocumented.
-		 */
-		loadUserInfo(): KeycloakPromise<{}, void>;
-	}
-}
+/*
+ * MIT License
+ *
+ * Copyright 2017 Brett Epps <https://github.com/eppsilon>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+ * associated documentation files (the "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+ * following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+ * LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+ * NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+export as namespace Keycloak;
+
+export = Keycloak;
+
+/**
+ * Creates a new Keycloak client instance.
+ * @param config Path to a JSON config file or a plain config object.
+ */
+declare function Keycloak(config?: string|{}): Keycloak.KeycloakInstance;
+
+declare namespace Keycloak {
+	type KeycloakAdapterName = 'cordova'|'default';
+	type KeycloakOnLoad = 'login-required'|'check-sso';
+	type KeycloakResponseMode = 'query'|'fragment';
+	type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
+	type KeycloakFlow = 'standard'|'implicit'|'hybrid';
+
+	interface KeycloakInitOptions {
+		/**
+		 * @private Undocumented.
+		 */
+		useNonce?: boolean;
+
+		/**
+		 * @private Undocumented.
+		 */
+		adapter?: KeycloakAdapterName;
+		
+		/**
+		 * Specifies an action to do on load.
+		 */
+		onLoad?: KeycloakOnLoad;
+
+		/**
+		 * Set an initial value for the token.
+		 */
+		token?: string;
+
+		/**
+		 * Set an initial value for the refresh token.
+		 */
+		refreshToken?: string;
+
+		/**
+		 * Set an initial value for the id token (only together with `token` or
+		 * `refreshToken`).
+		 */
+		idToken?: string;
+
+		/**
+		 * Set an initial value for skew between local time and Keycloak server in
+		 * seconds (only together with `token` or `refreshToken`).
+		 */
+		timeSkew?: number;
+
+		/**
+		 * Set to enable/disable monitoring login state.
+		 * @default true
+		 */
+		checkLoginIframe?: boolean;
+
+		/**
+		 * Set the interval to check login state (in seconds).
+		 * @default 5
+		 */
+		checkLoginIframeInterval?: number;
+
+		/**
+		 * Set the OpenID Connect response mode to send to Keycloak upon login.
+		 * @default fragment After successful authentication Keycloak will redirect
+		 *                   to JavaScript application with OpenID Connect parameters
+		 *                   added in URL fragment. This is generally safer and
+		 *                   recommended over query.
+		 */
+		responseMode?: KeycloakResponseMode;
+
+		/**
+		 * Set the OpenID Connect flow.
+		 * @default standard
+		 */
+		flow?: KeycloakFlow;
+	}
+
+	interface KeycloakLoginOptions {
+		/**
+		 * @private Undocumented.
+		 */
+		scope?: string;
+
+		/**
+		 * Specifies the uri to redirect to after login.
+		 */
+		redirectUri?: string;
+
+		/**
+		 * By default the login screen is displayed if the user is not logged into
+		 * Keycloak. To only authenticate to the application if the user is already
+		 * logged in and not display the login page if the user is not logged in, set
+		 * this option to `'none'`. To always require re-authentication and ignore
+		 * SSO, set this option to `'login'`.
+		 */
+		prompt?: 'none'|'login';
+
+		/**
+		 * If value is `'register'` then user is redirected to registration page,
+		 * otherwise to login page.
+		 */
+		action?: 'register';
+
+		/**
+		 * Used just if user is already authenticated. Specifies maximum time since
+		 * the authentication of user happened. If user is already authenticated for
+		 * longer time than `'maxAge'`, the SSO is ignored and he will need to
+		 * authenticate again.
+		 */
+		maxAge?: number;
+
+		/**
+		 * Used to pre-fill the username/email field on the login form.
+		 */
+		loginHint?: string;
+
+		/**
+		 * Used to tell Keycloak which IDP the user wants to authenticate with.
+		 */
+		idpHint?: string;
+
+		/**
+		 * Specifies the desired locale for the UI.
+		 */
+		locale?: string;
+	}
+
+	type KeycloakPromiseCallback<T> = (result: T) => void;
+
+	interface KeycloakPromise<TSuccess, TError> {
+		/**
+		 * Function to call if the promised action succeeds.
+		 */
+		success(callback: KeycloakPromiseCallback<TSuccess>): KeycloakPromise<TSuccess, TError>;
+
+		/**
+		 * Function to call if the promised action throws an error.
+		 */
+		error(callback: KeycloakPromiseCallback<TError>): KeycloakPromise<TSuccess, TError>;
+	}
+
+	interface KeycloakError {
+		error: string;
+		error_description: string;
+	}
+
+	interface KeycloakAdapter {
+		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+		logout(options?: any): KeycloakPromise<void, void>;
+		register(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+		accountManagement(): KeycloakPromise<void, void>;
+		redirectUri(options: { redirectUri: string; }, encodeHash: boolean): string;
+	}
+
+	interface KeycloakProfile {
+		id?: string;
+		username?: string;
+		email?: string;
+		firstName?: string;
+		lastName?: string;
+		enabled?: boolean;
+		emailVerified?: boolean;
+		totp?: boolean;
+		createdTimestamp?: number;
+	}
+
+	// export interface KeycloakUserInfo {}
+
+	/**
+	 * A client for the Keycloak authentication server.
+	 * @see {@link https://keycloak.gitbooks.io/securing-client-applications-guide/content/topics/oidc/javascript-adapter.html|Keycloak JS adapter documentation}
+	 */
+	interface KeycloakInstance {
+		/**
+		 * Is true if the user is authenticated, false otherwise.
+		 */
+		authenticated?: boolean;
+
+		/**
+		 * The user id.
+		 */
+		subject?: string;
+
+		/**
+		 * Response mode passed in init (default value is `'fragment'`).
+		 */
+		responseMode?: KeycloakResponseMode;
+
+		/**
+		 * Response type sent to Keycloak with login requests. This is determined
+		 * based on the flow value used during initialization, but can be overridden
+		 * by setting this value.
+		 */
+		responseType?: KeycloakResponseType;
+
+		/**
+		 * Flow passed in init.
+		 */
+		flow?: KeycloakFlow;
+
+		/**
+		 * The realm roles associated with the token.
+		 */
+		realmAccess?: { roles: string[] };
+
+		/**
+		 * The resource roles associated with the token.
+		 */
+		resourceAccess?: string[];
+
+		/**
+		 * The base64 encoded token that can be sent in the Authorization header in
+		 * requests to services.
+		 */
+		token?: string;
+
+		/**
+		 * The parsed token as a JavaScript object.
+		 */
+		tokenParsed?: {
+			exp?: number;
+			iat?: number;
+			nonce?: string;
+			sub?: string;
+			session_state?: string;
+			realm_access?: { roles: string[] };
+			resource_access?: string[];
+		};
+
+		/**
+		 * The base64 encoded refresh token that can be used to retrieve a new token.
+		 */
+		refreshToken?: string;
+
+		/**
+		 * The parsed refresh token as a JavaScript object.
+		 */
+		refreshTokenParsed?: { nonce?: string };
+
+		/**
+		 * The base64 encoded ID token.
+		 */
+		idToken?: string;
+
+		/**
+		 * The parsed id token as a JavaScript object.
+		 */
+		idTokenParsed?: { nonce?: string };
+
+		/**
+		 * The estimated time difference between the browser time and the Keycloak
+		 * server in seconds. This value is just an estimation, but is accurate
+		 * enough when determining if a token is expired or not.
+		 */
+		timeSkew?: number;
+
+		/**
+		 * @private Undocumented.
+		 */
+		loginRequired?: boolean;
+
+		/**
+		 * @private Undocumented.
+		 */
+		authServerUrl?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		realm?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		clientId?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		clientSecret?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		redirectUri?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		sessionId?: string;
+
+		/**
+		 * @private Undocumented.
+		 */
+		profile?: KeycloakProfile;
+
+		/**
+		 * @private Undocumented.
+		 */
+		userInfo?: {}; // KeycloakUserInfo;
+
+		/**
+		 * Called when the adapter is initialized.
+		 */
+		onReady?(authenticated?: boolean): void;
+
+		/**
+		 * Called when a user is successfully authenticated.
+		 */
+		onAuthSuccess?(): void;
+
+		/**
+		 * Called if there was an error during authentication.
+		 */
+		onAuthError?(errorData: KeycloakError): void;
+
+		/**
+		 * Called when the token is refreshed.
+		 */
+		onAuthRefreshSuccess?(): void;
+
+		/**
+		 * Called if there was an error while trying to refresh the token.
+		 */
+		onAuthRefreshError?(): void;
+
+		/**
+		 * Called if the user is logged out (will only be called if the session
+		 * status iframe is enabled, or in Cordova mode).
+		 */
+		onAuthLogout?(): void;
+
+		/**
+		 * Called when the access token is expired. If a refresh token is available
+		 * the token can be refreshed with Keycloak#updateToken, or in cases where
+		 * it's not (ie. with implicit flow) you can redirect to login screen to
+		 * obtain a new access token.
+		 */
+		onTokenExpired?(): void;
+
+		/**
+		 * Called to initialize the adapter.
+		 * @param initOptions Initialization options.
+		 * @returns A promise to set functions to be invoked on success or error.
+		 */
+		init(initOptions: KeycloakInitOptions): KeycloakPromise<boolean, KeycloakError>;
+
+		/**
+		 * Redirects to login form.
+		 * @param options Login options.
+		 */
+		login(options?: KeycloakLoginOptions): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to logout.
+		 * @param options Logout options.
+		 * @param options.redirectUri Specifies the uri to redirect to after logout.
+		 */
+		logout(options?: any): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to registration form.
+		 * @param options Supports same options as Keycloak#login but `action` is
+		 *                set to `'register'`.
+		 */
+		register(options?: any): KeycloakPromise<void, void>;
+
+		/**
+		 * Redirects to the Account Management Console.
+		 */
+		accountManagement(): KeycloakPromise<void, void>;
+
+		/**
+		 * Returns the URL to login form.
+		 * @param options Supports same options as Keycloak#login.
+		 */
+		createLoginUrl(options?: KeycloakLoginOptions): string;
+
+		/**
+		 * Returns the URL to logout the user.
+		 * @param options Logout options.
+		 * @param options.redirectUri Specifies the uri to redirect to after logout.
+		 */
+		createLogoutUrl(options?: any): string;
+
+		/**
+		 * Returns the URL to registration page.
+		 * @param options Supports same options as Keycloak#createLoginUrl but
+		 *                `action` is set to `'register'`.
+		 */
+		createRegisterUrl(options?: KeycloakLoginOptions): string;
+
+		/**
+		 * Returns the URL to the Account Management Console.
+		 */
+		createAccountUrl(): string;
+
+		/**
+		 * Returns true if the token has less than `minValidity` seconds left before
+		 * it expires.
+		 * @param minValidity If not specified, `0` is used.
+		 */
+		isTokenExpired(minValidity?: number): boolean;
+
+		/**
+		 * If the token expires within `minValidity` seconds, the token is refreshed.
+		 * If the session status iframe is enabled, the session status is also
+		 * checked.
+		 * @returns A promise to set functions that can be invoked if the token is
+		 *          still valid, or if the token is no longer valid.
+		 * @example
+		 * ```js
+		 * keycloak.updateToken(5).success(function(refreshed) {
+		 *   if (refreshed) {
+		 *     alert('Token was successfully refreshed');
+		 *   } else {
+		 *     alert('Token is still valid');
+		 *   }
+		 * }).error(function() {
+		 *   alert('Failed to refresh the token, or the session has expired');
+		 * });
+		 */
+		updateToken(minValidity: number): KeycloakPromise<boolean, boolean>;
+
+		/**
+		 * Clears authentication state, including tokens. This can be useful if
+		 * the application has detected the session was expired, for example if
+		 * updating token fails. Invoking this results in Keycloak#onAuthLogout
+		 * callback listener being invoked.
+		 */
+		clearToken(): void;
+
+		/**
+		 * Returns true if the token has the given realm role.
+		 * @param role A realm role name.
+		 */
+		hasRealmRole(role: string): boolean;
+
+		/**
+		 * Returns true if the token has the given role for the resource.
+		 * @param role A role name.
+		 * @param resource If not specified, `clientId` is used.
+		 */
+		hasResourceRole(role: string, resource?: string): boolean;
+
+		/**
+		 * Loads the user's profile.
+		 * @returns A promise to set functions to be invoked on success or error.
+		 */
+		loadUserProfile(): KeycloakPromise<KeycloakProfile, void>;
+
+		/**
+		 * @private Undocumented.
+		 */
+		loadUserInfo(): KeycloakPromise<{}, void>;
+	}
+}

adapters/oidc/js/src/main/resources/keycloak.js

@@ -51,8 +51,6 @@
                 adapter = loadAdapter('cordova');
             } else if (initOptions && initOptions.adapter === 'default') {
                 adapter = loadAdapter();
-            } else if (initOptions && typeof initOptions.adapter === "object") {
-                adapter = initOptions.adapter;
             } else {
                 if (window.Cordova || window.cordova) {
                     adapter = loadAdapter('cordova');
@@ -282,10 +280,6 @@
             if (options && options.locale) {
                 url += '&ui_locales=' + encodeURIComponent(options.locale);
             }
-            
-            if (options && options.kcLocale) {
-                url += '&kc_locale=' + encodeURIComponent(options.kcLocale);
-            }
 
             return url;
         }
@@ -470,10 +464,6 @@
                                 } else {
                                     console.warn('[KEYCLOAK] Failed to refresh token');
 
-                                    if (req.status == 400) {
-                                        kc.clearToken();
-                                    }
-
                                     kc.onAuthRefreshError && kc.onAuthRefreshError();
                                     for (var p = refreshQueue.pop(); p != null; p = refreshQueue.pop()) {
                                         p.setError(true);

adapters/oidc/kcinit/src/main/bin/kcinit

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-case "`uname`" in
-    CYGWIN*)
-        CFILE = `cygpath "$0"`
-        RESOLVED_NAME=`readlink -f "$CFILE"`
-        ;;
-    Darwin*)
-        RESOLVED_NAME=`readlink "$0"`
-        ;;
-    FreeBSD)
-        RESOLVED_NAME=`readlink -f "$0"`
-        ;;
-    Linux)
-        RESOLVED_NAME=`readlink -f "$0"`
-        ;;
-esac
-
-if [ "x$RESOLVED_NAME" = "x" ]; then
-    RESOLVED_NAME="$0"
-fi
-
-SCRIPTPATH=`dirname "$RESOLVED_NAME"`
-JAR=$SCRIPTPATH/kcinit-${project.version}.jar
-
-java -jar $JAR $@

adapters/oidc/kcinit/src/main/bin/kcinit.bat

@@ -1,8 +0,0 @@
-@echo off
-
-if "%OS%" == "Windows_NT" (
-  set "DIRNAME=%~dp0%"
-) else (
-  set DIRNAME=.\
-)
-java -jar %DIRNAME%\kcinit-${project.version}.jar %*

adapters/oidc/osgi-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>
@@ -34,7 +34,7 @@
         <module>adapter-core</module>
         <module>as7-eap6</module>
         <module>installed</module>
-        <module>kcinit</module>
+        <module>cli-sso</module>
         <module>jaxrs-oauth-client</module>
         <module>jetty</module>
         <module>js</module>
@@ -42,8 +42,6 @@
         <module>servlet-filter</module>
         <module>servlet-oauth-client</module>
         <module>spring-boot</module>
-        <module>spring-boot2</module>
-        <module>spring-boot-adapter-core</module>
         <module>spring-boot-container-bundle</module>
         <module>spring-security</module>
         <module>tomcat</module>

adapters/oidc/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/src/main/java/org/keycloak/servlet/ServletOAuthClient.java

@@ -36,8 +36,6 @@ import javax.security.cert.X509Certificate;
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-
-import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
@@ -267,8 +265,6 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
         public Request getRequest() {
             return new Request() {
 
-                private InputStream inputStream;
-
                 @Override
                 public String getFirstParam(String param) {
                     return servletRequest.getParameter(param);
@@ -318,27 +314,10 @@ public class ServletOAuthClient extends KeycloakDeploymentDelegateOAuthClient {
 
                 @Override
                 public InputStream getInputStream() {
-                    return getInputStream(false);
-                }
-
-                @Override
-                public InputStream getInputStream(boolean buffered) {
-                    if (inputStream != null) {
-                        return inputStream;
-                    }
-
-                    if (buffered) {
-                        try {
-                            return inputStream = new BufferedInputStream(servletRequest.getInputStream());
-                        } catch (IOException e) {
-                            throw new RuntimeException(e);
-                        }
-                    }
-
                     try {
                         return servletRequest.getInputStream();
-                    } catch (IOException e) {
-                        throw new RuntimeException(e);
+                    } catch (IOException ioe) {
+                        throw new RuntimeException(ioe);
                     }
                 }
 

adapters/oidc/spring-boot-adapter-core/pom.xml

@@ -1,116 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-  <parent>
-    <artifactId>keycloak-parent</artifactId>
-    <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
-    <relativePath>../../../pom.xml</relativePath>
-  </parent>
-  <modelVersion>4.0.0</modelVersion>
-
-  <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-  <name>Keycloak Spring Boot Adapter Core</name>
-  <description/>
-
-  <properties>
-    <spring-boot.version>1.3.0.RELEASE</spring-boot.version>
-  </properties>
-
-  <dependencies>
-    <dependency>
-      <groupId>org.jboss.logging</groupId>
-      <artifactId>jboss-logging</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-core</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>spring-boot-container-bundle</artifactId>
-      <version>${project.version}</version>
-      <optional>true</optional>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-security-adapter</artifactId>
-      <version>${project.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>${spring-boot.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>io.undertow</groupId>
-      <artifactId>undertow-servlet</artifactId>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-security</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-webapp</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <scope>test</scope>
-    </dependency>
-     <dependency>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-configuration-processor</artifactId>
-        <optional>true</optional>
-        <version>${spring-boot.version}</version>
-     </dependency>
-  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
-      </plugin>
-    </plugins>
-  </build>
-</project>

adapters/oidc/spring-boot-adapter-core/src/main/java/org/keycloak/adapters/springboot/KeycloakBaseSpringBootConfiguration.java

@@ -1,262 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot;
-
-import io.undertow.servlet.api.DeploymentInfo;
-import io.undertow.servlet.api.WebResourceCollection;
-import org.apache.catalina.Context;
-import org.apache.tomcat.util.descriptor.web.LoginConfig;
-import org.apache.tomcat.util.descriptor.web.SecurityCollection;
-import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
-import org.eclipse.jetty.security.ConstraintMapping;
-import org.eclipse.jetty.security.ConstraintSecurityHandler;
-import org.eclipse.jetty.server.Server;
-import org.eclipse.jetty.util.security.Constraint;
-import org.eclipse.jetty.webapp.WebAppContext;
-import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
-import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
-import org.keycloak.adapters.undertow.KeycloakServletExtension;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer;
-import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer;
-import org.springframework.boot.context.embedded.jetty.JettyEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.jetty.JettyServerCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.undertow.UndertowDeploymentInfoCustomizer;
-import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-/**
- * Keycloak authentication base integration for Spring Boot - base to be extended for particular boot versions.
- */
-public class KeycloakBaseSpringBootConfiguration {
-
-    protected KeycloakSpringBootProperties keycloakProperties;
-
-    @Autowired
-    public void setKeycloakSpringBootProperties(KeycloakSpringBootProperties keycloakProperties) {
-        this.keycloakProperties = keycloakProperties;
-        KeycloakSpringBootConfigResolver.setAdapterConfig(keycloakProperties);
-    }
-
-
-    static class KeycloakBaseUndertowDeploymentInfoCustomizer  {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(DeploymentInfo deploymentInfo) {
-
-            io.undertow.servlet.api.LoginConfig loginConfig = new io.undertow.servlet.api.LoginConfig(keycloakProperties.getRealm());
-            loginConfig.addFirstAuthMethod("KEYCLOAK");
-
-            deploymentInfo.setLoginConfig(loginConfig);
-
-            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
-            deploymentInfo.addSecurityConstraints(getSecurityConstraints());
-
-            deploymentInfo.addServletExtension(new KeycloakServletExtension());
-        }
-
-        private List<io.undertow.servlet.api.SecurityConstraint> getSecurityConstraints() {
-
-            List<io.undertow.servlet.api.SecurityConstraint> undertowSecurityConstraints = new ArrayList<io.undertow.servlet.api.SecurityConstraint>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
-
-                io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
-                undertowSecurityConstraint.addRolesAllowed(constraintDefinition.getAuthRoles());
-
-                for (KeycloakSpringBootProperties.SecurityCollection collectionDefinition : constraintDefinition.getSecurityCollections()) {
-
-                    WebResourceCollection webResourceCollection = new WebResourceCollection();
-                    webResourceCollection.addHttpMethods(collectionDefinition.getMethods());
-                    webResourceCollection.addHttpMethodOmissions(collectionDefinition.getOmittedMethods());
-                    webResourceCollection.addUrlPatterns(collectionDefinition.getPatterns());
-
-                    undertowSecurityConstraint.addWebResourceCollections(webResourceCollection);
-
-                }
-
-                undertowSecurityConstraints.add(undertowSecurityConstraint);
-            }
-            return undertowSecurityConstraints;
-        }
-    }
-
-    static class KeycloakBaseJettyServerCustomizer {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(Server server) {
-
-            KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
-            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
-
-            /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
-               on how to map servlet spec to Constraints */
-
-            List<ConstraintMapping> jettyConstraintMappings = new ArrayList<ConstraintMapping>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
-
-                for (KeycloakSpringBootProperties.SecurityCollection securityCollectionDefinition : constraintDefinition
-                        .getSecurityCollections()) {
-                    // securityCollection matches servlet spec's web-resource-collection
-                    Constraint jettyConstraint = new Constraint();
-
-                    if (constraintDefinition.getAuthRoles().size() > 0) {
-                        jettyConstraint.setAuthenticate(true);
-                        jettyConstraint.setRoles(constraintDefinition.getAuthRoles().toArray(new String[0]));
-                    }
-
-                    jettyConstraint.setName(securityCollectionDefinition.getName());
-
-                    // according to the servlet spec each security-constraint has at least one URL pattern
-                    for(String pattern : securityCollectionDefinition.getPatterns()) {
-
-                        /* the following code is asymmetric as Jetty's ConstraintMapping accepts only one allowed HTTP method,
-                           but multiple omitted methods. Therefore we add one ConstraintMapping for each allowed
-                           mapping but only one mapping in the cases of omitted methods or no methods.
-                         */
-
-                        if (securityCollectionDefinition.getMethods().size() > 0) {
-                            // according to the servlet spec we have either methods ...
-                            for(String method : securityCollectionDefinition.getMethods()) {
-                                ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                                jettyConstraintMappings.add(jettyConstraintMapping);
-
-                                jettyConstraintMapping.setConstraint(jettyConstraint);
-                                jettyConstraintMapping.setPathSpec(pattern);
-                                jettyConstraintMapping.setMethod(method);
-                            }
-                        } else if (securityCollectionDefinition.getOmittedMethods().size() > 0){
-                            // ... omitted methods ...
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                            jettyConstraintMapping.setMethodOmissions(
-                                    securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
-                        } else {
-                            // ... or no methods at all
-                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
-                            jettyConstraintMappings.add(jettyConstraintMapping);
-
-                            jettyConstraintMapping.setConstraint(jettyConstraint);
-                            jettyConstraintMapping.setPathSpec(pattern);
-                        }
-
-                    }
-
-                }
-            }
-
-            WebAppContext webAppContext = server.getBean(WebAppContext.class);
-            //if not found as registered bean let's try the handler
-            if(webAppContext==null){
-                webAppContext = (WebAppContext) server.getHandler();
-            }
-
-            ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
-            securityHandler.setConstraintMappings(jettyConstraintMappings);
-            securityHandler.setAuthenticator(keycloakJettyAuthenticator);
-
-            webAppContext.setSecurityHandler(securityHandler);
-        }
-    }
-
-    static class KeycloakBaseTomcatContextCustomizer {
-
-        protected final KeycloakSpringBootProperties keycloakProperties;
-
-        public KeycloakBaseTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            this.keycloakProperties = keycloakProperties;
-        }
-
-        public void customize(Context context) {
-            LoginConfig loginConfig = new LoginConfig();
-            loginConfig.setAuthMethod("KEYCLOAK");
-            context.setLoginConfig(loginConfig);
-
-            Set<String> authRoles = new HashSet<String>();
-            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
-                for (String authRole : constraint.getAuthRoles()) {
-                    if (!authRoles.contains(authRole)) {
-                        context.addSecurityRole(authRole);
-                        authRoles.add(authRole);
-                    }
-                }
-            }
-
-            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
-                SecurityConstraint tomcatConstraint = new SecurityConstraint();
-
-                for (String authRole : constraint.getAuthRoles()) {
-                    tomcatConstraint.addAuthRole(authRole);
-                }
-
-                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
-                    SecurityCollection tomcatSecCollection = new SecurityCollection();
-
-                    if (collection.getName() != null) {
-                        tomcatSecCollection.setName(collection.getName());
-                    }
-                    if (collection.getDescription() != null) {
-                        tomcatSecCollection.setDescription(collection.getDescription());
-                    }
-
-                    for (String pattern : collection.getPatterns()) {
-                        tomcatSecCollection.addPattern(pattern);
-                    }
-
-                    for (String method : collection.getMethods()) {
-                        tomcatSecCollection.addMethod(method);
-                    }
-
-                    for (String method : collection.getOmittedMethods()) {
-                        tomcatSecCollection.addOmittedMethod(method);
-                    }
-
-                    tomcatConstraint.addCollection(tomcatSecCollection);
-                }
-
-                context.addConstraint(tomcatConstraint);
-            }
-
-            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
-        }
-    }
-}

adapters/oidc/spring-boot-adapter-core/src/main/resources/META-INF/spring.factories

@@ -1,2 +0,0 @@
-org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.keycloak.adapters.springboot.KeycloakAutoConfiguration

adapters/oidc/spring-boot-container-bundle/pom.xml

@@ -4,7 +4,7 @@
     <parent>
       <artifactId>keycloak-parent</artifactId>
       <groupId>org.keycloak</groupId>
-      <version>4.0.0.Beta2</version>
+      <version>4.0.0.Beta1</version>
       <relativePath>../../../pom.xml</relativePath>
     </parent>
     <artifactId>spring-boot-container-bundle</artifactId>

adapters/oidc/spring-boot/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
+    <version>4.0.0.Beta1</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>
@@ -37,12 +37,6 @@
   </properties>
 
   <dependencies>
-
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-    </dependency>
-
     <dependency>
       <groupId>org.jboss.logging</groupId>
       <artifactId>jboss-logging</artifactId>

adapters/oidc/spring-boot/src/main/java/org/keycloak/adapters/springboot/KeycloakAutoConfiguration.java

@@ -17,7 +17,20 @@
 
 package org.keycloak.adapters.springboot;
 
+import io.undertow.servlet.api.DeploymentInfo;
+import io.undertow.servlet.api.WebResourceCollection;
+import org.apache.catalina.Context;
+import org.apache.tomcat.util.descriptor.web.LoginConfig;
+import org.apache.tomcat.util.descriptor.web.SecurityCollection;
+import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
+import org.eclipse.jetty.security.ConstraintMapping;
+import org.eclipse.jetty.security.ConstraintSecurityHandler;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.util.security.Constraint;
+import org.eclipse.jetty.webapp.WebAppContext;
+import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
 import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
+import org.keycloak.adapters.undertow.KeycloakServletExtension;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
@@ -34,6 +47,10 @@ import org.springframework.boot.context.properties.EnableConfigurationProperties
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 
 /**
  * Keycloak authentication integration for Spring Boot
@@ -45,7 +62,7 @@ import org.springframework.context.annotation.Configuration;
 @ConditionalOnWebApplication
 @EnableConfigurationProperties(KeycloakSpringBootProperties.class)
 @ConditionalOnProperty(value = "keycloak.enabled", matchIfMissing = true)
-public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfiguration  {
+public class KeycloakAutoConfiguration {
 
     private KeycloakSpringBootProperties keycloakProperties;
 
@@ -100,27 +117,202 @@ public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfigurati
         return new KeycloakUndertowDeploymentInfoCustomizer(keycloakProperties);
     }
 
-    static class KeycloakUndertowDeploymentInfoCustomizer extends KeycloakBaseUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
+    static class KeycloakUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(DeploymentInfo deploymentInfo) {
+
+            io.undertow.servlet.api.LoginConfig loginConfig = new io.undertow.servlet.api.LoginConfig(keycloakProperties.getRealm());
+            loginConfig.addFirstAuthMethod("KEYCLOAK");
+
+            deploymentInfo.setLoginConfig(loginConfig);
+            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
+            deploymentInfo.addSecurityConstraints(getSecurityConstraints());
+            deploymentInfo.addServletExtension(new KeycloakServletExtension());
+        }
+
+        private List<io.undertow.servlet.api.SecurityConstraint> getSecurityConstraints() {
+
+            List<io.undertow.servlet.api.SecurityConstraint> undertowSecurityConstraints = new ArrayList<io.undertow.servlet.api.SecurityConstraint>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
+
+                io.undertow.servlet.api.SecurityConstraint undertowSecurityConstraint = new io.undertow.servlet.api.SecurityConstraint();
+                undertowSecurityConstraint.addRolesAllowed(constraintDefinition.getAuthRoles());
+
+                for (KeycloakSpringBootProperties.SecurityCollection collectionDefinition : constraintDefinition.getSecurityCollections()) {
+
+                    WebResourceCollection webResourceCollection = new WebResourceCollection();
+                    webResourceCollection.addHttpMethods(collectionDefinition.getMethods());
+                    webResourceCollection.addHttpMethodOmissions(collectionDefinition.getOmittedMethods());
+                    webResourceCollection.addUrlPatterns(collectionDefinition.getPatterns());
+
+                    undertowSecurityConstraint.addWebResourceCollections(webResourceCollection);
+
+                }
+                undertowSecurityConstraints.add(undertowSecurityConstraint);
+            }
+            return undertowSecurityConstraints;
+        }
     }
 
-    static class KeycloakJettyServerCustomizer extends KeycloakBaseJettyServerCustomizer implements JettyServerCustomizer {
+    static class KeycloakJettyServerCustomizer implements JettyServerCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(Server server) {
+
+            KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
+            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
+
+            /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
+               on how to map servlet spec to Constraints */
+
+            List<ConstraintMapping> jettyConstraintMappings = new ArrayList<ConstraintMapping>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraintDefinition : keycloakProperties.getSecurityConstraints()) {
+
+                for (KeycloakSpringBootProperties.SecurityCollection securityCollectionDefinition : constraintDefinition
+                        .getSecurityCollections()) {
+                    // securityCollection matches servlet spec's web-resource-collection
+                    Constraint jettyConstraint = new Constraint();
+
+                    if (constraintDefinition.getAuthRoles().size() > 0) {
+                        jettyConstraint.setAuthenticate(true);
+                        jettyConstraint.setRoles(constraintDefinition.getAuthRoles().toArray(new String[0]));
+                    }
+
+                    jettyConstraint.setName(securityCollectionDefinition.getName());
+
+                    // according to the servlet spec each security-constraint has at least one URL pattern
+                    for(String pattern : securityCollectionDefinition.getPatterns()) {
+
+                        /* the following code is asymmetric as Jetty's ConstraintMapping accepts only one allowed HTTP method,
+                           but multiple omitted methods. Therefore we add one ConstraintMapping for each allowed
+                           mapping but only one mapping in the cases of omitted methods or no methods.
+                         */
+
+                        if (securityCollectionDefinition.getMethods().size() > 0) {
+                            // according to the servlet spec we have either methods ...
+                            for(String method : securityCollectionDefinition.getMethods()) {
+                                ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                                jettyConstraintMappings.add(jettyConstraintMapping);
+
+                                jettyConstraintMapping.setConstraint(jettyConstraint);
+                                jettyConstraintMapping.setPathSpec(pattern);
+                                jettyConstraintMapping.setMethod(method);
+                            }
+                        } else if (securityCollectionDefinition.getOmittedMethods().size() > 0){
+                            // ... omitted methods ...
+                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                            jettyConstraintMappings.add(jettyConstraintMapping);
+
+                            jettyConstraintMapping.setConstraint(jettyConstraint);
+                            jettyConstraintMapping.setPathSpec(pattern);
+                            jettyConstraintMapping.setMethodOmissions(
+                                    securityCollectionDefinition.getOmittedMethods().toArray(new String[0]));
+                        } else {
+                            // ... or no methods at all
+                            ConstraintMapping jettyConstraintMapping = new ConstraintMapping();
+                            jettyConstraintMappings.add(jettyConstraintMapping);
+
+                            jettyConstraintMapping.setConstraint(jettyConstraint);
+                            jettyConstraintMapping.setPathSpec(pattern);
+                        }
+
+                    }
+
+                }
+            }
+
+            WebAppContext webAppContext = server.getBean(WebAppContext.class);
+            //if not found as registered bean let's try the handler
+            if(webAppContext==null){
+                webAppContext = (WebAppContext) server.getHandler();
+            }
+
+            ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
+            securityHandler.setConstraintMappings(jettyConstraintMappings);
+            securityHandler.setAuthenticator(keycloakJettyAuthenticator);
+
+            webAppContext.setSecurityHandler(securityHandler);
+        }
     }
 
-    static class KeycloakTomcatContextCustomizer extends KeycloakBaseTomcatContextCustomizer implements TomcatContextCustomizer {
+    static class KeycloakTomcatContextCustomizer implements TomcatContextCustomizer {
+
+        private final KeycloakSpringBootProperties keycloakProperties;
 
         public KeycloakTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
+            this.keycloakProperties = keycloakProperties;
         }
 
+        @Override
+        public void customize(Context context) {
+            LoginConfig loginConfig = new LoginConfig();
+            loginConfig.setAuthMethod("KEYCLOAK");
+            context.setLoginConfig(loginConfig);
+
+            Set<String> authRoles = new HashSet<String>();
+            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
+                for (String authRole : constraint.getAuthRoles()) {
+                    if (!authRoles.contains(authRole)) {
+                        context.addSecurityRole(authRole);
+                        authRoles.add(authRole);
+                    }
+                }
+            }
+
+            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
+                SecurityConstraint tomcatConstraint = new SecurityConstraint();
+
+                for (String authRole : constraint.getAuthRoles()) {
+                    tomcatConstraint.addAuthRole(authRole);
+                    if(authRole.equals("*") || authRole.equals("**")) {
+                        // For some reasons embed tomcat don't set the auth constraint on true when wildcard is
+                        // used
+                        tomcatConstraint.setAuthConstraint(true);
+                    }
+                }
+
+                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
+                    SecurityCollection tomcatSecCollection = new SecurityCollection();
+
+                    if (collection.getName() != null) {
+                        tomcatSecCollection.setName(collection.getName());
+                    }
+                    if (collection.getDescription() != null) {
+                        tomcatSecCollection.setDescription(collection.getDescription());
+                    }
+
+                    for (String pattern : collection.getPatterns()) {
+                        tomcatSecCollection.addPattern(pattern);
+                    }
+
+                    for (String method : collection.getMethods()) {
+                        tomcatSecCollection.addMethod(method);
+                    }
+
+                    for (String method : collection.getOmittedMethods()) {
+                        tomcatSecCollection.addOmittedMethod(method);
+                    }
+
+                    tomcatConstraint.addCollection(tomcatSecCollection);
+                }
+
+                context.addConstraint(tomcatConstraint);
+            }
+
+            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
+        }
     }
 }

adapters/oidc/spring-boot2/pom.xml

@@ -1,151 +0,0 @@
-<?xml version="1.0"?>
-<!--
-  ~ Copyright 2016 Red Hat, Inc. and/or its affiliates
-  ~ and other contributors as indicated by the @author tags.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~ http://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-  <parent>
-    <artifactId>keycloak-parent</artifactId>
-    <groupId>org.keycloak</groupId>
-    <version>4.0.0.Beta2</version>
-    <relativePath>../../../pom.xml</relativePath>
-  </parent>
-  <modelVersion>4.0.0</modelVersion>
-
-  <artifactId>keycloak-spring-boot-2-adapter</artifactId>
-  <name>Keycloak Spring Boot 2 Integration</name>
-  <description/>
-
-  <properties>
-    <spring-boot.version>2.0.0.RELEASE</spring-boot.version>
-    <spring.version>5.0.2.RELEASE</spring.version>
-    <mockito.version>1.9.5</mockito.version>
-  </properties>
-
-  <dependencies>
-
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-boot-adapter-core</artifactId>
-    </dependency>
-
-    <dependency>
-      <groupId>org.jboss.logging</groupId>
-      <artifactId>jboss-logging</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-core</artifactId>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>spring-boot-container-bundle</artifactId>
-      <version>${project.version}</version>
-      <optional>true</optional>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.keycloak</groupId>
-      <artifactId>keycloak-spring-security-adapter</artifactId>
-      <version>${project.version}</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-      <version>2.9.4</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-annotations</artifactId>
-      <version>2.9.4</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>5.0.2.RELEASE</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>${spring-boot.version}</version>
-    </dependency>
-    <dependency>
-      <groupId>io.undertow</groupId>
-      <artifactId>undertow-servlet</artifactId>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-server</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-security</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-
-    <dependency>
-      <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-webapp</artifactId>
-      <version>${jetty9.version}</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-test</artifactId>
-      <version>${spring.version}</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-all</artifactId>
-      <version>${mockito.version}</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-configuration-processor</artifactId>
-      <optional>true</optional>
-      <version>${spring-boot.version}</version>
-    </dependency>
-  </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-compiler-plugin</artifactId>
-      </plugin>
-    </plugins>
-  </build>
-</project>

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/KeycloakAutoConfiguration.java

@@ -1,116 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot;
-
-import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.boot.web.server.WebServerFactoryCustomizer;
-import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
-import org.springframework.boot.web.embedded.tomcat.TomcatContextCustomizer;
-import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
-import org.springframework.boot.web.embedded.jetty.JettyServerCustomizer;
-import org.springframework.boot.web.embedded.jetty.JettyServletWebServerFactory;
-import org.springframework.boot.web.embedded.undertow.UndertowDeploymentInfoCustomizer;
-import org.springframework.boot.web.embedded.undertow.UndertowServletWebServerFactory;
-
-
-
-
-/**
- * Keycloak authentication integration for Spring Boot 2
- *
- */
-@Configuration
-@ConditionalOnWebApplication
-@EnableConfigurationProperties(KeycloakSpringBootProperties.class)
-@ConditionalOnProperty(value = "keycloak.enabled", matchIfMissing = true)
-public class KeycloakAutoConfiguration extends KeycloakBaseSpringBootConfiguration {
-
-
-    @Bean
-    public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> getKeycloakContainerCustomizer() {
-        return new WebServerFactoryCustomizer<ConfigurableServletWebServerFactory>() {
-            @Override
-            public void customize(ConfigurableServletWebServerFactory configurableServletWebServerFactory) {
-                if(configurableServletWebServerFactory instanceof TomcatServletWebServerFactory){
-
-                    TomcatServletWebServerFactory container = (TomcatServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addContextValves(new KeycloakAuthenticatorValve());
-                    container.addContextCustomizers(tomcatKeycloakContextCustomizer());
-
-                } else if (configurableServletWebServerFactory instanceof UndertowServletWebServerFactory){
-
-                    UndertowServletWebServerFactory container = (UndertowServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addDeploymentInfoCustomizers(undertowKeycloakContextCustomizer());
-
-                } else if (configurableServletWebServerFactory instanceof JettyServletWebServerFactory){
-
-                    JettyServletWebServerFactory container = (JettyServletWebServerFactory)configurableServletWebServerFactory;
-                    container.addServerCustomizers(jettyKeycloakServerCustomizer());
-                }
-            }
-
-        };
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"org.eclipse.jetty.webapp.WebAppContext"})
-    public JettyServerCustomizer jettyKeycloakServerCustomizer() {
-        return new KeycloakJettyServerCustomizer(keycloakProperties);
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"org.apache.catalina.startup.Tomcat"})
-    public TomcatContextCustomizer tomcatKeycloakContextCustomizer() {
-        return new KeycloakTomcatContextCustomizer(keycloakProperties);
-    }
-
-    @Bean
-    @ConditionalOnClass(name = {"io.undertow.Undertow"})
-    public UndertowDeploymentInfoCustomizer undertowKeycloakContextCustomizer() {
-        return new KeycloakUndertowDeploymentInfoCustomizer(keycloakProperties);
-    }
-
-    static class KeycloakJettyServerCustomizer extends KeycloakBaseJettyServerCustomizer implements JettyServerCustomizer {
-
-
-        public KeycloakJettyServerCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
-        }
-
-    }
-
-    static class KeycloakTomcatContextCustomizer extends KeycloakBaseTomcatContextCustomizer implements TomcatContextCustomizer {
-
-        public KeycloakTomcatContextCustomizer(KeycloakSpringBootProperties keycloakProperties) {
-            super(keycloakProperties);
-        }
-    }
-
-    static class KeycloakUndertowDeploymentInfoCustomizer extends KeycloakBaseUndertowDeploymentInfoCustomizer implements UndertowDeploymentInfoCustomizer {
-
-        public KeycloakUndertowDeploymentInfoCustomizer(KeycloakSpringBootProperties keycloakProperties){
-            super(keycloakProperties);
-        }
-    }
-}

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/client/KeycloakRestTemplateCustomizer.java

@@ -1,24 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.springframework.boot.web.client.RestTemplateCustomizer;
-import org.springframework.web.client.RestTemplate;
-
-public class KeycloakRestTemplateCustomizer implements RestTemplateCustomizer {
-
-    private final KeycloakSecurityContextClientRequestInterceptor keycloakInterceptor;
-
-    public KeycloakRestTemplateCustomizer() {
-        this(new KeycloakSecurityContextClientRequestInterceptor());
-    }
-
-    protected KeycloakRestTemplateCustomizer(
-            KeycloakSecurityContextClientRequestInterceptor keycloakInterceptor
-    ) {
-        this.keycloakInterceptor = keycloakInterceptor;
-    }
-
-    @Override
-    public void customize(RestTemplate restTemplate) {
-        restTemplate.getInterceptors().add(keycloakInterceptor);
-    }
-}

adapters/oidc/spring-boot2/src/main/java/org/keycloak/adapters/springboot/client/KeycloakSecurityContextClientRequestInterceptor.java

@@ -1,55 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.springframework.http.HttpRequest;
-import org.springframework.http.client.ClientHttpRequestExecution;
-import org.springframework.http.client.ClientHttpRequestInterceptor;
-import org.springframework.http.client.ClientHttpResponse;
-import org.springframework.web.context.request.RequestContextHolder;
-import org.springframework.web.context.request.ServletRequestAttributes;
-
-import java.io.IOException;
-import java.security.Principal;
-
-/**
- * Interceptor for {@link ClientHttpRequestExecution} objects created for server to server secured
- * communication using OAuth2 bearer tokens issued by Keycloak.
- *
- * @author <a href="mailto:jmcshan1@gmail.com">James McShane</a>
- * @version $Revision: 1 $
- */
-public class KeycloakSecurityContextClientRequestInterceptor implements ClientHttpRequestInterceptor {
-
-    private static final String AUTHORIZATION_HEADER = "Authorization";
-
-    /**
-     * Returns the {@link KeycloakSecurityContext} from the Spring {@link ServletRequestAttributes}'s {@link Principal}.
-     *
-     * The principal must support retrieval of the KeycloakSecurityContext, so at this point, only {@link KeycloakPrincipal}
-     * values are supported
-     *
-     * @return the current <code>KeycloakSecurityContext</code>
-     */
-    protected KeycloakSecurityContext getKeycloakSecurityContext() {
-        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
-        Principal principal = attributes.getRequest().getUserPrincipal();
-        if (principal == null) {
-            throw new IllegalStateException("Cannot set authorization header because there is no authenticated principal");
-        }
-        if (!(principal instanceof KeycloakPrincipal)) {
-            throw new IllegalStateException(
-                    String.format(
-                            "Cannot set authorization header because the principal type %s does not provide the KeycloakSecurityContext",
-                            principal.getClass()));
-        }
-        return ((KeycloakPrincipal) principal).getKeycloakSecurityContext();
-    }
-
-    @Override
-    public ClientHttpResponse intercept(HttpRequest httpRequest, byte[] bytes, ClientHttpRequestExecution clientHttpRequestExecution) throws IOException {
-        KeycloakSecurityContext context = this.getKeycloakSecurityContext();
-        httpRequest.getHeaders().set(AUTHORIZATION_HEADER, "Bearer " + context.getTokenString());
-        return clientHttpRequestExecution.execute(httpRequest, bytes);
-    }
-}

adapters/oidc/spring-boot2/src/main/resources/META-INF/spring.factories

@@ -1,2 +0,0 @@
-org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.keycloak.adapters.springboot.KeycloakAutoConfiguration

adapters/oidc/spring-boot2/src/test/java/org/keycloak/adapters/springboot/client/KeycloakRestTemplateCustomizerTest.java

@@ -1,28 +0,0 @@
-package org.keycloak.adapters.springboot.client;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.web.client.RestTemplate;
-
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Mockito.mock;
-
-public class KeycloakRestTemplateCustomizerTest {
-
-    private KeycloakRestTemplateCustomizer customizer;
-    private KeycloakSecurityContextClientRequestInterceptor interceptor =
-            mock(KeycloakSecurityContextClientRequestInterceptor.class);
-
-    @Before
-    public void setup() {
-        customizer = new KeycloakRestTemplateCustomizer(interceptor);
-    }
-
-    @Test
-    public void interceptorIsAddedToRequest() {
-        RestTemplate restTemplate = new RestTemplate();
-        customizer.customize(restTemplate);
-        assertTrue(restTemplate.getInterceptors().contains(interceptor));
-    }
-
-}

adapters/oidc/spring-boot2/src/test/java/org/keycloak/adapters/springboot/client/KeycloakSecurityContextClientRequestInterceptorTest.java

@@ -1,87 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.springboot.client;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.KeycloakPrincipal;
-import org.keycloak.KeycloakSecurityContext;
-import org.mockito.Mock;
-import org.mockito.MockitoAnnotations;
-import org.mockito.Spy;
-import org.springframework.mock.web.MockHttpServletRequest;
-import org.springframework.web.context.request.RequestContextHolder;
-import org.springframework.web.context.request.ServletRequestAttributes;
-
-import java.security.Principal;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.mockito.Mockito.when;
-
-/**
- * Keycloak spring boot client request factory tests.
- */
-public class KeycloakSecurityContextClientRequestInterceptorTest {
-
-    @Spy
-    private KeycloakSecurityContextClientRequestInterceptor factory;
-
-    private MockHttpServletRequest servletRequest;
-
-    @Mock
-    private KeycloakSecurityContext keycloakSecurityContext;
-
-    @Mock
-    private KeycloakPrincipal keycloakPrincipal;
-
-    @Before
-    public void setUp() {
-        MockitoAnnotations.initMocks(this);
-        servletRequest = new MockHttpServletRequest();
-        RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(servletRequest));
-        servletRequest.setUserPrincipal(keycloakPrincipal);
-        when(keycloakPrincipal.getKeycloakSecurityContext()).thenReturn(keycloakSecurityContext);
-    }
-
-    @Test
-    public void testGetKeycloakSecurityContext() throws Exception {
-        KeycloakSecurityContext context = factory.getKeycloakSecurityContext();
-        assertNotNull(context);
-        assertEquals(keycloakSecurityContext, context);
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testGetKeycloakSecurityContextInvalidPrincipal() throws Exception {
-        servletRequest.setUserPrincipal(new MarkerPrincipal());
-        factory.getKeycloakSecurityContext();
-    }
-
-    @Test(expected = IllegalStateException.class)
-    public void testGetKeycloakSecurityContextNullAuthentication() throws Exception {
-        servletRequest.setUserPrincipal(null);
-        factory.getKeycloakSecurityContext();
-    }
-
-    private static class MarkerPrincipal implements Principal {
-        @Override
-        public String getName() {
-            return null;
-        }
-    }
-}

adapters/oidc/spring-security/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/facade/WrappedHttpServletRequest.java

@@ -24,8 +24,6 @@ import org.keycloak.adapters.spi.LogoutError;
 import org.springframework.util.Assert;
 
 import javax.servlet.http.HttpServletRequest;
-
-import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
@@ -42,7 +40,6 @@ import java.util.List;
 class WrappedHttpServletRequest implements Request {
 
     private final HttpServletRequest request;
-    private InputStream inputStream;
 
     /**
      * Creates a new request for the given <code>HttpServletRequest</code>
@@ -125,27 +122,10 @@ class WrappedHttpServletRequest implements Request {
 
     @Override
     public InputStream getInputStream() {
-        return getInputStream(false);
-    }
-
-    @Override
-    public InputStream getInputStream(boolean buffered) {
-        if (inputStream != null) {
-            return inputStream;
-        }
-
-        if (buffered) {
-            try {
-                return inputStream = new BufferedInputStream(request.getInputStream());
-            } catch (IOException e) {
-                throw new RuntimeException(e);
-            }
-        }
-
         try {
             return request.getInputStream();
         } catch (IOException e) {
-            throw new RuntimeException(e);
+            throw new RuntimeException("Unable to get request input stream", e);
         }
     }
 

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakSecurityContextRequestFilter.java

@@ -16,15 +16,6 @@
  */
 package org.keycloak.adapters.springsecurity.filter;
 
-import java.io.IOException;
-
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
 import org.keycloak.KeycloakPrincipal;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterDeploymentContext;
@@ -38,6 +29,14 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.filter.GenericFilterBean;
 
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
 /**
  * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
  */
@@ -61,14 +60,19 @@ public class KeycloakSecurityContextRequestFilter extends GenericFilterBean impl
 
         if (keycloakSecurityContext instanceof RefreshableKeycloakSecurityContext) {
             RefreshableKeycloakSecurityContext refreshableSecurityContext = (RefreshableKeycloakSecurityContext) keycloakSecurityContext;
-            KeycloakDeployment deployment = resolveDeployment(request, response);
 
-            if (deployment.isAlwaysRefreshToken()) {
-                if (refreshableSecurityContext.refreshExpiredToken(false)) {
-                    request.setAttribute(KeycloakSecurityContext.class.getName(), refreshableSecurityContext);
-                } else {
-                    clearAuthenticationContext();
+            if (refreshableSecurityContext.isActive()) {
+                KeycloakDeployment deployment = resolveDeployment(request, response);
+
+                if (deployment.isAlwaysRefreshToken()) {
+                    if (refreshableSecurityContext.refreshExpiredToken(false)) {
+                        request.setAttribute(KeycloakSecurityContext.class.getName(), refreshableSecurityContext);
+                    } else {
+                        clearAuthenticationContext();
+                    }
                 }
+            } else {
+                clearAuthenticationContext();
             }
         }
 
@@ -76,7 +80,7 @@ public class KeycloakSecurityContextRequestFilter extends GenericFilterBean impl
     }
 
     @Override
-    protected void initFilterBean() {
+    protected void initFilterBean() throws ServletException {
         deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
     }
 

adapters/oidc/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Tomcat Integration</name>

adapters/oidc/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly-elytron/pom.xml

@@ -22,7 +22,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly-elytron/src/main/java/org/keycloak/adapters/elytron/ElytronHttpFacade.java

@@ -40,8 +40,6 @@ import org.wildfly.security.http.Scope;
 
 import javax.security.auth.callback.CallbackHandler;
 import javax.security.cert.X509Certificate;
-
-import java.io.BufferedInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -160,8 +158,6 @@ class ElytronHttpFacade implements OIDCHttpFacade {
     @Override
     public Request getRequest() {
         return new Request() {
-            private InputStream inputStream;
-
             @Override
             public String getMethod() {
                 return request.getRequestMethod();
@@ -188,7 +184,7 @@ class ElytronHttpFacade implements OIDCHttpFacade {
 
             @Override
             public String getFirstParam(String param) {
-                return request.getFirstParameterValue(param);
+                throw new RuntimeException("Not implemented.");
             }
 
             @Override
@@ -234,19 +230,6 @@ class ElytronHttpFacade implements OIDCHttpFacade {
 
             @Override
             public InputStream getInputStream() {
-                return getInputStream(false);
-            }
-
-            @Override
-            public InputStream getInputStream(boolean buffered) {
-                if (inputStream != null) {
-                    return inputStream;
-                }
-
-                if (buffered) {
-                    return inputStream = new BufferedInputStream(request.getInputStream());
-                }
-
                 return request.getInputStream();
             }
 
@@ -284,9 +267,7 @@ class ElytronHttpFacade implements OIDCHttpFacade {
 
             @Override
             public void setStatus(final int status) {
-                if (status < 200 || status > 300) {
-                    responseConsumer = responseConsumer.andThen(response -> response.setStatusCode(status));
-                }
+                responseConsumer = responseConsumer.andThen(response -> response.setStatusCode(status));
             }
 
             @Override

adapters/oidc/wildfly/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak WildFly Integration</name>

adapters/oidc/wildfly/wf8-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/oidc/wildfly/wildfly-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly/wildfly-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Adapters</name>

adapters/saml/as7-eap6/adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML EAP Integration</name>

adapters/saml/as7-eap6/subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/saml/core-public/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.4/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Jetty Integration</name>

adapters/saml/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Client Adapter Modules</name>

adapters/saml/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.0.0.Beta2</version>
+        <version>4.0.0.Beta1</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Tomcat Integration</name>

adapters/saml/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.0.0.Beta2</version>
+		<version>4.0.0.Beta1</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>