Set version to 4.3.0.Final

Fixes to examples-dist for removed Fuse example
KEYCLOAK-8036 Fix misplaced IdP buttons
2018-08-15 18:12:19 +00:00 · 2018-08-15 16:57:23 +02:00 · 2018-08-15 11:32:02 +02:00 · 2018-08-15 11:04:18 +02:00 · 2018-08-14 17:35:37 +02:00 · 2018-08-14 13:56:45 +02:00
787 changed files with 12872 additions and 8784 deletions
@@ -17,6 +17,7 @@ env:
    - TESTS=old
    - TESTS=crossdc-server
    - TESTS=crossdc-adapter
+    - TESTS=ssl

 jdk:
  - oraclejdk8
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -17,6 +17,7 @@
 */
 package org.keycloak.adapters.authorization;

+import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
@@ -151,7 +152,7 @@ public abstract class AbstractPolicyEnforcer {
        }

        boolean hasPermission = false;
-        List<Permission> grantedPermissions = authorization.getPermissions();
+        Collection<Permission> grantedPermissions = authorization.getPermissions();

        for (Permission permission : grantedPermissions) {
            if (permission.getResourceId() != null) {
@@ -18,7 +18,7 @@
 package org.keycloak.adapters.authorization;

 import java.util.ArrayList;
-import java.util.HashMap;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -78,8 +78,8 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
        AccessToken.Authorization newAuthorization = accessToken.getAuthorization();

        if (newAuthorization != null) {
-            List<Permission> grantedPermissions = authorization.getPermissions();
-            List<Permission> newPermissions = newAuthorization.getPermissions();
+            Collection<Permission> grantedPermissions = authorization.getPermissions();
+            Collection<Permission> newPermissions = newAuthorization.getPermissions();

            for (Permission newPermission : newPermissions) {
                if (!grantedPermissions.contains(newPermission)) {
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.2.0.Final</version>
+    <version>4.3.0.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -25,27 +25,16 @@ import org.apache.tomcat.util.descriptor.web.SecurityCollection;
 import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
 import org.eclipse.jetty.security.ConstraintMapping;
 import org.eclipse.jetty.security.ConstraintSecurityHandler;
+import org.eclipse.jetty.server.Handler;
 import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.handler.HandlerCollection;
+import org.eclipse.jetty.server.handler.HandlerList;
+import org.eclipse.jetty.server.handler.HandlerWrapper;
 import org.eclipse.jetty.util.security.Constraint;
 import org.eclipse.jetty.webapp.WebAppContext;
 import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
-import org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve;
 import org.keycloak.adapters.undertow.KeycloakServletExtension;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.context.embedded.ConfigurableEmbeddedServletContainer;
-import org.springframework.boot.context.embedded.EmbeddedServletContainerCustomizer;
-import org.springframework.boot.context.embedded.jetty.JettyEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.jetty.JettyServerCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatContextCustomizer;
-import org.springframework.boot.context.embedded.tomcat.TomcatEmbeddedServletContainerFactory;
-import org.springframework.boot.context.embedded.undertow.UndertowDeploymentInfoCustomizer;
-import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
-import org.springframework.boot.context.properties.EnableConfigurationProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;

 import java.util.ArrayList;
 import java.util.HashSet;
@@ -187,7 +176,7 @@ public class KeycloakBaseSpringBootConfiguration {
            WebAppContext webAppContext = server.getBean(WebAppContext.class);
            //if not found as registered bean let's try the handler
            if(webAppContext==null){
-                webAppContext = (WebAppContext) server.getHandler();
+                webAppContext = getWebAppContext(server.getHandlers());
            }

            ConstraintSecurityHandler securityHandler = new ConstraintSecurityHandler();
@@ -196,6 +185,21 @@ public class KeycloakBaseSpringBootConfiguration {

            webAppContext.setSecurityHandler(securityHandler);
        }
+
+        private WebAppContext getWebAppContext(Handler... handlers) {
+            for (Handler handler : handlers) {
+                if (handler instanceof WebAppContext) {
+                    return (WebAppContext) handler;
+                } else if (handler instanceof HandlerList) {
+                    return getWebAppContext(((HandlerList) handler).getHandlers());
+                } else if (handler instanceof HandlerCollection) {
+                    return getWebAppContext(((HandlerCollection) handler).getHandlers());
+                } else if (handler instanceof HandlerWrapper) {
+                    return getWebAppContext(((HandlerWrapper) handler).getHandlers());
+                }
+            }
+            throw new RuntimeException("No WebAppContext found in Jetty server handlers");
+        }
    }

    static class KeycloakBaseTomcatContextCustomizer {
@@ -4,7 +4,7 @@
    <parent>
      <artifactId>keycloak-parent</artifactId>
      <groupId>org.keycloak</groupId>
-      <version>4.2.0.Final</version>
+      <version>4.3.0.Final</version>
      <relativePath>../../../pom.xml</relativePath>
    </parent>
    <artifactId>spring-boot-container-bundle</artifactId>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.2.0.Final</version>
+    <version>4.3.0.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.2.0.Final</version>
+    <version>4.3.0.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -22,7 +22,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Adapters</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -84,6 +84,7 @@ import org.keycloak.dom.saml.v2.protocol.ExtensionsType;
 import org.keycloak.rotation.KeyLocator;
 import org.keycloak.saml.processing.core.util.KeycloakKeySamlExtensionGenerator;
 import org.keycloak.saml.processing.core.util.XMLEncryptionUtil;
+import org.keycloak.saml.validators.DestinationValidator;

 /**
 *
@@ -97,6 +98,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
    protected final SamlSessionStore sessionStore;
    protected  final SamlDeployment deployment;
    protected AuthChallenge challenge;
+    private final DestinationValidator destinationValidator = DestinationValidator.forProtocolMap(null);

    public AbstractSamlAuthenticationHandler(HttpFacade facade, SamlDeployment deployment, SamlSessionStore sessionStore) {
        this.facade = facade;
@@ -145,7 +147,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
            holder = SAMLRequestParser.parseRequestPostBinding(samlRequest);
        }
        RequestAbstractType requestAbstractType = (RequestAbstractType) holder.getSamlObject();
-        if (!requestUri.equals(requestAbstractType.getDestination().toString())) {
+        if (! destinationValidator.validate(requestUri, requestAbstractType.getDestination())) {
            log.error("expected destination '" + requestUri + "' got '" + requestAbstractType.getDestination() + "'");
            return AuthOutcome.FAILED;
        }
@@ -186,7 +188,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
        }
        final StatusResponseType statusResponse = (StatusResponseType) holder.getSamlObject();
        // validate destination
-        if (!requestUri.equals(statusResponse.getDestination())) {
+        if (! destinationValidator.validate(requestUri, statusResponse.getDestination())) {
            log.error("Request URI '" + requestUri + "' does not match SAML request destination '" + statusResponse.getDestination() + "'");
            return AuthOutcome.FAILED;
        }
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Wildfly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Client Adapter SPI Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.2.0.Final</version>
+		<version>4.3.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -103,7 +103,7 @@ public class AuthzClient {
    /**
     * <p>Creates a {@link ProtectionResource} instance which can be used to access the Protection API.
     *
-     * @param the PAT (the access token with the uma_protection scope)
+     * @param accessToken the PAT (the access token with the uma_protection scope)
     * @return a {@link ProtectionResource}
     */
    public ProtectionResource protection(final String accessToken) {
@@ -69,7 +69,7 @@ public class PolicyResource {
        try {
            return callable.call();
        } catch (Exception cause) {
-            return Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error creating policy for resurce [" + resourceId + "]", cause);
+            return Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error creating policy for resource [" + resourceId + "]", cause);
        }
    }

@@ -99,7 +99,7 @@ public class PolicyResource {
        try {
            callable.call();
        } catch (Exception cause) {
-            Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error updating policy for resurce [" + resourceId + "]", cause);
+            Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error updating policy for resource [" + resourceId + "]", cause);
        }
    }

@@ -121,7 +121,7 @@ public class PolicyResource {
        try {
            callable.call();
        } catch (Exception cause) {
-            Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error updating policy for resurce [" + resourceId + "]", cause);
+            Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error updating policy for resource [" + resourceId + "]", cause);
        }
    }

@@ -181,7 +181,7 @@ public class PolicyResource {
        try {
            return callable.call();
        } catch (Exception cause) {
-            return Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error creating policy for resurce [" + resourceId + "]", cause);
+            return Throwables.retryAndWrapExceptionIfNecessary(callable, pat, "Error creating policy for resource [" + resourceId + "]", cause);
        }
    }
 }
@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -17,10 +17,15 @@
 */
 package org.keycloak.authorization.policy.provider.aggregated;

-import java.util.List;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.Map;

 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.Decision;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.evaluation.DecisionResultCollector;
 import org.keycloak.authorization.policy.evaluation.DefaultEvaluation;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
@@ -34,31 +39,40 @@ public class AggregatePolicyProvider implements PolicyProvider {

    @Override
    public void evaluate(Evaluation evaluation) {
-        //TODO: need to detect deep recursions
        DecisionResultCollector decision = new DecisionResultCollector() {
            @Override
-            protected void onComplete(List<Result> results) {
-                if (results.isEmpty()) {
-                    evaluation.deny();
+            protected void onComplete(Result result) {
+                if (isGranted(result.getResults().iterator().next())) {
+                    evaluation.grant();
                } else {
-                    Result result = results.iterator().next();
-
-                    if (Effect.PERMIT.equals(result.getEffect())) {
-                        evaluation.grant();
-                    }
+                    evaluation.deny();
                }
            }
        };
-
-        Policy policy = evaluation.getPolicy();
        AuthorizationProvider authorization = evaluation.getAuthorizationProvider();
+        Policy policy = evaluation.getPolicy();
+        DefaultEvaluation defaultEvaluation = DefaultEvaluation.class.cast(evaluation);
+        Map<Policy, Map<Object, Decision.Effect>> decisionCache = defaultEvaluation.getDecisionCache();
+        ResourcePermission permission = evaluation.getPermission();

-        policy.getAssociatedPolicies().forEach(associatedPolicy -> {
-            PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
-            policyProvider.evaluate(new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision, authorization));
-        });
+        for (Policy associatedPolicy : policy.getAssociatedPolicies()) {
+            Map<Object, Decision.Effect> decisions = decisionCache.computeIfAbsent(associatedPolicy, p -> new HashMap<>());
+            Decision.Effect effect = decisions.get(permission);
+            DefaultEvaluation eval = new DefaultEvaluation(evaluation.getPermission(), evaluation.getContext(), policy, associatedPolicy, decision, authorization, decisionCache);

-        decision.onComplete();
+            if (effect == null) {
+                PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
+
+                policyProvider.evaluate(eval);
+
+                eval.denyIfNoEffect();
+                decisions.put(permission, eval.getEffect());
+            } else {
+                eval.setEffect(effect);
+            }
+        }
+
+        decision.onComplete(permission);
    }

    @Override
@@ -19,6 +19,9 @@ package org.keycloak.authorization.policy.provider.js;

 import java.util.function.BiFunction;

+import javax.script.ScriptContext;
+import javax.script.SimpleScriptContext;
+
 import org.keycloak.authorization.AuthorizationProvider;
 import org.keycloak.authorization.model.Policy;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
@@ -40,14 +43,14 @@ class JSPolicyProvider implements PolicyProvider {
    public void evaluate(Evaluation evaluation) {
        Policy policy = evaluation.getPolicy();
        AuthorizationProvider authorization = evaluation.getAuthorizationProvider();
-        final EvaluatableScriptAdapter adapter = evaluatableScript.apply(authorization, policy);
+        EvaluatableScriptAdapter adapter = evaluatableScript.apply(authorization, policy);

        try {
-            //how to deal with long running scripts -> timeout?
-            adapter.eval(bindings -> {
-                bindings.put("script", adapter.getScriptModel());
-                bindings.put("$evaluation", evaluation);
-            });
+            SimpleScriptContext context = new SimpleScriptContext();
+
+            context.setAttribute("$evaluation", evaluation, ScriptContext.ENGINE_SCOPE);
+
+            adapter.eval(context);
        }
        catch (Exception e) {
            throw new RuntimeException("Error evaluating JS Policy [" + policy.getName() + "].", e);
@@ -67,6 +67,12 @@ public class ScriptCache {

    public EvaluatableScriptAdapter computeIfAbsent(String id, Function<String, EvaluatableScriptAdapter> function) {
        try {
+            EvaluatableScriptAdapter adapter = removeIfExpired(cache.get(id));
+
+            if (adapter != null) {
+                return adapter;
+            }
+
            if (parkForWriteAndCheckInterrupt()) {
                return null;
            }
@@ -83,20 +89,6 @@ public class ScriptCache {
        }
    }

-    public EvaluatableScriptAdapter get(String uri) {
-        if (parkForReadAndCheckInterrupt()) {
-            return null;
-        }
-
-        CacheEntry cached = cache.get(uri);
-
-        if (cached != null) {
-            return removeIfExpired(cached);
-        }
-
-        return null;
-    }
-
    public void remove(String key) {
        try {
            if (parkForWriteAndCheckInterrupt()) {
@@ -132,16 +124,6 @@ public class ScriptCache {
        return false;
    }

-    private boolean parkForReadAndCheckInterrupt() {
-        while (writing.get()) {
-            LockSupport.parkNanos(1L);
-            if (Thread.interrupted()) {
-                return true;
-            }
-        }
-        return false;
-    }
-
    private static final class CacheEntry {

        final String key;
@@ -17,34 +17,43 @@
 package org.keycloak.authorization.policy.provider.permission;

 import org.keycloak.authorization.AuthorizationProvider;
+import org.keycloak.authorization.Decision;
 import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.permission.ResourcePermission;
 import org.keycloak.authorization.policy.evaluation.DefaultEvaluation;
 import org.keycloak.authorization.policy.evaluation.Evaluation;
 import org.keycloak.authorization.policy.provider.PolicyProvider;

+import java.util.HashMap;
+import java.util.Map;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
-public class AbstractPermissionProvider implements PolicyProvider {
-
-    public AbstractPermissionProvider() {
-
-    }
+public abstract class AbstractPermissionProvider implements PolicyProvider {

    @Override
    public void evaluate(Evaluation evaluation) {
-        if (!(evaluation instanceof DefaultEvaluation)) {
-            throw new IllegalArgumentException("Unexpected evaluation instance type [" + evaluation.getClass() + "]");
-        }
-
-        Policy policy = evaluation.getPolicy();
        AuthorizationProvider authorization = evaluation.getAuthorizationProvider();
+        DefaultEvaluation defaultEvaluation = DefaultEvaluation.class.cast(evaluation);
+        Map<Policy, Map<Object, Decision.Effect>> decisionCache = defaultEvaluation.getDecisionCache();
+        Policy policy = evaluation.getPolicy();
+        ResourcePermission permission = evaluation.getPermission();

        policy.getAssociatedPolicies().forEach(associatedPolicy -> {
-            PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
-            DefaultEvaluation.class.cast(evaluation).setPolicy(associatedPolicy);
-            policyProvider.evaluate(evaluation);
-            evaluation.denyIfNoEffect();
+            Map<Object, Decision.Effect> decisions = decisionCache.computeIfAbsent(associatedPolicy, p -> new HashMap<>());
+            Decision.Effect effect = decisions.get(permission);
+
+            defaultEvaluation.setPolicy(associatedPolicy);
+
+            if (effect == null) {
+                PolicyProvider policyProvider = authorization.getProvider(associatedPolicy.getType());
+                policyProvider.evaluate(defaultEvaluation);
+                evaluation.denyIfNoEffect();
+                decisions.put(permission, defaultEvaluation.getEffect());
+            } else {
+                defaultEvaluation.setEffect(effect);
+            }
        });
    }

@@ -16,9 +16,36 @@
 */
 package org.keycloak.authorization.policy.provider.permission;

+import org.keycloak.authorization.Decision;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.DefaultEvaluation;
+import org.keycloak.authorization.policy.evaluation.Evaluation;
+
+import java.util.HashMap;
+import java.util.Map;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class ResourcePolicyProvider extends AbstractPermissionProvider {

+    @Override
+    public void evaluate(Evaluation evaluation) {
+        DefaultEvaluation defaultEvaluation = DefaultEvaluation.class.cast(evaluation);
+        Map<Policy, Map<Object, Decision.Effect>> decisionCache = defaultEvaluation.getDecisionCache();
+        Policy policy = defaultEvaluation.getParentPolicy();
+        Map<Object, Decision.Effect> decisions = decisionCache.computeIfAbsent(policy, p -> new HashMap<>());
+        ResourcePermission permission = evaluation.getPermission();
+        Decision.Effect effect = decisions.get(permission.getResource());
+
+        if (effect != null) {
+            defaultEvaluation.setEffect(effect);
+            return;
+        }
+
+        super.evaluate(evaluation);
+
+        decisions.put(permission.getResource(), defaultEvaluation.getEffect());
+    }
 }
@@ -16,9 +16,46 @@
 */
 package org.keycloak.authorization.policy.provider.permission;

+import org.keycloak.authorization.Decision;
+import org.keycloak.authorization.model.Policy;
+import org.keycloak.authorization.model.Scope;
+import org.keycloak.authorization.permission.ResourcePermission;
+import org.keycloak.authorization.policy.evaluation.DefaultEvaluation;
+import org.keycloak.authorization.policy.evaluation.Evaluation;
+
+import java.util.HashMap;
+import java.util.Map;
+
 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class ScopePolicyProvider extends AbstractPermissionProvider {

+    @Override
+    public void evaluate(Evaluation evaluation) {
+        DefaultEvaluation defaultEvaluation = DefaultEvaluation.class.cast(evaluation);
+        Map<Policy, Map<Object, Decision.Effect>> decisionCache = defaultEvaluation.getDecisionCache();
+        Policy policy = defaultEvaluation.getParentPolicy();
+        Map<Object, Decision.Effect> decisions = decisionCache.computeIfAbsent(policy, p -> new HashMap<>());
+        ResourcePermission permission = evaluation.getPermission();
+
+        for (Scope scope : permission.getScopes()) {
+            Decision.Effect effect = decisions.get(scope);
+
+            if (effect != null) {
+                defaultEvaluation.setEffect(effect);
+                return;
+            }
+        }
+
+        Decision.Effect decision = defaultEvaluation.getEffect();
+
+        if (decision == null) {
+            super.evaluate(evaluation);
+
+            for (Scope scope : policy.getScopes()) {
+                decisions.put(scope, defaultEvaluation.getEffect());
+            }
+        }
+    }
 }
@@ -45,6 +45,7 @@ import org.keycloak.representations.idm.authorization.PolicyRepresentation;
 import org.keycloak.representations.idm.authorization.RolePolicyRepresentation;
 import org.keycloak.representations.idm.authorization.RolePolicyRepresentation.RoleDefinition;
 import org.keycloak.representations.idm.authorization.UmaPermissionRepresentation;
+import org.keycloak.representations.idm.authorization.UserPolicyRepresentation;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -106,6 +107,14 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
            }
        }

+        Set<String> users = representation.getUsers();
+
+        if (users != null) {
+            for (String user : users) {
+                createUserPolicy(policy, policyStore, user, representation.getOwner());
+            }
+        }
+
        String condition = representation.getCondition();

        if (condition != null) {
@@ -184,6 +193,24 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
                } else {
                    RepresentationToModel.toModel(rep, authorization, associatedPolicy);
                }
+            } else if ("user".equals(associatedRep.getType())) {
+                UserPolicyRepresentation rep = UserPolicyRepresentation.class.cast(associatedRep);
+
+                rep.setUsers(new HashSet<>());
+
+                Set<String> updatedUsers = representation.getUsers();
+
+                if (updatedUsers != null) {
+                    for (String user : updatedUsers) {
+                        rep.addUser(user);
+                    }
+                }
+
+                if (rep.getUsers().isEmpty()) {
+                    policyStore.delete(associatedPolicy.getId());
+                } else {
+                    RepresentationToModel.toModel(rep, authorization, associatedPolicy);
+                }
            }
        }

@@ -241,6 +268,24 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
            }
        }

+        Set<String> updatedUsers = representation.getUsers();
+
+        if (updatedUsers != null) {
+            boolean createPolicy = true;
+
+            for (Policy associatedPolicy : associatedPolicies) {
+                if ("user".equals(associatedPolicy.getType())) {
+                    createPolicy = false;
+                }
+            }
+
+            if (createPolicy) {
+                for (String user : updatedUsers) {
+                    createUserPolicy(policy, policyStore, user, policy.getOwner());
+                }
+            }
+        }
+
        String condition = representation.getCondition();

        if (condition != null) {
@@ -300,6 +345,12 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis
                for (String client : rep.getClients()) {
                    representation.addClient(realm.getClientById(client).getClientId());
                }
+            } else if ("user".equals(associatedPolicy.getType())) {
+                UserPolicyRepresentation rep = UserPolicyRepresentation.class.cast(associatedRep);
+
+                for (String user : rep.getUsers()) {
+                    representation.addUser(authorization.getKeycloakSession().users().getUserById(user, realm).getUsername());
+                }
            }
        }

@@ -391,4 +442,17 @@ public class UMAPolicyProviderFactory implements PolicyProviderFactory<UmaPermis

        policy.addAssociatedPolicy(associatedPolicy);
    }
+
+    private void createUserPolicy(Policy policy, PolicyStore policyStore, String user, String owner) {
+        UserPolicyRepresentation rep = new UserPolicyRepresentation();
+
+        rep.setName(KeycloakModelUtils.generateId());
+        rep.addUser(user);
+
+        Policy associatedPolicy = policyStore.create(rep, policy.getResourceServer());
+
+        associatedPolicy.setOwner(owner);
+
+        policy.addAssociatedPolicy(associatedPolicy);
+    }
 }
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -22,7 +22,7 @@
    <parent>
        <groupId>org.keycloak.bom</groupId>
        <artifactId>keycloak-bom-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
    </parent>

    <groupId>org.keycloak.bom</groupId>
@@ -37,107 +37,107 @@
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-core</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-adapter-core</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-adapter-spi</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-wildfly-adapter-dist</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-saml-adapter-core</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-saml-adapter-api-public</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat8-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat7-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat6-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty81-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty91-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty92-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty93-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-undertow-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-2-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>spring-boot-container-bundle</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-security-adapter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-starter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-legacy-spring-boot-starter</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-authz-client</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
@@ -26,7 +26,7 @@

    <groupId>org.keycloak.bom</groupId>
    <artifactId>keycloak-bom-parent</artifactId>
-    <version>4.2.0.Final</version>
+    <version>4.3.0.Final</version>

    <packaging>pom</packaging>

@@ -23,7 +23,7 @@
    <parent>
        <groupId>org.keycloak.bom</groupId>
        <artifactId>keycloak-bom-parent</artifactId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
    </parent>

    <groupId>org.keycloak.bom</groupId>
@@ -38,12 +38,12 @@
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-core</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-server-spi</artifactId>
-                <version>4.2.0.Final</version>
+                <version>4.3.0.Final</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.2.0.Final</version>
+        <version>4.3.0.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -22,9 +22,9 @@ import org.keycloak.representations.AccessToken.Authorization;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;
 import org.keycloak.representations.idm.authorization.Permission;

+import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
-import java.util.Map;

 /**
 * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
@@ -113,7 +113,7 @@ public class AuthorizationContext {
            return Collections.emptyList();
        }

-        return Collections.unmodifiableList(authorization.getPermissions());
+        return Collections.unmodifiableList(new ArrayList<>(authorization.getPermissions()));
    }

    public boolean isGranted() {
@@ -167,12 +167,15 @@ public class TokenVerifier<T extends JsonWebToken> {
    }

    /**
-     * Creates an instance of {@code TokenVerifier} from the given string on a JWT of the given class.
+     * Creates an instance of {@code TokenVerifier} for the given token.
     * The token verifier has no checks defined. Note that the checks are only tested when
     * {@link #verify()} method is invoked.
+     * <p>
+     * <b>NOTE:</b> The returned token verifier cannot verify token signature since
+     * that is not part of the {@link JsonWebToken} object.
     * @return
     */
-    public static <T extends JsonWebToken> TokenVerifier<T> create(T token) {
+    public static <T extends JsonWebToken> TokenVerifier<T> createWithoutSignature(T token) {
        return new TokenVerifier(token);
    }

@@ -22,9 +22,9 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import org.keycloak.representations.idm.authorization.Permission;

 import java.io.Serializable;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;

@@ -86,13 +86,13 @@ public class AccessToken extends IDToken {
    public static class Authorization implements Serializable {

        @JsonProperty("permissions")
-        private List<Permission> permissions;
+        private Collection<Permission> permissions;

-        public List<Permission> getPermissions() {
+        public Collection<Permission> getPermissions() {
            return permissions;
        }

-        public void setPermissions(List<Permission> permissions) {
+        public void setPermissions(Collection<Permission> permissions) {
            this.permissions = permissions;
        }
    }
Author	SHA1	Message	Date
keycloak-bot	b2269bd74d	Set version to 4.3.0.Final	2018-08-15 18:12:19 +00:00
stianst	90bafee5eb	Fixes to examples-dist for removed Fuse example	2018-08-15 16:57:23 +02:00
stianst	ab77140454	KEYCLOAK-8036 Fix misplaced IdP buttons	2018-08-15 11:32:02 +02:00
stianst	d1ae13c208	Fix product versions	2018-08-15 11:04:18 +02:00
Sebastian Laskawiec	e9604a49e1	KEYCLOAK-8046 Prevent from sending Client twice	2018-08-14 17:35:37 +02:00
Hynek Mlnarik	645a72482b	KEYCLOAK-8048 Fix testsuite compilation issue	2018-08-14 13:56:45 +02:00
Hiroyuki Wada	730377a843	KEYCLOAK-7528 Set Cache-Control and Pragma header in token endpoint	2018-08-14 11:41:12 +02:00
Stefan Guilhen	f36e45cb10	[KEYCLOAK-4902] - Using streams to process scopes and cache improvements	2018-08-14 06:29:10 -03:00
Steffen Kreutz	ed72097862	KEYCLOAK-5289 Add support for Google's hd parameter	2018-08-14 11:08:57 +02:00
Stefan Guilhen	0b95cdacb8	[KEYCLOAK-7885] Add user policy support to the policy API	2018-08-13 22:09:17 -03:00
Stefan Guilhen	1912a8acf4	[KEYCLOAK-7885] Fix javadoc/log message typos	2018-08-13 22:09:17 -03:00
vmuzikar	79774d2f07	KEYCLOAK-8035 Fix failing GitLab Social Login test	2018-08-13 08:46:06 -04:00
Erin Recachinas	fa8cb004a1	KEYCLOAK-6086 Casting Jetty WebAppContext in Spring Adapter checks validity and unwraps	2018-08-13 11:16:19 +02:00
Sebastian Laskawiec	3449401ae2	KEYCLOAK-7635: Subject DN validation for x509ClientAuthenticator	2018-08-13 09:36:02 +02:00
sebastienblanc	02b2a8aab0	KEYCLOAK-7635 : Authenticate clients with x509 certificate	2018-08-13 09:36:02 +02:00
mposolda	575851d45c	KEYCLOAK-6038 Kerberos cross-realm trust test	2018-08-10 13:31:36 +02:00
Stefan Guilhen	060b3b8d0f	[KEYCLOAK-4902] - Using streams when fetching resources	2018-08-09 16:28:31 -03:00
Hynek Mlnarik	a8a9631d4f	KEYCLOAK-6832 Unify Destination attribute handling	2018-08-09 10:30:30 +02:00
vmuzikar	2efc7ebb48	KEYCLOAK-8007 Fix compilation errors in Console UI and WelcomePage tests	2018-08-09 07:26:07 +02:00
Pedro Igor	905fd3ae00	[KEYCLOAK-8003] - Migration to 4.2.1 extracting RESOURCE_URIs fails with fine-grained admin permissions	2018-08-08 11:00:25 +02:00
Martin Kanis	ee8c35a48e	KEYCLOAK-6119 Create CI job for Postgres with schema	2018-08-08 08:57:11 +02:00
Hynek Mlnarik	fb58214fcc	KEYCLOAK-7994 Move examples to test-apps	2018-08-08 08:55:38 +02:00
ssilvert@win.redhat.com	4554798cec	KEYCLOAK-8002: Add missing TS files to notification component	2018-08-07 15:27:42 -04:00
Pedro Igor	80e5227bcd	[KEYCLOAK-4902] - Refactoring and improvements to processing of authz requests	2018-08-07 10:53:40 -03:00
vmuzikar	65f51b7b83	KEYCLOAK-6736 Base UI tests for mobile and desktop browsers	2018-08-07 13:53:31 +02:00
Richard Kolkovich	72750b9882	KEYCLOAK-7954 treat empty string as null for skipping token verification	2018-08-07 11:13:15 +02:00
mposolda	27719565ae	KEYCLOAK-4298 Migrate LDAP tests to the new testsuite	2018-08-06 12:08:19 +02:00
Hynek Mlnarik	65030e2c73	KEYCLOAK-7993 Fix failing Fuse 7 tests	2018-08-06 08:22:30 +02:00
wyvie	b5d56e2f3b	[KEYCLOAK-7838] made tests ordered so they don't fail because of order	2018-08-03 20:52:54 +02:00
mposolda	a63676ce93	KEYCLOAK-7989 Running server config migration fails due the Hostname SPI	2018-08-03 13:47:17 +02:00
wyvie	01af40413e	[KEYCLOAK-7868] code fixed, unignoring the test	2018-08-02 15:33:31 +02:00
Hynek Mlnarik	f6a4ba98de	KEYCLOAK-7986 Fix realm definition	2018-08-02 15:32:42 +02:00
Hiroyuki Wada	263792a4ab	KEYCLOAK-7984 Fix migration issue	2018-08-02 14:58:20 +02:00
alva.huang	3380fdc119	[KEYCLOAK-7985] fix the table name error, from RESOURCE_URI to RESOURCE_URIS Signed-off-by: alva.huang <alva@izhiju.cn>	2018-08-02 08:31:44 -03:00
mposolda	959cd035ba	Set version to 4.3.0.Final-SNAPSHOT	2018-08-01 22:40:05 +02:00
ssilvert@win.redhat.com	e7e15652cf	KEYCLOAK-7479: Sanitize	2018-08-01 14:22:39 -04:00
Hynek Mlnarik	f57cc3a9c0	KEYCLOAK-5257 Clarify usage of TokenVerifier	2018-08-01 13:38:31 +02:00
mposolda	29da7d3d90	KEYCLOAK-7562 Fix ClientInitiatedAccountLinkTest#testErrorConditions	2018-08-01 13:33:23 +02:00
stianst	f99299ee39	KEYCLOAK-7967 Introduce Hostname SPI	2018-08-01 11:57:45 +02:00
stianst	ae47b7fa80	KEYCLOAK-7967 Remove injection of UriInfo	2018-08-01 11:57:45 +02:00