KEYCLOAK-8264 Update OpenShift Token Review endpoint to support additional algorithms and to update session last refresh on token introspection

KEYCLOAK-8263 Add option to client to override access token timeout
KEYCLOAK-7560 Refactor token signature SPI PR
2018-09-11 14:18:13 +02:00 · 2018-09-11 12:40:51 +02:00 · 2018-09-11 08:14:10 +02:00 · 2018-09-11 08:14:10 +02:00 · 2018-09-10 21:17:00 +02:00 · 2018-09-10 20:31:04 +02:00
605 changed files with 8614 additions and 1755 deletions
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.3.0.Final-SNAPSHOT</version>
+    <version>4.5.0.Final-SNAPSHOT</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -4,7 +4,7 @@
    <parent>
      <artifactId>keycloak-parent</artifactId>
      <groupId>org.keycloak</groupId>
-      <version>4.3.0.Final-SNAPSHOT</version>
+      <version>4.5.0.Final-SNAPSHOT</version>
      <relativePath>../../../pom.xml</relativePath>
    </parent>
    <artifactId>spring-boot-container-bundle</artifactId>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.3.0.Final-SNAPSHOT</version>
+    <version>4.5.0.Final-SNAPSHOT</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.3.0.Final-SNAPSHOT</version>
+    <version>4.5.0.Final-SNAPSHOT</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -22,7 +22,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Adapters</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Wildfly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Client Adapter SPI Modules</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.3.0.Final-SNAPSHOT</version>
+		<version>4.5.0.Final-SNAPSHOT</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -25,7 +25,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-provider-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-authz-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -22,7 +22,7 @@
    <parent>
        <groupId>org.keycloak.bom</groupId>
        <artifactId>keycloak-bom-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
    </parent>

    <groupId>org.keycloak.bom</groupId>
@@ -37,107 +37,107 @@
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-core</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-adapter-core</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-adapter-spi</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-wildfly-adapter-dist</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-saml-adapter-core</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-saml-adapter-api-public</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat8-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat7-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-tomcat6-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty81-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty91-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty92-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-jetty93-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-undertow-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-2-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>spring-boot-container-bundle</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-security-adapter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-spring-boot-starter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-legacy-spring-boot-starter</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-authz-client</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
@@ -26,7 +26,7 @@

    <groupId>org.keycloak.bom</groupId>
    <artifactId>keycloak-bom-parent</artifactId>
-    <version>4.3.0.Final-SNAPSHOT</version>
+    <version>4.5.0.Final-SNAPSHOT</version>

    <packaging>pom</packaging>

@@ -23,7 +23,7 @@
    <parent>
        <groupId>org.keycloak.bom</groupId>
        <artifactId>keycloak-bom-parent</artifactId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
    </parent>

    <groupId>org.keycloak.bom</groupId>
@@ -38,12 +38,12 @@
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-core</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
            <dependency>
                <groupId>org.keycloak</groupId>
                <artifactId>keycloak-server-spi</artifactId>
-                <version>4.3.0.Final-SNAPSHOT</version>
+                <version>4.5.0.Final-SNAPSHOT</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -33,7 +33,13 @@ import java.util.Set;
 public class Profile {

    public enum Feature {
-        AUTHORIZATION, IMPERSONATION, SCRIPTS, DOCKER, ACCOUNT2, TOKEN_EXCHANGE
+        ACCOUNT2,
+        AUTHORIZATION,
+        DOCKER,
+        IMPERSONATION,
+        OPENSHIFT_INTEGRATION,
+        SCRIPTS,
+        TOKEN_EXCHANGE
    }

    private enum ProductValue {
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.3.0.Final-SNAPSHOT</version>
+        <version>4.5.0.Final-SNAPSHOT</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -27,6 +27,7 @@ import java.security.PublicKey;
 * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
 * @version $Revision: 1 $
 */
+@Deprecated
 public class RSATokenVerifier {

    private final TokenVerifier<AccessToken> tokenVerifier;
@@ -0,0 +1,26 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
+public interface Token {
+
+    @JsonIgnore
+    TokenCategory getCategory();
+
+}
@@ -0,0 +1,25 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak;
+
+public enum TokenCategory {
+    INTERNAL,
+    ACCESS,
+    ID,
+    ADMIN,
+    USERINFO
+}
@@ -24,12 +24,14 @@ import org.keycloak.jose.jws.AlgorithmType;
 import org.keycloak.jose.jws.JWSHeader;
 import org.keycloak.jose.jws.JWSInput;
 import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.crypto.SignatureVerifierContext;
 import org.keycloak.jose.jws.crypto.HMACProvider;
 import org.keycloak.jose.jws.crypto.RSAProvider;
 import org.keycloak.representations.JsonWebToken;
 import org.keycloak.util.TokenUtil;

 import javax.crypto.SecretKey;
+
 import java.security.PublicKey;
 import java.util.*;
 import java.util.logging.Level;
@@ -144,6 +146,13 @@ public class TokenVerifier<T extends JsonWebToken> {
    private JWSInput jws;
    private T token;

+    private SignatureVerifierContext verifier = null;
+
+    public TokenVerifier<T> verifierContext(SignatureVerifierContext verifier) {
+        this.verifier = verifier;
+        return this;
+    }
+
    protected TokenVerifier(String tokenString, Class<T> clazz) {
        this.tokenString = tokenString;
        this.clazz = clazz;
@@ -337,27 +346,39 @@ public class TokenVerifier<T extends JsonWebToken> {
    }

    public void verifySignature() throws VerificationException {
-        AlgorithmType algorithmType = getHeader().getAlgorithm().getType();
+        if (this.verifier != null) {
+            try {
+                if (!verifier.verify(jws.getEncodedSignatureInput().getBytes("UTF-8"), jws.getSignature())) {
+                    throw new TokenSignatureInvalidException(token, "Invalid token signature");
+                }
+            } catch (Exception e) {
+                throw new VerificationException(e);
+            }
+        } else {
+            AlgorithmType algorithmType = getHeader().getAlgorithm().getType();

-        if (null == algorithmType) {
-            throw new VerificationException("Unknown or unsupported token algorithm");
-        } else switch (algorithmType) {
-            case RSA:
-                if (publicKey == null) {
-                    throw new VerificationException("Public key not set");
-                }
-                if (!RSAProvider.verify(jws, publicKey)) {
-                    throw new TokenSignatureInvalidException(token, "Invalid token signature");
-                }   break;
-            case HMAC:
-                if (secretKey == null) {
-                    throw new VerificationException("Secret key not set");
-                }
-                if (!HMACProvider.verify(jws, secretKey)) {
-                    throw new TokenSignatureInvalidException(token, "Invalid token signature");
-                }   break;
-            default:
+            if (null == algorithmType) {
                throw new VerificationException("Unknown or unsupported token algorithm");
+            } else switch (algorithmType) {
+                case RSA:
+                    if (publicKey == null) {
+                        throw new VerificationException("Public key not set");
+                    }
+                    if (!RSAProvider.verify(jws, publicKey)) {
+                        throw new TokenSignatureInvalidException(token, "Invalid token signature");
+                    }
+                    break;
+                case HMAC:
+                    if (secretKey == null) {
+                        throw new VerificationException("Secret key not set");
+                    }
+                    if (!HMACProvider.verify(jws, secretKey)) {
+                        throw new TokenSignatureInvalidException(token, "Invalid token signature");
+                    }
+                    break;
+                default:
+                    throw new VerificationException("Unknown or unsupported token algorithm");
+            }
        }
    }

@@ -412,7 +433,7 @@ public class TokenVerifier<T extends JsonWebToken> {
    public static <T extends JsonWebToken> Predicate<T> alternative(final Predicate<? super T>... predicates) {
        return new Predicate<T>() {
            @Override
-            public boolean test(T t) throws VerificationException {
+            public boolean test(T t) {
                for (Predicate<? super T> predicate : predicates) {
                    try {
                        if (predicate.test(t)) {
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+import java.security.PrivateKey;
+import java.security.Signature;
+
+public class AsymmetricSignatureSignerContext implements SignatureSignerContext {
+
+    private final KeyWrapper key;
+
+    public AsymmetricSignatureSignerContext(KeyWrapper key) throws SignatureException {
+        this.key = key;
+    }
+
+    @Override
+    public String getKid() {
+        return key.getKid();
+    }
+
+    @Override
+    public String getAlgorithm() {
+        return key.getAlgorithm();
+    }
+
+    @Override
+    public byte[] sign(byte[] data) throws SignatureException {
+        try {
+            Signature signature = Signature.getInstance(JavaAlgorithm.getJavaAlgorithm(key.getAlgorithm()));
+            signature.initSign((PrivateKey) key.getSignKey());
+            signature.update(data);
+            return signature.sign();
+        } catch (Exception e) {
+            throw new SignatureException("Signing failed", e);
+        }
+    }
+
+}
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+import org.keycloak.common.VerificationException;
+
+import java.security.PublicKey;
+import java.security.Signature;
+
+public class AsymmetricSignatureVerifierContext implements SignatureVerifierContext {
+
+    private final KeyWrapper key;
+
+    public AsymmetricSignatureVerifierContext(KeyWrapper key) {
+        this.key = key;
+    }
+
+    @Override
+    public String getKid() {
+        return key.getKid();
+    }
+
+    @Override
+    public String getAlgorithm() {
+        return key.getAlgorithm();
+    }
+
+    @Override
+    public boolean verify(byte[] data, byte[] signature) throws VerificationException {
+        try {
+            Signature verifier = Signature.getInstance(JavaAlgorithm.getJavaAlgorithm(key.getAlgorithm()));
+            verifier.initVerify((PublicKey) key.getVerifyKey());
+            verifier.update(data);
+            return verifier.verify(signature);
+        } catch (Exception e) {
+            throw new VerificationException("Signing failed", e);
+        }
+    }
+
+}
@@ -18,24 +18,41 @@ package org.keycloak.crypto;

 public class JavaAlgorithm {

+    public static final String RS256 = "SHA256withRSA";
+    public static final String RS384 = "SHA384withRSA";
+    public static final String RS512 = "SHA512withRSA";
+    public static final String HS256 = "HMACSHA256";
+    public static final String HS384 = "HMACSHA384";
+    public static final String HS512 = "HMACSHA512";
+    public static final String ES256 = "SHA256withECDSA";
+    public static final String ES384 = "SHA384withECDSA";
+    public static final String ES512 = "SHA512withECDSA";
+    public static final String AES = "AES";
+
    public static String getJavaAlgorithm(String algorithm) {
        switch (algorithm) {
            case Algorithm.RS256:
-                return "SHA256withRSA";
+                return RS256;
            case Algorithm.RS384:
-                return "SHA384withRSA";
+                return RS384;
            case Algorithm.RS512:
-                return "SHA512withRSA";
+                return RS512;
            case Algorithm.HS256:
-                return "HMACSHA256";
+                return HS256;
            case Algorithm.HS384:
-                return "HMACSHA384";
+                return HS384;
            case Algorithm.HS512:
-                return "HMACSHA512";
+                return HS512;
+            case Algorithm.ES256:
+                return ES256;
+            case Algorithm.ES384:
+                return ES384;
+            case Algorithm.ES512:
+                return ES512;
            case Algorithm.AES:
-                return "AES";
+                return AES;
            default:
-                throw new IllegalArgumentException("Unkown algorithm " + algorithm);
+                throw new IllegalArgumentException("Unknown algorithm " + algorithm);
        }
    }

@@ -19,17 +19,13 @@ package org.keycloak.crypto;
 import javax.crypto.SecretKey;
 import java.security.Key;
 import java.security.cert.X509Certificate;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;

 public class KeyWrapper {

    private String providerId;
    private long providerPriority;
    private String kid;
-    private Set<String> algorithms;
+    private String algorithm;
    private String type;
    private KeyUse use;
    private KeyStatus status;
@@ -62,19 +58,12 @@ public class KeyWrapper {
        this.kid = kid;
    }

-    public Set<String> getAlgorithms() {
-        return algorithms;
+    public String getAlgorithm() {
+        return algorithm;
    }

-    public void setAlgorithms(String... algorithms) {
-        this.algorithms = new HashSet<>();
-        for (String a : algorithms) {
-            this.algorithms.add(a);
-        }
-    }
-
-    public void setAlgorithms(Set<String> algorithms) {
-        this.algorithms = algorithms;
+    public void setAlgorithm(String algorithm) {
+        this.algorithm = algorithm;
    }

    public String getType() {
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+import javax.crypto.Mac;
+
+public class MacSignatureSignerContext implements SignatureSignerContext {
+
+    private final KeyWrapper key;
+
+    public MacSignatureSignerContext(KeyWrapper key) throws SignatureException {
+        this.key = key;
+    }
+
+    @Override
+    public String getKid() {
+        return key.getKid();
+    }
+
+    @Override
+    public String getAlgorithm() {
+        return key.getAlgorithm();
+    }
+
+    @Override
+    public byte[] sign(byte[] data) throws SignatureException {
+        try {
+            Mac mac = Mac.getInstance(JavaAlgorithm.getJavaAlgorithm(key.getAlgorithm()));
+            mac.init(key.getSecretKey());
+            mac.update(data);
+            return mac.doFinal();
+        } catch (Exception e) {
+            throw new SignatureException("Signing failed", e);
+        }
+    }
+
+}
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+import org.keycloak.common.VerificationException;
+
+import javax.crypto.Mac;
+import java.security.MessageDigest;
+
+public class MacSignatureVerifierContext implements SignatureVerifierContext {
+
+    private final KeyWrapper key;
+
+    public MacSignatureVerifierContext(KeyWrapper key) {
+        this.key = key;
+    }
+
+    @Override
+    public String getKid() {
+        return key.getKid();
+    }
+
+    @Override
+    public String getAlgorithm() {
+        return key.getAlgorithm();
+    }
+
+    @Override
+    public boolean verify(byte[] data, byte[] signature) throws VerificationException {
+        try {
+            Mac mac = Mac.getInstance(JavaAlgorithm.getJavaAlgorithm(key.getAlgorithm()));
+            mac.init(key.getSecretKey());
+            mac.update(data);
+            byte[] verificationSignature = mac.doFinal();
+            return MessageDigest.isEqual(verificationSignature, signature);
+        } catch (Exception e) {
+            throw new VerificationException("Signing failed", e);
+        }
+    }
+
+}
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+public class SignatureException extends RuntimeException {
+
+    public SignatureException(String message) {
+        super(message);
+    }
+
+    public SignatureException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+}
@@ -0,0 +1,27 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+public interface SignatureSignerContext {
+
+    String getKid();
+
+    String getAlgorithm();
+
+    byte[] sign(byte[] data) throws SignatureException;
+
+}
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.crypto;
+
+import org.keycloak.common.VerificationException;
+
+public interface SignatureVerifierContext {
+
+    String getKid();
+
+    String getAlgorithm();
+
+    boolean verify(byte[] data, byte[] signature) throws VerificationException;
+
+}
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.jose.jwk;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class ECPublicJWK extends JWK {
+
+    public static final String CRV = "crv";
+    public static final String X = "x";
+    public static final String Y = "y";
+
+    @JsonProperty(CRV)
+    private String crv;
+
+    @JsonProperty(X)
+    private String x;
+
+    @JsonProperty(Y)
+    private String y;
+
+    public String getCrv() {
+        return crv;
+    }
+
+    public void setCrv(String crv) {
+        this.crv = crv;
+    }
+
+    public String getX() {
+        return x;
+    }
+
+    public void setX(String x) {
+        this.x = x;
+    }
+
+    public String getY() {
+        return y;
+    }
+
+    public void setY(String y) {
+        this.y = y;
+    }
+}
@@ -19,9 +19,13 @@ package org.keycloak.jose.jwk;

 import org.keycloak.common.util.Base64Url;
 import org.keycloak.common.util.KeyUtils;
+import org.keycloak.crypto.Algorithm;
+import org.keycloak.crypto.KeyType;

 import java.math.BigInteger;
+import java.security.Key;
 import java.security.PublicKey;
+import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPublicKey;

 /**
@@ -30,10 +34,11 @@ import java.security.interfaces.RSAPublicKey;
 public class JWKBuilder {

    public static final String DEFAULT_PUBLIC_KEY_USE = "sig";
-    public static final String DEFAULT_MESSAGE_DIGEST = "SHA-256";

    private String kid;

+    private String algorithm;
+
    private JWKBuilder() {
    }

@@ -46,15 +51,25 @@ public class JWKBuilder {
        return this;
    }

+    public JWKBuilder algorithm(String algorithm) {
+        this.algorithm = algorithm;
+        return this;
+    }
+
    public JWK rs256(PublicKey key) {
+        algorithm(Algorithm.RS256);
+        return rsa(key);
+    }
+
+    public JWK rsa(Key key) {
        RSAPublicKey rsaKey = (RSAPublicKey) key;

        RSAPublicJWK k = new RSAPublicJWK();

        String kid = this.kid != null ? this.kid : KeyUtils.createKeyId(key);
        k.setKeyId(kid);
-        k.setKeyType(RSAPublicJWK.RSA);
-        k.setAlgorithm(RSAPublicJWK.RS256);
+        k.setKeyType(KeyType.RSA);
+        k.setAlgorithm(algorithm);
        k.setPublicKeyUse(DEFAULT_PUBLIC_KEY_USE);
        k.setModulus(Base64Url.encode(toIntegerBytes(rsaKey.getModulus())));
        k.setPublicExponent(Base64Url.encode(toIntegerBytes(rsaKey.getPublicExponent())));
@@ -62,6 +77,24 @@ public class JWKBuilder {
        return k;
    }

+
+    public JWK ec(Key key) {
+        ECPublicKey ecKey = (ECPublicKey) key;
+
+        ECPublicJWK k = new ECPublicJWK();
+
+        String kid = this.kid != null ? this.kid : KeyUtils.createKeyId(key);
+        k.setKeyId(kid);
+        k.setKeyType(KeyType.EC);
+        k.setAlgorithm(algorithm);
+        k.setPublicKeyUse(DEFAULT_PUBLIC_KEY_USE);
+        k.setCrv("P-" + ecKey.getParams().getCurve().getField().getFieldSize());
+        k.setX(Base64Url.encode(ecKey.getW().getAffineX().toByteArray()));
+        k.setY(Base64Url.encode(ecKey.getW().getAffineY().toByteArray()));
+
+        return k;
+    }
+
    /**
     * Copied from org.apache.commons.codec.binary.Base64
     */
@@ -18,12 +18,18 @@
 package org.keycloak.jose.jwk;

 import com.fasterxml.jackson.core.type.TypeReference;
+import org.bouncycastle.jce.ECNamedCurveTable;
+import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
+import org.bouncycastle.jce.spec.ECNamedCurveSpec;
 import org.keycloak.common.util.Base64Url;
+import org.keycloak.crypto.KeyType;
 import org.keycloak.util.JsonSerialization;

 import java.math.BigInteger;
 import java.security.KeyFactory;
 import java.security.PublicKey;
+import java.security.spec.ECPoint;
+import java.security.spec.ECPublicKeySpec;
 import java.security.spec.RSAPublicKeySpec;
 import java.util.Map;

@@ -66,20 +72,61 @@ public class JWKParser {

    public PublicKey toPublicKey() {
        String keyType = jwk.getKeyType();
-        if (isKeyTypeSupported(keyType)) {
-            BigInteger modulus = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.MODULUS).toString()));
-            BigInteger publicExponent = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.PUBLIC_EXPONENT).toString()));
+        if (keyType.equals(KeyType.RSA)) {
+            return createRSAPublicKey();
+        } else if (keyType.equals(KeyType.EC)) {
+            return createECPublicKey();

-            try {
-                return KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
-            } catch (Exception e) {
-                throw new RuntimeException(e);
-            }
        } else {
            throw new RuntimeException("Unsupported keyType " + keyType);
        }
    }

+    private PublicKey createECPublicKey() {
+        String crv = (String) jwk.getOtherClaims().get(ECPublicJWK.CRV);
+        BigInteger x = new BigInteger(1, Base64Url.decode((String) jwk.getOtherClaims().get(ECPublicJWK.X)));
+        BigInteger y = new BigInteger(1, Base64Url.decode((String) jwk.getOtherClaims().get(ECPublicJWK.Y)));
+
+        String name;
+        switch (crv) {
+            case "P-256" :
+                name = "secp256r1";
+                break;
+            case "P-384" :
+                name = "secp384r1";
+                break;
+            case "P-521" :
+                name = "secp521r1";
+                break;
+            default :
+                throw new RuntimeException("Unsupported curve");
+        }
+
+        try {
+            ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(name);
+            ECNamedCurveSpec params = new ECNamedCurveSpec("prime256v1", spec.getCurve(), spec.getG(), spec.getN());
+            ECPoint point = new ECPoint(x, y);
+            ECPublicKeySpec pubKeySpec = new ECPublicKeySpec(point, params);
+
+            KeyFactory kf = KeyFactory.getInstance("ECDSA");
+            return kf.generatePublic(pubKeySpec);
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private PublicKey createRSAPublicKey() {
+        BigInteger modulus = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.MODULUS).toString()));
+        BigInteger publicExponent = new BigInteger(1, Base64Url.decode(jwk.getOtherClaims().get(RSAPublicJWK.PUBLIC_EXPONENT).toString()));
+
+        try {
+            KeyFactory kf = KeyFactory.getInstance("RSA");
+            return kf.generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
    public boolean isKeyTypeSupported(String keyType) {
        return RSAPublicJWK.RSA.equals(keyType);
    }
Author	SHA1	Message	Date
stianst	0bb2ff9e8a	KEYCLOAK-8264 Update OpenShift Token Review endpoint to support additional algorithms and to update session last refresh on token introspection	2018-09-11 14:18:13 +02:00
stianst	12f3d2115d	KEYCLOAK-8263 Add option to client to override access token timeout	2018-09-11 12:40:51 +02:00
stianst	24e60747b6	KEYCLOAK-7560 Refactor token signature SPI PR Also incorporates: KEYCLOAK-6770 ES256/384/512 providers KEYCLOAK-4622 Use HS256 for refresh tokens KEYCLOAK-4623 Use HS256 for client reg tokens	2018-09-11 08:14:10 +02:00
Takashi Norimatsu	5b6036525c	KEYCLOAK-7560 Refactor Token Sign and Verify by Token Signature SPI	2018-09-11 08:14:10 +02:00
vramik	bd4098191b	KEYCLOAK-7604-rename-ids-saml-clients	2018-09-10 21:17:00 +02:00
Leon Graser	df22c4d613	changed user and resource entity to fetch mode select with batch size 20	2018-09-10 20:31:04 +02:00
Pedro Igor	0561d73ae2	[KEYCLOAK-6285] - HTTP Challenge Authentication Flow	2018-09-10 19:02:49 +02:00
stianst	bf758809ba	KEYCLOAK-6229 OpenShift Token Review interface	2018-09-07 08:21:28 +02:00
stianst	1fb4ca4525	Set version to 4.5.0.Final	2018-09-06 20:08:02 +02:00
vmuzikar	e59646aafb	KEYCLOAK-8246 Disable Base UI tests by default	2018-09-06 14:56:57 +02:00
vmuzikar	bd8510f4da	KEYCLOAK-7925 Initial tests for the new Account Console	2018-09-06 09:59:28 +02:00
stianst	c56e171f3a	KEYCLOAK-7608 Check if themes dir is null in FolderThemeProvider	2018-09-06 08:52:17 +02:00