Set version to 4.4.0.Final

README.md

@@ -44,7 +44,6 @@ To start Keycloak during development first build as specified above, then run:
 
     mvn -f testsuite/utils/pom.xml exec:java -Pkeycloak-server 
 
-When running testsuite, by default an account with username `admin` and password `admin` will be created within the master realm at start.
 
 To start Keycloak from the server distribution first build the distribution it as specified above, then run:
 

adapters/oidc/adapter-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AdapterDeploymentContext.java

@@ -482,16 +482,6 @@ public class AdapterDeploymentContext {
         public void setPublicKeyCacheTtl(int publicKeyCacheTtl) {
             delegate.setPublicKeyCacheTtl(publicKeyCacheTtl);
         }
-
-        @Override
-        public boolean isVerifyTokenAudience() {
-            return delegate.isVerifyTokenAudience();
-        }
-
-        @Override
-        public void setVerifyTokenAudience(boolean verifyTokenAudience) {
-            delegate.setVerifyTokenAudience(verifyTokenAudience);
-        }
     }
 
     protected KeycloakUriBuilder getBaseBuilder(HttpFacade facade, String base) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/AuthenticatedActionsHandler.java

@@ -106,10 +106,7 @@ public class AuthenticatedActionsHandler {
         if (deployment.getPolicyEnforcer() != null) {
             if (exposeHeaders != null) {
                 exposeHeaders += ",";
-            } else {
-                exposeHeaders = "";
             }
-
             exposeHeaders += "WWW-Authenticate";
         }
 

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/BearerTokenRequestAuthenticator.java

@@ -18,7 +18,7 @@
 package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
@@ -72,13 +72,8 @@ public class BearerTokenRequestAuthenticator {
         for (String authHeader : authHeaders) {
             String[] split = authHeader.trim().split("\\s+");
             if (split == null || split.length != 2) continue;
-            if (split[0].equalsIgnoreCase("Bearer")) {
-                tokenString = split[1];
-                if (log.isDebugEnabled()) {
-                    log.debugf("Found [%s] values in authorization header, selecting the first value for Bearer.", authHeaders.size());
-                }
-                break;
-            };
+            if (!split[0].equalsIgnoreCase("Bearer")) continue;
+            tokenString = split[1];
         }
 
         if (tokenString == null) {
@@ -101,7 +96,7 @@ public class BearerTokenRequestAuthenticator {
             }
         }
         try {
-            token = AdapterTokenVerifier.verifyToken(tokenString, deployment);
+            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
         } catch (VerificationException e) {
             log.error("Failed to verify token", e);
             challenge = challengeResponse(exchange, OIDCAuthenticationError.Reason.INVALID_TOKEN, "invalid_token", e.getMessage());

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/CookieTokenStore.java

@@ -19,8 +19,7 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.KeycloakPrincipal;
-import org.keycloak.TokenVerifier;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.KeycloakUriBuilder;
@@ -72,11 +71,7 @@ public class CookieTokenStore {
 
         try {
             // Skip check if token is active now. It's supposed to be done later by the caller
-            TokenVerifier<AccessToken> tokenVerifier = AdapterTokenVerifier.createVerifier(accessTokenString, deployment, true, AccessToken.class)
-                    .checkActive(false)
-                    .verify();
-            AccessToken accessToken = tokenVerifier.getToken();
-
+            AccessToken accessToken = AdapterRSATokenVerifier.verifyToken(accessTokenString, deployment, false, true);
             IDToken idToken;
             if (idTokenString != null && idTokenString.length() > 0) {
                 try {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java

@@ -92,11 +92,10 @@ public class KeycloakDeployment {
     // https://tools.ietf.org/html/rfc7636
     protected boolean pkce = false;
     protected boolean ignoreOAuthQueryParameter;
-
+    
     protected Map<String, String> redirectRewriteRules;
 
     protected boolean delegateBearerErrorResponseSending = false;
-    protected boolean verifyTokenAudience = false;
 
     public KeycloakDeployment() {
     }
@@ -478,12 +477,4 @@ public class KeycloakDeployment {
     public void setDelegateBearerErrorResponseSending(boolean delegateBearerErrorResponseSending) {
         this.delegateBearerErrorResponseSending = delegateBearerErrorResponseSending;
     }
-
-    public boolean isVerifyTokenAudience() {
-        return verifyTokenAudience;
-    }
-
-    public void setVerifyTokenAudience(boolean verifyTokenAudience) {
-        this.verifyTokenAudience = verifyTokenAudience;
-    }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeploymentBuilder.java

@@ -122,7 +122,6 @@ public class KeycloakDeploymentBuilder {
         deployment.setPublicKeyCacheTtl(adapterConfig.getPublicKeyCacheTtl());
         deployment.setIgnoreOAuthQueryParameter(adapterConfig.isIgnoreOAuthQueryParameter());
         deployment.setRewriteRedirectRules(adapterConfig.getRedirectRewriteRules());
-        deployment.setVerifyTokenAudience(adapterConfig.isVerifyTokenAudience());
 
         if (realmKeyPem == null && adapterConfig.isBearerOnly() && adapterConfig.getAuthServerUrl() == null) {
             throw new IllegalArgumentException("For bearer auth, you must set the realm-public-key or auth-server-url");

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java

@@ -19,7 +19,7 @@ package org.keycloak.adapters;
 
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.AdapterSessionStore;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
@@ -40,6 +40,7 @@ import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.Map;
+import java.util.logging.Level;
 
 
 /**
@@ -358,9 +359,15 @@ public class OAuthRequestAuthenticator {
         }
 
         try {
-            AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, idTokenString, deployment);
-            token = tokens.getAccessToken();
-            idToken = tokens.getIdToken();
+            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+            if (idTokenString != null) {
+                try {
+                    JWSInput input = new JWSInput(idTokenString);
+                    idToken = input.readJsonContent(IDToken.class);
+                } catch (JWSInputException e) {
+                    throw new VerificationException();
+                }
+            }
             log.debug("Token Verification succeeded!");
         } catch (VerificationException e) {
             log.error("failed verification of token: " + e.getMessage());

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/PreAuthActionsHandler.java

@@ -20,27 +20,30 @@ package org.keycloak.adapters;
 import java.security.PublicKey;
 
 import org.jboss.logging.Logger;
-import org.keycloak.TokenVerifier;
 import org.keycloak.adapters.authentication.ClientCredentialsProvider;
 import org.keycloak.adapters.authentication.JWTClientCredentialsProvider;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.spi.UserSessionManagement;
-import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.StreamUtil;
 import org.keycloak.jose.jwk.JSONWebKeySet;
 import org.keycloak.jose.jwk.JWK;
 import org.keycloak.jose.jwk.JWKBuilder;
-import org.keycloak.representations.JsonWebToken;
+import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.constants.AdapterConstants;
 import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
+import org.keycloak.jose.jws.crypto.RSAProvider;
+import org.keycloak.representations.VersionRepresentation;
 import org.keycloak.representations.adapters.action.AdminAction;
 import org.keycloak.representations.adapters.action.LogoutAction;
 import org.keycloak.representations.adapters.action.PushNotBeforeAction;
 import org.keycloak.representations.adapters.action.TestAvailabilityAction;
 import org.keycloak.util.JsonSerialization;
 
+import java.security.PublicKey;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
@@ -210,19 +213,17 @@ public class PreAuthActionsHandler {
         }
 
         try {
-            // Check just signature. Other things checked in validateAction
-            TokenVerifier tokenVerifier = AdapterTokenVerifier.createVerifier(token, deployment, false, JsonWebToken.class);
-            tokenVerifier.verify();
-            return new JWSInput(token);
-        } catch (VerificationException ignore) {
-            log.warn("admin request failed, unable to verify token: "  + ignore.getMessage());
-            if (log.isDebugEnabled()) {
-                log.debug(ignore.getMessage(), ignore);
+            JWSInput input = new JWSInput(token);
+            PublicKey publicKey = AdapterRSATokenVerifier.getPublicKey(input.getHeader().getKeyId(), deployment);
+            if (RSAProvider.verify(input, publicKey)) {
+                return input;
             }
-
-            facade.getResponse().sendError(403, "token failed verification");
-            return null;
+        } catch (JWSInputException ignore) {
         }
+
+        log.warn("admin request failed, unable to verify token");
+        facade.getResponse().sendError(403, "no token");
+        return null;
     }
 
 
@@ -249,15 +250,6 @@ public class PreAuthActionsHandler {
     protected void handleVersion()  {
         try {
             facade.getResponse().setStatus(200);
-            KeycloakDeployment deployment = deploymentContext.resolveDeployment(facade);
-            if (deployment.isCors()) {
-                String origin = facade.getRequest().getHeader(CorsHeaders.ORIGIN);
-                if (origin == null) {
-                    log.debug("no origin header set in request");
-                } else {
-                    facade.getResponse().setHeader(CorsHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
-                }
-            }
             facade.getResponse().setHeader("Content-Type", "application/json");
             JsonSerialization.writeValueToStream(facade.getResponse().getOutputStream(), VersionRepresentation.SINGLETON);
         } catch (Exception e) {

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/RefreshableKeycloakSecurityContext.java

@@ -20,7 +20,7 @@ package org.keycloak.adapters;
 import org.jboss.logging.Logger;
 import org.keycloak.AuthorizationContext;
 import org.keycloak.KeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.Time;
 import org.keycloak.representations.AccessToken;
@@ -130,8 +130,7 @@ public class RefreshableKeycloakSecurityContext extends KeycloakSecurityContext
         String tokenString = response.getToken();
         AccessToken token = null;
         try {
-            AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, response.getIdToken(), deployment);
-            token = tokens.getAccessToken();
+            token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
             log.debug("Token Verification succeeded!");
         } catch (VerificationException e) {
             log.error("failed verification of token");

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/AbstractPolicyEnforcer.java

@@ -112,9 +112,8 @@ public abstract class AbstractPolicyEnforcer {
             }
 
             MethodConfig methodConfig = getRequiredScopes(pathConfig, request);
-            Map<String, List<String>> claims = resolveClaims(pathConfig, httpFacade);
 
-            if (isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims)) {
+            if (isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
                 try {
                     return createAuthorizationContext(accessToken, pathConfig);
                 } catch (Exception e) {
@@ -143,7 +142,7 @@ public abstract class AbstractPolicyEnforcer {
 
     protected abstract boolean challenge(PathConfig pathConfig, MethodConfig methodConfig, OIDCHttpFacade facade);
 
-    protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
+    protected boolean isAuthorized(PathConfig actualPathConfig, MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         Request request = httpFacade.getRequest();
 
         if (isDefaultAccessDeniedUri(request)) {
@@ -176,7 +175,7 @@ public abstract class AbstractPolicyEnforcer {
                             policyEnforcer.getPathMatcher().removeFromCache(getPath(request));
                         }
 
-                        return hasValidClaims(permission, claims);
+                        return hasValidClaims(actualPathConfig, permission, httpFacade, authorization);
                     }
                 }
             } else {
@@ -198,10 +197,12 @@ public abstract class AbstractPolicyEnforcer {
         return false;
     }
 
-    private boolean hasValidClaims(Permission permission, Map<String, List<String>> claims) {
+    private boolean hasValidClaims(PathConfig actualPathConfig, Permission permission, OIDCHttpFacade httpFacade, Authorization authorization) {
         Map<String, Set<String>> grantedClaims = permission.getClaims();
 
         if (grantedClaims != null) {
+            Map<String, List<String>> claims = resolveClaims(actualPathConfig, httpFacade);
+
             if (claims.isEmpty()) {
                 return false;
             }
@@ -348,16 +349,18 @@ public abstract class AbstractPolicyEnforcer {
     }
 
     private Map<String, List<String>> getClaims(Map<String, Map<String, Object>>claimInformationPointConfig, HttpFacade httpFacade) {
+        Map<String, List<String>> claims = new HashMap<>();
+
         if (claimInformationPointConfig != null) {
             for (Entry<String, Map<String, Object>> claimDef : claimInformationPointConfig.entrySet()) {
                 ClaimInformationPointProviderFactory factory = getPolicyEnforcer().getClaimInformationPointProviderFactories().get(claimDef.getKey());
 
                 if (factory != null) {
-                    return factory.create(claimDef.getValue()).resolve(httpFacade);
+                    claims.putAll(factory.create(claimDef.getValue()).resolve(httpFacade));
                 }
             }
         }
 
-        return new HashMap<>();
+        return claims;
     }
 }

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/authorization/KeycloakAdapterPolicyEnforcer.java

@@ -27,7 +27,7 @@ import org.jboss.logging.Logger;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.authorization.client.AuthorizationDeniedException;
 import org.keycloak.authorization.client.AuthzClient;
@@ -55,14 +55,14 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
     }
 
     @Override
-    protected boolean isAuthorized(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
+    protected boolean isAuthorized(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, AccessToken accessToken, OIDCHttpFacade httpFacade) {
         AccessToken original = accessToken;
 
-        if (super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims)) {
+        if (super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade)) {
             return true;
         }
 
-        accessToken = requestAuthorizationToken(pathConfig, methodConfig, httpFacade, claims);
+        accessToken = requestAuthorizationToken(pathConfig, methodConfig, httpFacade);
 
         if (accessToken == null) {
             return false;
@@ -90,7 +90,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
 
         original.setAuthorization(authorization);
 
-        return super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade, claims);
+        return super.isAuthorized(pathConfig, methodConfig, accessToken, httpFacade);
     }
 
     @Override
@@ -133,7 +133,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
         }
     }
 
-    private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade, Map<String, List<String>> claims) {
+    private AccessToken requestAuthorizationToken(PathConfig pathConfig, PolicyEnforcerConfig.MethodConfig methodConfig, OIDCHttpFacade httpFacade) {
         if (getEnforcerConfig().getUserManagedAccess() != null) {
             return null;
         }
@@ -149,6 +149,8 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
                 authzRequest.addPermission(pathConfig.getId(), methodConfig.getScopes());
             }
 
+            Map<String, List<String>> claims = resolveClaims(pathConfig, httpFacade);
+
             if (!claims.isEmpty()) {
                 authzRequest.setClaimTokenFormat("urn:ietf:params:oauth:token-type:jwt");
                 authzRequest.setClaimToken(Base64.encodeBytes(JsonSerialization.writeValueAsBytes(claims)));
@@ -169,7 +171,7 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {
             }
 
             if (authzResponse != null) {
-                return AdapterTokenVerifier.verifyToken(authzResponse.getToken(), deployment);
+                return AdapterRSATokenVerifier.verifyToken(authzResponse.getToken(), deployment);
             }
         } catch (AuthorizationDeniedException ignore) {
             LOGGER.debug("Authorization denied", ignore);

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/AbstractKeycloakLoginModule.java

@@ -23,7 +23,7 @@ import org.keycloak.adapters.AdapterUtils;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.FindFile;
 import org.keycloak.common.util.reflections.Reflections;
@@ -202,16 +202,8 @@ public abstract class AbstractKeycloakLoginModule implements LoginModule {
 
 
     protected Auth bearerAuth(String tokenString) throws VerificationException {
-        AccessToken token = AdapterTokenVerifier.verifyToken(tokenString, deployment);
-        return postTokenVerification(tokenString, token);
-    }
+        AccessToken token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
 
-
-    /**
-     * Called after accessToken was verified (including signature, expiration etc)
-     *
-     */
-    protected Auth postTokenVerification(String tokenString, AccessToken token) {
         boolean verifyCaller;
         if (deployment.isUseResourceRoleMappings()) {
             verifyCaller = token.isVerifyCaller(deployment.getResourceName());

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/jaas/DirectAccessGrantsLoginModule.java

@@ -27,7 +27,6 @@ import org.apache.http.message.BasicNameValuePair;
 import org.jboss.logging.Logger;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.authentication.ClientCredentialsProviderUtils;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.KeycloakUriBuilder;
 import org.keycloak.constants.ServiceUrlConstants;
@@ -57,15 +56,11 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
 
     private static final Logger log = Logger.getLogger(DirectAccessGrantsLoginModule.class);
 
-    public static final String SCOPE_OPTION = "scope";
-
     private String refreshToken;
-    private String scope;
 
     @Override
     public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) {
         super.initialize(subject, callbackHandler, sharedState, options);
-        this.scope = (String)options.get(SCOPE_OPTION);
 
         // This is used just for logout
         Iterator<RefreshTokenHolder> iterator = subject.getPrivateCredentials(RefreshTokenHolder.class).iterator();
@@ -94,10 +89,6 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
         formparams.add(new BasicNameValuePair("username", username));
         formparams.add(new BasicNameValuePair("password", password));
 
-        if (scope != null) {
-            formparams.add(new BasicNameValuePair(OAuth2Constants.SCOPE, scope));
-        }
-
         ClientCredentialsProviderUtils.setClientCredentials(deployment, post, formparams);
 
         UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
@@ -130,8 +121,7 @@ public class DirectAccessGrantsLoginModule extends AbstractKeycloakLoginModule {
         // refreshToken will be saved to privateCreds of Subject for now
         refreshToken = tokenResponse.getRefreshToken();
 
-        AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenResponse.getToken(), tokenResponse.getIdToken(), deployment);
-        return postTokenVerification(tokenResponse.getToken(), tokens.getAccessToken());
+        return bearerAuth(tokenResponse.getToken());
     }
 
     @Override

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/AdapterRSATokenVerifier.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.adapters.rotation;
+
+import org.jboss.logging.Logger;
+import org.keycloak.RSATokenVerifier;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.common.VerificationException;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.representations.AccessToken;
+
+import java.security.PublicKey;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class AdapterRSATokenVerifier {
+
+    private static final Logger log = Logger.getLogger(AdapterRSATokenVerifier.class);
+
+    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment) throws VerificationException {
+        return verifyToken(tokenString, deployment, true, true);
+    }
+
+
+    public static PublicKey getPublicKey(String kid, KeycloakDeployment deployment) throws VerificationException {
+        PublicKeyLocator pkLocator = deployment.getPublicKeyLocator();
+
+        PublicKey publicKey = pkLocator.getPublicKey(kid, deployment);
+        if (publicKey == null) {
+            log.errorf("Didn't find publicKey for kid: %s", kid);
+            throw new VerificationException("Didn't find publicKey for specified kid");
+        }
+
+        return publicKey;
+    }
+
+    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment, boolean checkActive, boolean checkTokenType) throws VerificationException {
+        RSATokenVerifier verifier = RSATokenVerifier.create(tokenString).realmUrl(deployment.getRealmInfoUrl()).checkActive(checkActive).checkTokenType(checkTokenType);
+        PublicKey publicKey = getPublicKey(verifier.getHeader().getKeyId(), deployment);
+        return verifier.publicKey(publicKey).verify().getToken();
+    }
+}

adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/rotation/AdapterTokenVerifier.java

@@ -1,149 +0,0 @@
-/*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.keycloak.adapters.rotation;
-
-import org.jboss.logging.Logger;
-import org.keycloak.TokenVerifier;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.common.VerificationException;
-import org.keycloak.representations.AccessToken;
-import org.keycloak.representations.IDToken;
-import org.keycloak.representations.JsonWebToken;
-
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
- */
-public class AdapterTokenVerifier {
-
-    private static final Logger log = Logger.getLogger(AdapterTokenVerifier.class);
-
-
-    /**
-     * Verifies bearer token. Typically called when bearer token (access token) is sent to the service, which wants to verify it. Hence it also checks the audience in the token.
-     *
-     * @param tokenString
-     * @param deployment
-     * @return
-     * @throws VerificationException
-     */
-    public static AccessToken verifyToken(String tokenString, KeycloakDeployment deployment) throws VerificationException {
-        TokenVerifier<AccessToken> tokenVerifier = createVerifier(tokenString, deployment, true, AccessToken.class);
-
-        // Verify audience of bearer-token
-        if (deployment.isVerifyTokenAudience()) {
-            tokenVerifier.audience(deployment.getResourceName());
-        }
-
-        return tokenVerifier.verify().getToken();
-    }
-
-
-    /**
-     * Verify access token and ID token. Typically called after successful tokenResponse is received from Keycloak
-     *
-     * @param accessTokenString
-     * @param idTokenString
-     * @param deployment
-     * @return verified and parsed accessToken and idToken
-     * @throws VerificationException
-     */
-    public static VerifiedTokens verifyTokens(String accessTokenString, String idTokenString, KeycloakDeployment deployment) throws VerificationException {
-        // Adapters currently do most of the checks including signature etc on the access token
-        TokenVerifier<AccessToken> tokenVerifier = createVerifier(accessTokenString, deployment, true, AccessToken.class);
-        AccessToken accessToken = tokenVerifier.verify().getToken();
-
-        if (idTokenString != null) {
-            // Don't verify signature again on IDToken
-            IDToken idToken = TokenVerifier.create(idTokenString, IDToken.class).getToken();
-            TokenVerifier<IDToken> idTokenVerifier = TokenVerifier.createWithoutSignature(idToken);
-
-            // Always verify audience on IDToken
-            idTokenVerifier.audience(deployment.getResourceName());
-
-            idTokenVerifier.verify();
-            return new VerifiedTokens(accessToken, idToken);
-        } else {
-            return new VerifiedTokens(accessToken, null);
-        }
-    }
-
-
-    /**
-     * Creates verifier, initializes it from the KeycloakDeployment and adds the publicKey and some default basic checks (activeness and tokenType). Useful if caller wants to add/remove/update
-     * some checks
-     *
-     * @param tokenString
-     * @param deployment
-     * @param withDefaultChecks
-     * @param tokenClass
-     * @param <T>
-     * @return tokenVerifier
-     * @throws VerificationException
-     */
-    public static <T extends JsonWebToken> TokenVerifier<T> createVerifier(String tokenString, KeycloakDeployment deployment, boolean withDefaultChecks, Class<T> tokenClass) throws VerificationException {
-        TokenVerifier<T> tokenVerifier = TokenVerifier.create(tokenString, tokenClass);
-
-        if (withDefaultChecks) {
-            tokenVerifier
-                    .withDefaultChecks()
-                    .realmUrl(deployment.getRealmInfoUrl());
-        }
-
-        String kid = tokenVerifier.getHeader().getKeyId();
-        PublicKey publicKey = getPublicKey(kid, deployment);
-        tokenVerifier.publicKey(publicKey);
-
-        return tokenVerifier;
-    }
-
-
-    private static PublicKey getPublicKey(String kid, KeycloakDeployment deployment) throws VerificationException {
-        PublicKeyLocator pkLocator = deployment.getPublicKeyLocator();
-
-        PublicKey publicKey = pkLocator.getPublicKey(kid, deployment);
-        if (publicKey == null) {
-            log.errorf("Didn't find publicKey for kid: %s", kid);
-            throw new VerificationException("Didn't find publicKey for specified kid");
-        }
-
-        return publicKey;
-    }
-
-
-    public static class VerifiedTokens {
-
-        private final AccessToken accessToken;
-        private final IDToken idToken;
-
-        public VerifiedTokens(AccessToken accessToken, IDToken idToken) {
-            this.accessToken = accessToken;
-            this.idToken = idToken;
-        }
-
-
-        public AccessToken getAccessToken() {
-            return accessToken;
-        }
-
-        public IDToken getIdToken() {
-            return idToken;
-        }
-    }
-}

adapters/oidc/adapter-core/src/test/java/org/keycloak/adapters/KeycloakDeploymentBuilderTest.java

@@ -77,7 +77,6 @@ public class KeycloakDeploymentBuilderTest {
         assertEquals(20, deployment.getMinTimeBetweenJwksRequests());
         assertEquals(120, deployment.getPublicKeyCacheTtl());
         assertEquals("/api/$1", deployment.getRedirectRewriteRules().get("^/wsmaster/api/(.*)$"));
-        assertTrue(deployment.isVerifyTokenAudience());
     }
 
     @Test

adapters/oidc/adapter-core/src/test/resources/keycloak.json

@@ -34,7 +34,6 @@
     "min-time-between-jwks-requests": 20,
     "public-key-cache-ttl": 120,
     "ignore-oauth-query-parameter": true,
-    "verify-token-audience": true,
     "redirect-rewrite-rules" : {
   	"^/wsmaster/api/(.*)$" : "/api/$1"
      }

adapters/oidc/as7-eap6/as7-adapter-spi/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-as7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/as7-eap6/as7-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/SecureDeploymentDefinition.java

@@ -98,12 +98,6 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
                     .setValidator(new IntRangeValidator(-1, true))
                     .setAllowExpression(true)
                     .build();
-    protected static final SimpleAttributeDefinition PUBLIC_KEY_CACHE_TTL =
-            new SimpleAttributeDefinitionBuilder("public-key-cache-ttl", ModelType.INT, true)
-                    .setXmlName("public-key-cache-ttl")
-                    .setAllowExpression(true)
-                    .setValidator(new IntRangeValidator(-1, true))
-                    .build();
 
     protected static final List<SimpleAttributeDefinition> DEPLOYMENT_ONLY_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
@@ -116,7 +110,6 @@ class SecureDeploymentDefinition extends SimpleResourceDefinition {
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TURN_OFF_CHANGE_SESSION);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TOKEN_MINIMUM_TIME_TO_LIVE);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(MIN_TIME_BETWEEN_JWKS_REQUESTS);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(PUBLIC_KEY_CACHE_TTL);
     }
 
     protected static final List<SimpleAttributeDefinition> ALL_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();

adapters/oidc/as7-eap6/as7-subsystem/src/main/java/org/keycloak/subsystem/as7/SharedAttributeDefinitons.java

@@ -173,13 +173,6 @@ class SharedAttributeDefinitons {
                     .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                     .build();
 
-    protected static final SimpleAttributeDefinition VERIFY_TOKEN_AUDIENCE =
-            new SimpleAttributeDefinitionBuilder("verify-token-audience", ModelType.BOOLEAN, true)
-                    .setXmlName("verify-token-audience")
-                    .setAllowExpression(true)
-                    .setDefaultValue(new ModelNode(false))
-                    .build();
-
 
 
     protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
@@ -207,7 +200,6 @@ class SharedAttributeDefinitons {
         ATTRIBUTES.add(TOKEN_STORE);
         ATTRIBUTES.add(PRINCIPAL_ATTRIBUTE);
         ATTRIBUTES.add(PROXY_URL);
-        ATTRIBUTES.add(VERIFY_TOKEN_AUDIENCE);
     }
 
     /**

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/org/keycloak/subsystem/as7/LocalDescriptions.properties

@@ -47,7 +47,6 @@ keycloak.realm.register-node-period=how often to re-register node
 keycloak.realm.token-store=cookie or session storage for auth session data
 keycloak.realm.principal-attribute=token attribute to use to set Principal name
 keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.realm.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -84,9 +83,7 @@ keycloak.secure-deployment.principal-attribute=token attribute to use to set Pri
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-keycloak.secure-deployment.public-key-cache-ttl=Maximum time the downloaded public keys are considered valid. When this time reach, the adapter is forced to download public keys from keycloak server
 keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.secure-deployment.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 keycloak.secure-deployment.credential=Credential value
 
 keycloak.credential=Credential

adapters/oidc/as7-eap6/as7-subsystem/src/main/resources/schema/keycloak_1_1.xsd

@@ -66,7 +66,6 @@
             <xs:element name="token-store" type="xs:string" minOccurs="0" maxOccurs="1"/>
             <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>
@@ -109,9 +108,7 @@
             <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
             <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="public-key-cache-ttl" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>

adapters/oidc/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak AS7 / JBoss EAP 6 Integration</name>

adapters/oidc/fuse7/camel-undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-fuse7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -38,7 +38,7 @@
             org.keycloak.*;version="${project.version}",
             org.apache.camel.*,
             org.apache.camel.component.undertow,
-            io.undertow.*;version="[1.4,3)",
+            io.undertow.*,
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>

adapters/oidc/fuse7/jetty94/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-fuse7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/fuse7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/fuse7/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-fuse7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/fuse7/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-fuse7-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -43,7 +43,7 @@
             org.apache.cxf.transport.http;resolution:=optional;version="[3,4)",
             org.apache.cxf.transport.http_undertow;resolution:=optional;version="[3,4)",
             org.apache.cxf.transport.servlet;resolution:=optional;version="[3,4)",
-            io.undertow.*;version="[1.4,3)",
+            io.undertow.*,
             *;resolution:=optional
         </keycloak.osgi.import>
         <keycloak.osgi.fragment>org.ops4j.pax.web.pax-web-undertow</keycloak.osgi.fragment>

adapters/oidc/installed/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/installed/src/main/java/org/keycloak/adapters/installed/KeycloakInstalled.java

@@ -24,13 +24,16 @@ import org.keycloak.OAuthErrorException;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.ServerRequest;
-import org.keycloak.adapters.rotation.AdapterTokenVerifier;
+import org.keycloak.adapters.rotation.AdapterRSATokenVerifier;
 import org.keycloak.common.VerificationException;
 import org.keycloak.common.util.KeycloakUriBuilder;
+import org.keycloak.jose.jws.JWSInput;
+import org.keycloak.jose.jws.JWSInputException;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.IDToken;
 
+import javax.ws.rs.client.Client;
 import javax.ws.rs.client.Entity;
 import javax.ws.rs.core.Form;
 import javax.ws.rs.core.HttpHeaders;
@@ -534,9 +537,15 @@ public class KeycloakInstalled {
         refreshToken = tokenResponse.getRefreshToken();
         idTokenString = tokenResponse.getIdToken();
 
-        AdapterTokenVerifier.VerifiedTokens tokens = AdapterTokenVerifier.verifyTokens(tokenString, idTokenString, deployment);
-        token = tokens.getAccessToken();
-        idToken = tokens.getIdToken();
+        token = AdapterRSATokenVerifier.verifyToken(tokenString, deployment);
+        if (idTokenString != null) {
+            try {
+                JWSInput input = new JWSInput(idTokenString);
+                idToken = input.readJsonContent(IDToken.class);
+            } catch (JWSInputException e) {
+                throw new VerificationException();
+            }
+        }
     }
 
     public AccessToken getToken() {

adapters/oidc/jaxrs-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/jetty9.4/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Jetty Integration</name>

adapters/oidc/js/pom.xml

@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/kcinit/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/osgi-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak OIDC Client Adapter Modules</name>

adapters/oidc/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/servlet-oauth-client/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-boot-adapter-core/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>4.6.0.Tmp</version>
+    <version>4.4.0.Final</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-boot-adapter-core/src/main/java/org/keycloak/adapters/springboot/KeycloakBaseSpringBootConfiguration.java

@@ -35,7 +35,6 @@ import org.eclipse.jetty.webapp.WebAppContext;
 import org.keycloak.adapters.jetty.KeycloakJettyAuthenticator;
 import org.keycloak.adapters.undertow.KeycloakServletExtension;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationContext;
 
 import java.util.ArrayList;
 import java.util.HashSet;
@@ -55,10 +54,6 @@ public class KeycloakBaseSpringBootConfiguration {
         KeycloakSpringBootConfigResolver.setAdapterConfig(keycloakProperties);
     }
 
-    @Autowired
-    public void setApplicationContext(ApplicationContext context) {
-        KeycloakSpringBootConfigResolverWrapper.setApplicationContext(context);
-    }
 
     static class KeycloakBaseUndertowDeploymentInfoCustomizer  {
 
@@ -75,7 +70,7 @@ public class KeycloakBaseSpringBootConfiguration {
 
             deploymentInfo.setLoginConfig(loginConfig);
 
-            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolverWrapper.class.getName());
+            deploymentInfo.addInitParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
             deploymentInfo.addSecurityConstraints(getSecurityConstraints());
 
             deploymentInfo.addServletExtension(new KeycloakServletExtension());
@@ -117,7 +112,7 @@ public class KeycloakBaseSpringBootConfiguration {
         public void customize(Server server) {
 
             KeycloakJettyAuthenticator keycloakJettyAuthenticator = new KeycloakJettyAuthenticator();
-            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolverWrapper());
+            keycloakJettyAuthenticator.setConfigResolver(new KeycloakSpringBootConfigResolver());
 
             /* see org.eclipse.jetty.webapp.StandardDescriptorProcessor#visitSecurityConstraint for an example
                on how to map servlet spec to Constraints */
@@ -268,7 +263,7 @@ public class KeycloakBaseSpringBootConfiguration {
                 context.addConstraint(tomcatConstraint);
             }
 
-            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolverWrapper.class.getName());
+            context.addParameter("keycloak.config.resolver", KeycloakSpringBootConfigResolver.class.getName());
         }
     }
 }

adapters/oidc/spring-boot-adapter-core/src/main/java/org/keycloak/adapters/springboot/KeycloakSpringBootConfigResolverWrapper.java

@@ -1,48 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.springboot;
-
-import org.keycloak.adapters.KeycloakConfigResolver;
-import org.keycloak.adapters.springsecurity.config.KeycloakSpringConfigResolverWrapper;
-import org.springframework.beans.factory.NoSuchBeanDefinitionException;
-import org.springframework.context.ApplicationContext;
-
-/**
- * <p>A specific implementation of {@link KeycloakSpringConfigResolverWrapper} that first tries to register any {@link KeycloakConfigResolver}
- * instance provided by the application. if none is provided, {@link KeycloakSpringBootConfigResolver} is set.
- *
- * <p>This implementation is specially useful when using Spring Boot and Spring Security in the same application where the same {@link KeycloakConfigResolver}
- * instance must be used across the different stacks.
- *
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakSpringBootConfigResolverWrapper extends KeycloakSpringConfigResolverWrapper {
-
-    private static ApplicationContext context;
-
-    public KeycloakSpringBootConfigResolverWrapper() {
-        super(new KeycloakSpringBootConfigResolver());
-        try {
-            setDelegate(context.getBean(KeycloakConfigResolver.class));
-        } catch (NoSuchBeanDefinitionException ignore) {
-        }
-    }
-
-    public static void setApplicationContext(ApplicationContext context) {
-        KeycloakSpringBootConfigResolverWrapper.context = context;
-    }
-}

adapters/oidc/spring-boot-adapter-core/src/main/resources/META-INF/spring.factories

@@ -0,0 +1,2 @@
+org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
+org.keycloak.adapters.springboot.KeycloakAutoConfiguration

adapters/oidc/spring-boot-container-bundle/pom.xml

@@ -4,7 +4,7 @@
     <parent>
       <artifactId>keycloak-parent</artifactId>
       <groupId>org.keycloak</groupId>
-      <version>4.6.0.Tmp</version>
+      <version>4.4.0.Final</version>
       <relativePath>../../../pom.xml</relativePath>
     </parent>
     <artifactId>spring-boot-container-bundle</artifactId>

adapters/oidc/spring-boot/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>4.6.0.Tmp</version>
+    <version>4.4.0.Final</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-boot2/pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <artifactId>keycloak-parent</artifactId>
     <groupId>org.keycloak</groupId>
-    <version>4.6.0.Tmp</version>
+    <version>4.4.0.Final</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/config/KeycloakSpringConfigResolverWrapper.java

@@ -1,46 +0,0 @@
-/*
- * Copyright 2018 Red Hat, Inc. and/or its affiliates
- * and other contributors as indicated by the @author tags.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.keycloak.adapters.springsecurity.config;
-
-import org.keycloak.adapters.KeycloakConfigResolver;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.spi.HttpFacade;
-
-/**
- * Spring applications may use different security stacks in order to enforce access based on the configuration provided
- * by a {@code KeycloakDeployment}. This implementation of {@code KeycloakConfigResolver} wraps and avoid calling multiple
- * {@code KeycloakConfigResolver} instances but only those defined by applications or set as default by the configuration.
- *
- * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
- */
-public class KeycloakSpringConfigResolverWrapper implements KeycloakConfigResolver {
-
-    private KeycloakConfigResolver delegate;
-
-    public KeycloakSpringConfigResolverWrapper(KeycloakConfigResolver delegate) {
-        this.delegate = delegate;
-    }
-
-    @Override
-    public KeycloakDeployment resolve(HttpFacade.Request facade) {
-        return delegate.resolve(facade);
-    }
-
-    protected void setDelegate(KeycloakConfigResolver delegate) {
-        this.delegate = delegate;
-    }
-}

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/config/KeycloakWebSecurityConfigurerAdapter.java

@@ -65,7 +65,7 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
     protected AdapterDeploymentContext adapterDeploymentContext() throws Exception {
         AdapterDeploymentContextFactoryBean factoryBean;
         if (keycloakConfigResolver != null) {
-             factoryBean = new AdapterDeploymentContextFactoryBean(new KeycloakSpringConfigResolverWrapper(keycloakConfigResolver));
+             factoryBean = new AdapterDeploymentContextFactoryBean(keycloakConfigResolver);
         }
         else {
             factoryBean = new AdapterDeploymentContextFactoryBean(keycloakConfigFileResource);

adapters/oidc/spring-security/src/main/java/org/keycloak/adapters/springsecurity/filter/KeycloakPreAuthActionsFilter.java

@@ -48,11 +48,10 @@ public class KeycloakPreAuthActionsFilter extends GenericFilterBean implements A
 
     private static final Logger log = LoggerFactory.getLogger(KeycloakPreAuthActionsFilter.class);
 
-    private NodesRegistrationManagement nodesRegistrationManagement = new NodesRegistrationManagement();
+    private final NodesRegistrationManagement management = new NodesRegistrationManagement();
     private ApplicationContext applicationContext;
     private AdapterDeploymentContext deploymentContext;
     private UserSessionManagement userSessionManagement;
-    private PreAuthActionsHandlerFactory preAuthActionsHandlerFactory = new PreAuthActionsHandlerFactory();
 
     public KeycloakPreAuthActionsFilter() {
         super();
@@ -70,7 +69,7 @@ public class KeycloakPreAuthActionsFilter extends GenericFilterBean implements A
     @Override
     public void destroy() {
         log.debug("Unregistering deployment");
-        nodesRegistrationManagement.stop();
+        management.stop();
     }
 
     @Override
@@ -78,8 +77,7 @@ public class KeycloakPreAuthActionsFilter extends GenericFilterBean implements A
             throws IOException, ServletException {
 
         HttpFacade facade = new SimpleHttpFacade((HttpServletRequest)request, (HttpServletResponse)response);
-        nodesRegistrationManagement.tryRegister(deploymentContext.resolveDeployment(facade));
-        PreAuthActionsHandler handler = preAuthActionsHandlerFactory.createPreAuthActionsHandler(facade);
+        PreAuthActionsHandler handler = new PreAuthActionsHandler(userSessionManagement, deploymentContext, facade);
         if (handler.handleRequest()) {
             log.debug("Pre-auth filter handled request: {}", ((HttpServletRequest) request).getRequestURI());
         } else {
@@ -95,23 +93,4 @@ public class KeycloakPreAuthActionsFilter extends GenericFilterBean implements A
     public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
         this.applicationContext = applicationContext;
     }
-    
-    void setNodesRegistrationManagement(NodesRegistrationManagement nodesRegistrationManagement) {
-        this.nodesRegistrationManagement = nodesRegistrationManagement;
-    }
-    
-    void setPreAuthActionsHandlerFactory(PreAuthActionsHandlerFactory preAuthActionsHandlerFactory) {
-        this.preAuthActionsHandlerFactory = preAuthActionsHandlerFactory;
-    }
-    
-    /**
-     * Creates {@link PreAuthActionsHandler}s.
-     * 
-     * Package-private class to enable mocking.
-     */
-    class PreAuthActionsHandlerFactory {
-        PreAuthActionsHandler createPreAuthActionsHandler(HttpFacade facade) {
-            return new PreAuthActionsHandler(userSessionManagement, deploymentContext, facade);
-        }
-    }
 }

adapters/oidc/spring-security/src/test/java/org/keycloak/adapters/springsecurity/filter/KeycloakPreAuthActionsFilterTest.java

@@ -1,90 +0,0 @@
-package org.keycloak.adapters.springsecurity.filter;
-
-import static org.mockito.Matchers.any;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.verifyZeroInteractions;
-import static org.mockito.Mockito.when;
-import static org.mockito.MockitoAnnotations.initMocks;
-
-import javax.servlet.FilterChain;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.keycloak.adapters.AdapterDeploymentContext;
-import org.keycloak.adapters.KeycloakDeployment;
-import org.keycloak.adapters.NodesRegistrationManagement;
-import org.keycloak.adapters.PreAuthActionsHandler;
-import org.keycloak.adapters.spi.HttpFacade;
-import org.keycloak.adapters.spi.UserSessionManagement;
-import org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.PreAuthActionsHandlerFactory;
-import org.mockito.Mock;
-import org.springframework.context.ApplicationContext;
-
-public class KeycloakPreAuthActionsFilterTest {
-
-    private KeycloakPreAuthActionsFilter filter;
-    
-    @Mock
-    private NodesRegistrationManagement nodesRegistrationManagement;
-    @Mock
-    private ApplicationContext applicationContext;
-    @Mock
-    private AdapterDeploymentContext deploymentContext;
-    @Mock
-    private PreAuthActionsHandlerFactory preAuthActionsHandlerFactory;
-    @Mock
-    private UserSessionManagement userSessionManagement;
-    @Mock
-    private PreAuthActionsHandler preAuthActionsHandler;
-    @Mock
-    private KeycloakDeployment deployment;
-
-    @Mock
-    private HttpServletRequest request;
-    @Mock
-    private HttpServletResponse response;
-    @Mock
-    private FilterChain chain;
-    
-    @Before
-    public void setUp() throws Exception {
-        initMocks(this);
-        filter = new KeycloakPreAuthActionsFilter(userSessionManagement);
-        filter.setNodesRegistrationManagement(nodesRegistrationManagement);
-        filter.setApplicationContext(applicationContext);
-        filter.setPreAuthActionsHandlerFactory(preAuthActionsHandlerFactory);
-        when(applicationContext.getBean(AdapterDeploymentContext.class)).thenReturn(deploymentContext);
-        when(deploymentContext.resolveDeployment(any(HttpFacade.class))).thenReturn(deployment);
-        when(preAuthActionsHandlerFactory.createPreAuthActionsHandler(any(HttpFacade.class))).thenReturn(preAuthActionsHandler);
-        filter.initFilterBean();
-    }
-    
-    @Test
-    public void shouldIgnoreChainWhenPreAuthActionHandlerHandled() throws Exception {
-        when(preAuthActionsHandler.handleRequest()).thenReturn(true);
-        
-        filter.doFilter(request, response, chain);
-        
-        verifyZeroInteractions(chain);
-        verify(nodesRegistrationManagement).tryRegister(deployment);
-    }
-    
-    @Test
-    public void shouldContinueChainWhenPreAuthActionHandlerDidNotHandle() throws Exception {
-        when(preAuthActionsHandler.handleRequest()).thenReturn(false);
-        
-        filter.doFilter(request, response, chain);
-        
-        verify(chain).doFilter(request, response);;
-        verify(nodesRegistrationManagement).tryRegister(deployment);
-    }
-    
-    @After
-    public void tearDown() {
-        filter.destroy();
-        verify(nodesRegistrationManagement).stop();
-    }
-}

adapters/oidc/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak Tomcat Integration</name>

adapters/oidc/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat6/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat7/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/tomcat/tomcat8/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/oidc/undertow/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>
@@ -35,7 +35,6 @@
             org.keycloak.adapters.undertow.*
         </keycloak.osgi.export>
         <keycloak.osgi.import>
-            io.undertow.*;version="[1.4,3)",
             *;resolution:=optional
         </keycloak.osgi.import>
     </properties>

adapters/oidc/wildfly-elytron/pom.xml

@@ -22,7 +22,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak WildFly Integration</name>

adapters/oidc/wildfly/wf8-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/oidc/wildfly/wf8-subsystem/src/main/java/org/keycloak/subsystem/wf8/extension/SecureDeploymentDefinition.java

@@ -96,12 +96,6 @@ public class SecureDeploymentDefinition extends SimpleResourceDefinition {
                     .setValidator(new IntRangeValidator(-1, true))
                     .setAllowExpression(true)
                     .build();
-    protected static final SimpleAttributeDefinition PUBLIC_KEY_CACHE_TTL =
-            new SimpleAttributeDefinitionBuilder("public-key-cache-ttl", ModelType.INT, true)
-                    .setXmlName("public-key-cache-ttl")
-                    .setAllowExpression(true)
-                    .setValidator(new IntRangeValidator(-1, true))
-                    .build();
 
     protected static final List<SimpleAttributeDefinition> DEPLOYMENT_ONLY_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
@@ -114,7 +108,6 @@ public class SecureDeploymentDefinition extends SimpleResourceDefinition {
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TURN_OFF_CHANGE_SESSION);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TOKEN_MINIMUM_TIME_TO_LIVE);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(MIN_TIME_BETWEEN_JWKS_REQUESTS);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(PUBLIC_KEY_CACHE_TTL);
     }
 
     protected static final List<SimpleAttributeDefinition> ALL_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();

adapters/oidc/wildfly/wf8-subsystem/src/main/java/org/keycloak/subsystem/wf8/extension/SharedAttributeDefinitons.java

@@ -194,13 +194,6 @@ public class SharedAttributeDefinitons {
                     .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                     .build();
 
-    protected static final SimpleAttributeDefinition VERIFY_TOKEN_AUDIENCE =
-            new SimpleAttributeDefinitionBuilder("verify-token-audience", ModelType.BOOLEAN, true)
-                    .setXmlName("verify-token-audience")
-                    .setAllowExpression(true)
-                    .setDefaultValue(new ModelNode(false))
-                    .build();
-
     protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
         ATTRIBUTES.add(REALM_PUBLIC_KEY);
@@ -229,7 +222,6 @@ public class SharedAttributeDefinitons {
         ATTRIBUTES.add(AUTODETECT_BEARER_ONLY);
         ATTRIBUTES.add(IGNORE_OAUTH_QUERY_PARAMETER);
         ATTRIBUTES.add(PROXY_URL);
-        ATTRIBUTES.add(VERIFY_TOKEN_AUDIENCE);
     }
 
     /**

adapters/oidc/wildfly/wf8-subsystem/src/main/resources/org/keycloak/subsystem/wf8/extension/LocalDescriptions.properties

@@ -50,7 +50,6 @@ keycloak.realm.principal-attribute=token attribute to use to set Principal name
 keycloak.realm.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.realm.ignore-oauth-query-parameter=disable query parameter parsing for access_token
 keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.realm.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -88,11 +87,9 @@ keycloak.secure-deployment.principal-attribute=token attribute to use to set Pri
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-keycloak.secure-deployment.public-key-cache-ttl=Maximum time the downloaded public keys are considered valid. When this time reach, the adapter is forced to download public keys from keycloak server
 keycloak.secure-deployment.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.secure-deployment.ignore-oauth-query-parameter=disable query parameter parsing for access_token
 keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.secure-deployment.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 keycloak.secure-deployment.credential=Credential value
 
 keycloak.credential=Credential

adapters/oidc/wildfly/wf8-subsystem/src/main/resources/schema/wildfly-keycloak_1_1.xsd

@@ -69,7 +69,6 @@
             <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>
@@ -113,11 +112,9 @@
             <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
             <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="public-key-cache-ttl" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>

adapters/oidc/wildfly/wf8-subsystem/src/test/resources/org/keycloak/subsystem/wf8/extension/keycloak-1.1.xml

@@ -23,14 +23,12 @@
         <turn-off-change-session-id-on-login>false</turn-off-change-session-id-on-login>
         <token-minimum-time-to-live>10</token-minimum-time-to-live>
         <min-time-between-jwks-requests>20</min-time-between-jwks-requests>
-        <public-key-cache-ttl>3600</public-key-cache-ttl>
         <realm-public-key>
             MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4siLKUew0WYxdtq6/rwk4Uj/4amGFFnE/yzIxQVU0PUqz3QBRVkUWpDj0K6ZnS5nzJV/y6DHLEy7hjZTdRDphyF1sq09aDOYnVpzu8o2sIlMM8q5RnUyEfIyUZqwo8pSZDJ90fS0s+IDUJNCSIrAKO3w1lqZDHL6E/YFHXyzkvQIDAQAB
         </realm-public-key>
         <auth-server-url>http://localhost:8080/auth</auth-server-url>
         <ssl-required>EXTERNAL</ssl-required>
         <proxy-url>http://localhost:9000</proxy-url>
-        <verify-token-audience>true</verify-token-audience>
         <credential name="secret">0aa31d98-e0aa-404c-b6e0-e771dba1e798</credential>
     </secure-deployment>
     <secure-deployment name="http-endpoint">

adapters/oidc/wildfly/wildfly-adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/oidc/wildfly/wildfly-subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-parent</artifactId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../../pom.xml</relativePath>
     </parent>
 

adapters/oidc/wildfly/wildfly-subsystem/src/main/java/org/keycloak/subsystem/adapter/extension/AbstractAdapterConfigurationDefinition.java

@@ -95,12 +95,6 @@ abstract class AbstractAdapterConfigurationDefinition extends SimpleResourceDefi
                     .setValidator(new IntRangeValidator(-1, true))
                     .setAllowExpression(true)
                     .build();
-    protected static final SimpleAttributeDefinition PUBLIC_KEY_CACHE_TTL =
-            new SimpleAttributeDefinitionBuilder("public-key-cache-ttl", ModelType.INT, true)
-                    .setXmlName("public-key-cache-ttl")
-                    .setAllowExpression(true)
-                    .setValidator(new IntRangeValidator(-1, true))
-                    .build();
 
     static final List<SimpleAttributeDefinition> DEPLOYMENT_ONLY_ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
 
@@ -114,7 +108,6 @@ abstract class AbstractAdapterConfigurationDefinition extends SimpleResourceDefi
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TURN_OFF_CHANGE_SESSION);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(TOKEN_MINIMUM_TIME_TO_LIVE);
         DEPLOYMENT_ONLY_ATTRIBUTES.add(MIN_TIME_BETWEEN_JWKS_REQUESTS);
-        DEPLOYMENT_ONLY_ATTRIBUTES.add(PUBLIC_KEY_CACHE_TTL);
     }
 
     static final List<SimpleAttributeDefinition> ALL_ATTRIBUTES = new ArrayList();

adapters/oidc/wildfly/wildfly-subsystem/src/main/java/org/keycloak/subsystem/adapter/extension/SharedAttributeDefinitons.java

@@ -200,13 +200,6 @@ public class SharedAttributeDefinitons {
                     .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                     .build();
 
-    protected static final SimpleAttributeDefinition VERIFY_TOKEN_AUDIENCE =
-            new SimpleAttributeDefinitionBuilder("verify-token-audience", ModelType.BOOLEAN, true)
-                    .setXmlName("verify-token-audience")
-                    .setAllowExpression(true)
-                    .setDefaultValue(new ModelNode(false))
-                    .build();
-
 
     protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
     static {
@@ -237,7 +230,6 @@ public class SharedAttributeDefinitons {
         ATTRIBUTES.add(AUTODETECT_BEARER_ONLY);
         ATTRIBUTES.add(IGNORE_OAUTH_QUERY_PARAMETER);
         ATTRIBUTES.add(PROXY_URL);
-        ATTRIBUTES.add(VERIFY_TOKEN_AUDIENCE);
     }
 
     private static boolean isSet(ModelNode attributes, SimpleAttributeDefinition def) {

adapters/oidc/wildfly/wildfly-subsystem/src/main/resources/org/keycloak/subsystem/adapter/extension/LocalDescriptions.properties

@@ -53,7 +53,6 @@ keycloak.realm.principal-attribute=token attribute to use to set Principal name
 keycloak.realm.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.realm.ignore-oauth-query-parameter=disable query parameter parsing for access_token
 keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.realm.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -94,10 +93,8 @@ keycloak.secure-deployment.principal-attribute=token attribute to use to set Pri
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-keycloak.secure-deployment.public-key-cache-ttl=Maximum time the downloaded public keys are considered valid. When this time reach, the adapter is forced to download public keys from keycloak server
 keycloak.secure-deployment.ignore-oauth-query-parameter=disable query parameter parsing for access_token
 keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.secure-deployment.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-server=A deployment secured by Keycloak
 keycloak.secure-server.add=Add a deployment to be secured by Keycloak
@@ -138,10 +135,8 @@ keycloak.secure-server.principal-attribute=token attribute to use to set Princip
 keycloak.secure-server.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-server.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-server.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-keycloak.secure-server.public-key-cache-ttl=Maximum time the downloaded public keys are considered valid. When this time reach, the adapter is forced to download public keys from keycloak server
 keycloak.secure-server.ignore-oauth-query-parameter=disable query parameter parsing for access_token
 keycloak.secure-server.proxy-url=The URL for the HTTP proxy if one is used.
-keycloak.secure-server.verify-token-audience=If true, then during bearer-only authentication, the adapter will verify if token contains this client name (resource) as an audience
 
 keycloak.secure-deployment.credential=Credential value
 keycloak.secure-server.credential=Credential value

adapters/oidc/wildfly/wildfly-subsystem/src/main/resources/schema/wildfly-keycloak_1_1.xsd

@@ -71,7 +71,6 @@
             <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>
@@ -117,11 +116,9 @@
             <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
             <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="public-key-cache-ttl" type="xs:integer" minOccurs="0" maxOccurs="1"/>
             <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
             <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
-            <xs:element name="verify-token-audience" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
         </xs:all>
         <xs:attribute name="name" type="xs:string" use="required">
             <xs:annotation>

adapters/oidc/wildfly/wildfly-subsystem/src/test/resources/org/keycloak/subsystem/adapter/extension/keycloak-1.1.xml

@@ -53,7 +53,6 @@
         <turn-off-change-session-id-on-login>false</turn-off-change-session-id-on-login>
         <token-minimum-time-to-live>10</token-minimum-time-to-live>
         <min-time-between-jwks-requests>20</min-time-between-jwks-requests>
-        <public-key-cache-ttl>3600</public-key-cache-ttl>
         <realm-public-key>
             MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4siLKUew0WYxdtq6/rwk4Uj/4amGFFnE/yzIxQVU0PUqz3QBRVkUWpDj0K6ZnS5nzJV/y6DHLEy7hjZTdRDphyF1sq09aDOYnVpzu8o2sIlMM8q5RnUyEfIyUZqwo8pSZDJ90fS0s+IDUJNCSIrAKO3w1lqZDHL6E/YFHXyzkvQIDAQAB
         </realm-public-key>
@@ -61,7 +60,6 @@
         <ssl-required>EXTERNAL</ssl-required>
         <confidential-port>443</confidential-port>
         <proxy-url>http://localhost:9000</proxy-url>
-        <verify-token-audience>true</verify-token-audience>
         <credential name="secret">0aa31d98-e0aa-404c-b6e0-e771dba1e798</credential>
         <redirect-rewrite-rule name="^/wsmaster/api/(.*)$">api/$1/</redirect-rewrite-rule>
     </secure-deployment>

adapters/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Adapters</name>

adapters/saml/as7-eap6/adapter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/as7-eap6/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML EAP Integration</name>

adapters/saml/as7-eap6/subsystem/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <groupId>org.keycloak</groupId>
         <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

adapters/saml/core-public/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/parsers/DeploymentBuilder.java

@@ -68,11 +68,6 @@ public class DeploymentBuilder {
         SP sp = adapter.getSps().get(0);
         deployment.setConfigured(true);
         deployment.setEntityID(sp.getEntityID());
-        try {
-            URI.create(sp.getEntityID());
-        } catch (IllegalArgumentException ex) {
-            log.warnf("Entity ID is not an URI, assertion that restricts audience will fail. Update Entity ID to be URI.", sp.getEntityID());
-        }
         deployment.setForceAuthentication(sp.isForceAuthentication());
         deployment.setIsPassive(sp.isIsPassive());
         deployment.setNameIDPolicyFormat(sp.getNameIDPolicyFormat());

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/profile/AbstractSamlAuthenticationHandler.java

@@ -84,7 +84,6 @@ import org.keycloak.dom.saml.v2.protocol.ExtensionsType;
 import org.keycloak.rotation.KeyLocator;
 import org.keycloak.saml.processing.core.util.KeycloakKeySamlExtensionGenerator;
 import org.keycloak.saml.processing.core.util.XMLEncryptionUtil;
-import org.keycloak.saml.validators.ConditionsValidator;
 import org.keycloak.saml.validators.DestinationValidator;
 
 /**
@@ -343,15 +342,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
         }
         try {
             assertion = AssertionUtil.getAssertion(responseHolder, responseType, deployment.getDecryptionKey());
-            ConditionsValidator.Builder cvb = new ConditionsValidator.Builder(assertion.getID(), assertion.getConditions(), destinationValidator);
-            try {
-                cvb.addAllowedAudience(URI.create(deployment.getEntityID()));
-                // getDestination has been validated to match request URL already so it matches SAML endpoint
-                cvb.addAllowedAudience(URI.create(responseType.getDestination()));
-            } catch (IllegalArgumentException ex) {
-                // warning has been already emitted in DeploymentBuilder
-            }
-            if (! cvb.build().isValid()) {
+            if (AssertionUtil.hasExpired(assertion)) {
                 return initiateLogin();
             }
         } catch (Exception e) {

adapters/saml/jetty/jetty-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty8.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.1/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.2/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.3/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/jetty9.4/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/jetty/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Jetty Integration</name>

adapters/saml/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Client Adapter Modules</name>

adapters/saml/servlet-filter/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

adapters/saml/tomcat/pom.xml

@@ -20,7 +20,7 @@
     <parent>
         <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
-        <version>4.6.0.Tmp</version>
+        <version>4.4.0.Final</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Keycloak SAML Tomcat Integration</name>

adapters/saml/tomcat/tomcat-core/pom.xml

@@ -21,7 +21,7 @@
     <parent>
 		<artifactId>keycloak-saml-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.6.0.Tmp</version>
+		<version>4.4.0.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>