Set version to 4.2.1.Final

KEYCLOAK-7986 Fix realm definition
KEYCLOAK-7984 Fix migration issue
2018-08-02 15:46:28 +00:00 · 2018-08-02 16:55:58 +02:00 · 2018-08-02 16:55:41 +02:00 · 2018-08-02 16:55:25 +02:00 · 2018-07-31 22:05:34 +02:00 · 2018-07-31 21:55:34 +02:00
1346 changed files with 26984 additions and 25535 deletions
@@ -15,7 +15,8 @@ env:
    - TESTS=server-group3
    - TESTS=server-group4
    - TESTS=old
-    - TESTS=crossdc
+    - TESTS=crossdc-server
+    - TESTS=crossdc-adapter

 jdk:
  - oraclejdk8
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -36,7 +36,16 @@
        </keycloak.osgi.export>
        <keycloak.osgi.import>
            org.keycloak.*;version="${project.version}",
-            org.apache.http.*;version=${apache.httpcomponents.version},
+            org.apache.http.auth.*;version=${apache.httpcomponents.version},
+            org.apache.http.client.*;version=${apache.httpcomponents.version},
+            org.apache.http.conn.*;version=${apache.httpcomponents.version},
+            org.apache.http.cookie.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.auth.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.client.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.conn.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.cookie.*;version=${apache.httpcomponents.version},
+            org.apache.http.impl.execchain.*;version=${apache.httpcomponents.version},
+            org.apache.http.*;version=${apache.httpcomponents.httpcore.version},
            org.apache.karaf.jaas.boot.principal;resolution:=optional,
            org.apache.karaf.jaas.modules;resolution:=optional,
            *;resolution:=optional
@@ -67,8 +67,12 @@ public abstract class AbstractPolicyEnforcer {
        KeycloakSecurityContext securityContext = httpFacade.getSecurityContext();

        if (securityContext == null) {
-            if (pathConfig != null) {
-                challenge(pathConfig, getRequiredScopes(pathConfig, request), httpFacade);
+            if (!isDefaultAccessDeniedUri(request)) {
+                if (pathConfig != null) {
+                    challenge(pathConfig, getRequiredScopes(pathConfig, request), httpFacade);
+                } else {
+                    handleAccessDenied(httpFacade);
+                }
            }
            return createEmptyAuthorizationContext(false);
        }
@@ -122,12 +122,6 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {

    @Override
    protected void handleAccessDenied(OIDCHttpFacade facade) {
-        KeycloakSecurityContext securityContext = facade.getSecurityContext();
-
-        if (securityContext == null) {
-            return;
-        }
-
        String accessDeniedPath = getEnforcerConfig().getOnDenyRedirectTo();
        HttpFacade.Response response = facade.getResponse();

@@ -211,17 +205,16 @@ public class KeycloakAdapterPolicyEnforcer extends AbstractPolicyEnforcer {

    private boolean isBearerAuthorization(OIDCHttpFacade httpFacade) {
        List<String> authHeaders = httpFacade.getRequest().getHeaders("Authorization");
-        if (authHeaders == null || authHeaders.size() == 0) {
-            return false;
+
+        if (authHeaders != null) {
+            for (String authHeader : authHeaders) {
+                String[] split = authHeader.trim().split("\\s+");
+                if (split == null || split.length != 2) continue;
+                if (!split[0].equalsIgnoreCase("Bearer")) continue;
+                return true;
+            }
        }

-        for (String authHeader : authHeaders) {
-            String[] split = authHeader.trim().split("\\s+");
-            if (split == null || split.length != 2) continue;
-            if (!split[0].equalsIgnoreCase("Bearer")) continue;
-            return true;
-        }
-
-        return false;
+        return getPolicyEnforcer().getDeployment().isBearerOnly();
    }
 }
@@ -21,6 +21,7 @@ import java.util.Map;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.locks.LockSupport;

+import org.keycloak.common.util.Time;
 import org.keycloak.representations.adapters.config.PolicyEnforcerConfig.PathConfig;

 /**
@@ -154,7 +155,7 @@ public class PathCache {
            if(maxAge == -1) {
                expiration = -1;
            } else {
-                expiration = System.currentTimeMillis() + maxAge;
+                expiration = Time.currentTimeMillis() + maxAge;
            }
        }

@@ -167,7 +168,7 @@ public class PathCache {
        }

        boolean isExpired() {
-            return expiration != -1 ? System.currentTimeMillis() > expiration : false;
+            return expiration != -1 ? Time.currentTimeMillis() > expiration : false;
        }
    }
 }
@@ -225,9 +225,10 @@ public class PolicyEnforcer {
            for (String id : protectedResource.findAll()) {
                ResourceRepresentation resourceDescription = protectedResource.findById(id);

-                if (resourceDescription.getUri() != null) {
-                    PathConfig pathConfig = PathConfig.createPathConfig(resourceDescription);
-                    paths.put(pathConfig.getPath(), pathConfig);
+                if (resourceDescription.getUris() != null && !resourceDescription.getUris().isEmpty()) {
+                    for(PathConfig pathConfig : PathConfig.createPathConfigs(resourceDescription)) {
+                        paths.put(pathConfig.getPath(), pathConfig);
+                    }
                }
            }
        }
@@ -277,7 +278,7 @@ public class PolicyEnforcer {
                                cipConfig = pathConfig.getClaimInformationPointConfig();
                            }

-                            pathConfig = PathConfig.createPathConfig(matchingResources.get(0));
+                            pathConfig = PathConfig.createPathConfigs(matchingResources.get(0)).iterator().next();

                            if (cipConfig != null) {
                                pathConfig.setClaimInformationPointConfig(cipConfig);
@@ -323,7 +324,7 @@ public class PolicyEnforcer {

                if (!search.isEmpty()) {
                    ResourceRepresentation targetResource = search.get(0);
-                    PathConfig config = PathConfig.createPathConfig(targetResource);
+                    PathConfig config = PathConfig.createPathConfigs(targetResource).iterator().next();

                    config.setScopes(originalConfig.getScopes());
                    config.setMethods(originalConfig.getMethods());
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-as7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-as7-integration-pom</artifactId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -166,6 +166,13 @@ class SharedAttributeDefinitons {
                    .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
                    .build();

+    protected static final SimpleAttributeDefinition PROXY_URL =
+            new SimpleAttributeDefinitionBuilder("proxy-url", ModelType.STRING, true)
+                    .setXmlName("proxy-url")
+                    .setAllowExpression(true)
+                    .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
+                    .build();
+


    protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
@@ -192,6 +199,7 @@ class SharedAttributeDefinitons {
        ATTRIBUTES.add(REGISTER_NODE_PERIOD);
        ATTRIBUTES.add(TOKEN_STORE);
        ATTRIBUTES.add(PRINCIPAL_ATTRIBUTE);
+        ATTRIBUTES.add(PROXY_URL);
    }

    /**
@@ -46,6 +46,7 @@ keycloak.realm.register-node-at-startup=Cluster setting
 keycloak.realm.register-node-period=how often to re-register node
 keycloak.realm.token-store=cookie or session storage for auth session data
 keycloak.realm.principal-attribute=token attribute to use to set Principal name
+keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.

 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -82,7 +83,7 @@ keycloak.secure-deployment.principal-attribute=token attribute to use to set Pri
 keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is changed by default on a successful login.  Change this to true if you want to turn this off
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
-
+keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
 keycloak.secure-deployment.credential=Credential value

 keycloak.credential=Credential
@@ -65,6 +65,7 @@
            <xs:element name="register-node-period" type="xs:integer" minOccurs="0" maxOccurs="1"/>
            <xs:element name="token-store" type="xs:string" minOccurs="0" maxOccurs="1"/>
            <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -107,6 +108,7 @@
            <xs:element name="turn-off-change-session-id-on-login" type="xs:boolean" minOccurs="0" maxOccurs="1" />
            <xs:element name="token-minimum-time-to-live" type="xs:integer" minOccurs="0" maxOccurs="1"/>
            <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak AS7 / JBoss EAP 6 Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -87,12 +87,12 @@
        <dependency>
            <groupId>org.apache.camel</groupId>
            <artifactId>camel-undertow</artifactId>
-            <version>2.21.0</version>
+            <version>2.21.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.camel</groupId>
            <artifactId>camel-core</artifactId>
-            <version>2.21.0</version>
+            <version>2.21.2</version>
        </dependency>
    </dependencies>

@@ -19,20 +19,9 @@ package org.keycloak.adapters.camel.undertow;

 import java.net.URI;
 import java.net.URISyntaxException;
-import java.util.HashMap;
-import java.util.Locale;
-import java.util.Map;
 import org.apache.camel.CamelContext;
-import org.apache.camel.Consumer;
-import org.apache.camel.Processor;
-import org.apache.camel.component.undertow.RestUndertowHttpBinding;
 import org.apache.camel.component.undertow.UndertowComponent;
 import org.apache.camel.component.undertow.UndertowEndpoint;
-import org.apache.camel.spi.RestConfiguration;
-import org.apache.camel.util.FileUtil;
-import org.apache.camel.util.HostUtils;
-import org.apache.camel.util.ObjectHelper;
-import org.apache.camel.util.URISupport;

 /**
 *
@@ -52,136 +41,8 @@ public class UndertowKeycloakComponent extends UndertowComponent {
        return new UndertowKeycloakEndpoint(endpointUri.toString(), component);
    }

-    // TODO: uncomment line below after backport of https://issues.apache.org/jira/browse/CAMEL-12514 into fuse
-//    @Override
+    @Override
    protected String getComponentName() {
        return "undertow-keycloak";
    }
-
-    // TODO: remove all below this line after backport of https://issues.apache.org/jira/browse/CAMEL-12514 into fuse
-    @Override
-    public Consumer createConsumer(CamelContext camelContext, Processor processor, String verb, String basePath, String uriTemplate,
-                                   String consumes, String produces, RestConfiguration configuration, Map<String, Object> parameters) throws Exception {
-        return doCreateConsumer(camelContext, processor, verb, basePath, uriTemplate, consumes, produces, configuration, parameters, false);
-    }
-
-    @Override
-    public Consumer createApiConsumer(CamelContext camelContext, Processor processor, String contextPath,
-                                      RestConfiguration configuration, Map<String, Object> parameters) throws Exception {
-        // reuse the createConsumer method we already have. The api need to use GET and match on uri prefix
-        return doCreateConsumer(camelContext, processor, "GET", contextPath, null, null, null, configuration, parameters, true);
-    }
-
-    Consumer doCreateConsumer(CamelContext camelContext, Processor processor, String verb, String basePath, String uriTemplate,
-                              String consumes, String produces, RestConfiguration configuration, Map<String, Object> parameters, boolean api) throws Exception {
-        String path = basePath;
-        if (uriTemplate != null) {
-            // make sure to avoid double slashes
-            if (uriTemplate.startsWith("/")) {
-                path = path + uriTemplate;
-            } else {
-                path = path + "/" + uriTemplate;
-            }
-        }
-        path = FileUtil.stripLeadingSeparator(path);
-        String scheme = "http";
-        String host = "";
-        int port = 0;
-
-        RestConfiguration config = configuration;
-        if (config == null) {
-            config = camelContext.getRestConfiguration(getComponentName(), true);
-        }
-        if (config.getScheme() != null) {
-            scheme = config.getScheme();
-        }
-        if (config.getHost() != null) {
-            host = config.getHost();
-        }
-        int num = config.getPort();
-        if (num > 0) {
-            port = num;
-        }
-
-        // prefix path with context-path if configured in rest-dsl configuration
-        String contextPath = config.getContextPath();
-        if (ObjectHelper.isNotEmpty(contextPath)) {
-            contextPath = FileUtil.stripTrailingSeparator(contextPath);
-            contextPath = FileUtil.stripLeadingSeparator(contextPath);
-            if (ObjectHelper.isNotEmpty(contextPath)) {
-                path = contextPath + "/" + path;
-            }
-        }
-
-        // if no explicit hostname set then resolve the hostname
-        if (ObjectHelper.isEmpty(host)) {
-            if (config.getRestHostNameResolver() == RestConfiguration.RestHostNameResolver.allLocalIp) {
-                host = "0.0.0.0";
-            } else if (config.getRestHostNameResolver() == RestConfiguration.RestHostNameResolver.localHostName) {
-                host = HostUtils.getLocalHostName();
-            } else if (config.getRestHostNameResolver() == RestConfiguration.RestHostNameResolver.localIp) {
-                host = HostUtils.getLocalIp();
-            }
-        }
-
-        Map<String, Object> map = new HashMap<String, Object>();
-        // build query string, and append any endpoint configuration properties
-        if (config.getComponent() == null || config.getComponent().equals(getComponentName())) {
-            // setup endpoint options
-            if (config.getEndpointProperties() != null && !config.getEndpointProperties().isEmpty()) {
-                map.putAll(config.getEndpointProperties());
-            }
-        }
-
-        boolean explicitOptions = true;
-        // must use upper case for restrict
-        String restrict = verb.toUpperCase(Locale.US);
-        // allow OPTIONS in rest-dsl to allow clients to call the API and have responses with ALLOW headers
-        if (!restrict.contains("OPTIONS")) {
-            restrict += ",OPTIONS";
-            // this is not an explicit OPTIONS path in the rest-dsl
-            explicitOptions = false;
-        }
-
-        boolean cors = config.isEnableCORS();
-        if (cors) {
-            // allow HTTP Options as we want to handle CORS in rest-dsl
-            map.put("optionsEnabled", "true");
-        } else if (explicitOptions) {
-            // the rest-dsl is using OPTIONS
-            map.put("optionsEnabled", "true");
-        }
-
-        String query = URISupport.createQueryString(map);
-
-        String url;
-        if (api) {
-            url = getComponentName() + ":%s://%s:%s/%s?matchOnUriPrefix=true&httpMethodRestrict=%s";
-        } else {
-            url = getComponentName() + ":%s://%s:%s/%s?matchOnUriPrefix=false&httpMethodRestrict=%s";
-        }
-
-        // get the endpoint
-        url = String.format(url, scheme, host, port, path, restrict);
-
-        if (!query.isEmpty()) {
-            url = url + "&" + query;
-        }
-
-        UndertowEndpoint endpoint = camelContext.getEndpoint(url, UndertowEndpoint.class);
-        setProperties(camelContext, endpoint, parameters);
-
-        if (!map.containsKey("undertowHttpBinding")) {
-            // use the rest binding, if not using a custom http binding
-            endpoint.setUndertowHttpBinding(new RestUndertowHttpBinding());
-        }
-
-        // configure consumer properties
-        Consumer consumer = endpoint.createConsumer(processor);
-        if (config.getConsumerProperties() != null && !config.getConsumerProperties().isEmpty()) {
-            setProperties(camelContext, consumer, config.getConsumerProperties());
-        }
-
-        return consumer;
-    }
 }
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -36,6 +36,7 @@
        </keycloak.osgi.export>
        <keycloak.osgi.import>
            !org.keycloak.adapters.osgi.jetty94,
+            org.ops4j.pax.web.*;version="[7.1,9)",
            org.keycloak.*;version="${project.version}",
            *;resolution:=optional
        </keycloak.osgi.import>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -36,6 +36,7 @@
        </keycloak.osgi.export>
        <keycloak.osgi.import>
            !org.keycloak.adapters.osgi.tomcat,
+            org.ops4j.pax.web.*;version="[7.1,9)",
            org.keycloak.*;version="${project.version}",
            *;resolution:=optional
        </keycloak.osgi.import>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-fuse7-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -38,7 +38,7 @@
            !org.keycloak.adapters.osgi.undertow,
            org.keycloak.*;version="${project.version}",
            org.keycloak.adapters.osgi.*;version="${project.version}",
-            org.ops4j.pax.web.*;version="[3.0,8)",
+            org.ops4j.pax.web.*;version="[7.1,9)",
            javax.servlet.*;version="[2.5,4)";resolution:=optional,
            org.apache.cxf.transport.http;resolution:=optional;version="[3,4)",
            org.apache.cxf.transport.http_undertow;resolution:=optional;version="[3,4)",
@@ -65,11 +65,6 @@
            <artifactId>org.osgi.enterprise</artifactId>
            <scope>provided</scope>
        </dependency>
-        <dependency>
-            <groupId>org.ops4j.pax.web</groupId>
-            <artifactId>pax-web-runtime</artifactId>
-            <scope>provided</scope>
-        </dependency>
        <dependency>
            <groupId>org.ops4j.pax.web</groupId>
            <artifactId>pax-web-spi</artifactId>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Jetty Integration</name>
@@ -21,7 +21,7 @@
 	<parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -29,7 +29,7 @@ export = Keycloak;
 declare function Keycloak(config?: string|{}): Keycloak.KeycloakInstance;

 declare namespace Keycloak {
-	type KeycloakAdapterName = 'cordova'|'default' | any;
+	type KeycloakAdapterName = 'cordova' | 'cordova-native' |'default' | any;
 	type KeycloakOnLoad = 'login-required'|'check-sso';
 	type KeycloakResponseMode = 'query'|'fragment';
 	type KeycloakResponseType = 'code'|'id_token token'|'code id_token token';
@@ -98,6 +98,12 @@ declare namespace Keycloak {
 		 */
 		responseMode?: KeycloakResponseMode;

+		/**
+		 * Specifies a default uri to redirect to after login or logout.
+		 * This is currently supported for adapter 'cordova-native' and 'default'
+		 */
+		redirectUri?: string;
+
 		/**
 		 * Set the OpenID Connect flow.
 		 * @default standard
@@ -46,11 +46,10 @@
            kc.authenticated = false;

            callbackStorage = createCallbackStorage();
+            var adapters = ['default', 'cordova', 'cordova-native'];

-            if (initOptions && initOptions.adapter === 'cordova') {
-                adapter = loadAdapter('cordova');
-            } else if (initOptions && initOptions.adapter === 'default') {
-                adapter = loadAdapter();
+            if (initOptions && adapters.indexOf(initOptions.adapter) > -1) {
+                adapter = loadAdapter(initOptions.adapter);
            } else if (initOptions && typeof initOptions.adapter === "object") {
                adapter = initOptions.adapter;
            } else {
@@ -106,6 +105,10 @@
                if (initOptions.timeSkew != null) {
                    kc.timeSkew = initOptions.timeSkew;
                }
+
+                if(initOptions.redirectUri) {
+                    kc.redirectUri = initOptions.redirectUri;
+                }
            }

            if (!kc.responseMode) {
@@ -1339,6 +1342,75 @@
                }
            }

+            if (type == 'cordova-native') {
+                loginIframe.enable = false;
+
+                return {
+                    login: function(options) {
+                        var promise = createPromise();
+                        var loginUrl = kc.createLoginUrl(options);
+
+                        universalLinks.subscribe('keycloak', function(event) {
+                            universalLinks.unsubscribe('keycloak');
+                            window.cordova.plugins.browsertab.close();
+                            var oauth = parseCallback(event.url);
+                            processCallback(oauth, promise);
+                        });
+
+                        window.cordova.plugins.browsertab.openUrl(loginUrl);
+                        return promise.promise;
+                    },
+
+                    logout: function(options) {
+                        var promise = createPromise();
+                        var logoutUrl = kc.createLogoutUrl(options);
+
+                        universalLinks.subscribe('keycloak', function(event) {
+                            universalLinks.unsubscribe('keycloak');
+                            window.cordova.plugins.browsertab.close();
+                            kc.clearToken();
+                            promise.setSuccess();
+                        });
+
+                        window.cordova.plugins.browsertab.openUrl(logoutUrl);
+                        return promise.promise;
+                    },
+
+                    register : function(options) {
+                        var promise = createPromise();
+                        var registerUrl = kc.createRegisterUrl(options);
+                        universalLinks.subscribe('keycloak' , function(event) {
+                            universalLinks.unsubscribe('keycloak');
+                            window.cordova.plugins.browsertab.close();
+                            var oauth = parseCallback(event.url);
+                            processCallback(oauth, promise);
+                        });
+                        window.cordova.plugins.browsertab.openUrl(registerUrl);
+                        return promise.promise;
+
+                    },
+
+                    accountManagement : function() {
+                        var accountUrl = kc.createAccountUrl();
+                        if (typeof accountUrl !== 'undefined') {
+                            window.cordova.plugins.browsertab.openUrl(accountUrl);
+                        } else {
+                            throw "Not supported by the OIDC server";
+                        }
+                    },
+
+                    redirectUri: function(options) {
+                        if (options && options.redirectUri) {
+                            return options.redirectUri;
+                        } else if (kc.redirectUri) {
+                            return kc.redirectUri;
+                        } else {
+                            return "http://localhost";
+                        }
+                    }
+                }
+            }
+
            throw 'invalid adapter type: ' + type;
        }

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -77,11 +77,6 @@
            <artifactId>org.osgi.enterprise</artifactId>
            <scope>provided</scope>
        </dependency>
-        <dependency>
-            <groupId>org.ops4j.pax.web</groupId>
-            <artifactId>pax-web-runtime</artifactId>
-            <scope>provided</scope>
-        </dependency>
        <dependency>
            <groupId>org.ops4j.pax.web</groupId>
            <artifactId>pax-web-api</artifactId>
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.osgi;
+
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.jboss.logging.Logger;
+import org.keycloak.adapters.KeycloakConfigResolver;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.OIDCHttpFacade;
+
+/**
+ * This {@link KeycloakConfigResolver} tries to resolve most specific configuration for given URI path. If not found,
+ * <em>parent</em> path is checked up to top-level path.
+ */
+public class HierarchicalPathBasedKeycloakConfigResolver extends PathBasedKeycloakConfigResolver {
+
+    protected static final Logger log = Logger.getLogger(HierarchicalPathBasedKeycloakConfigResolver.class);
+
+    public HierarchicalPathBasedKeycloakConfigResolver() {
+        prepopulateCache();
+    }
+
+    @Override
+    public KeycloakDeployment resolve(OIDCHttpFacade.Request request) {
+        // we cached all available deployments initially and now we'll try to check them from
+        // most specific to most general
+        URI uri = URI.create(request.getURI());
+        String path = uri.getPath();
+        if (path != null) {
+            while (path.startsWith("/")) {
+                path = path.substring(1);
+            }
+            String[] segments = path.split("/");
+            List<String> paths = collectPaths(segments);
+            for (String pathFragment: paths) {
+                KeycloakDeployment cachedDeployment = super.getCachedDeployment(pathFragment);
+                if (cachedDeployment != null) {
+                    return cachedDeployment;
+                }
+            }
+        }
+
+        throw new IllegalStateException("Can't find Keycloak configuration related to URI path " + uri);
+    }
+
+    /**
+     * <p>For segments like "a, b, c, d", returns:<ul>
+     *     <li>"a-b-c-d"</li>
+     *     <li>"a-b-c"</li>
+     *     <li>"a-b"</li>
+     *     <li>"a"</li>
+     *     <li>""</li>
+     * </ul></p>
+     * @param segments
+     * @return
+     */
+    private List<String> collectPaths(String[] segments) {
+        List<String> result = new ArrayList<>(segments.length + 1);
+        for (int idx = segments.length; idx >= 0; idx--) {
+            StringBuilder sb = null;
+            for (int i = 0; i < idx; i++) {
+                if (sb == null) {
+                    sb = new StringBuilder();
+                }
+                sb.append("-").append(segments[i]);
+            }
+            result.add(sb == null ? "" : sb.toString().substring(1));
+        }
+        return result;
+    }
+
+}
@@ -16,12 +16,15 @@
 */
 package org.keycloak.adapters.osgi;

+import org.jboss.logging.Logger;
 import org.keycloak.adapters.KeycloakConfigResolver;
 import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.KeycloakDeploymentBuilder;
 import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.HttpFacade;

 import java.io.File;
+import java.io.FileFilter;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
 import java.io.InputStream;
@@ -31,10 +34,117 @@ import java.util.concurrent.ConcurrentHashMap;

 public class PathBasedKeycloakConfigResolver implements KeycloakConfigResolver {

+    protected static final Logger log = Logger.getLogger(PathBasedKeycloakConfigResolver.class);
+
    private final Map<String, KeycloakDeployment> cache = new ConcurrentHashMap<String, KeycloakDeployment>();

+    private File keycloakConfigLocation = null;
+
+    public PathBasedKeycloakConfigResolver() {
+        String location = null;
+        String keycloakConfig = (String) System.getProperties().get("keycloak.config");
+        if (keycloakConfig != null && !"".equals(keycloakConfig.trim())) {
+            location = keycloakConfig;
+        } else {
+            String karafEtc = (String) System.getProperties().get("karaf.etc");
+            if (karafEtc != null && !"".equals(karafEtc.trim())) {
+                location = karafEtc;
+            }
+        }
+        if (location != null) {
+            File loc = new File(location);
+            if (loc.isDirectory()) {
+                keycloakConfigLocation = loc;
+            }
+        }
+    }
+
    @Override
    public KeycloakDeployment resolve(OIDCHttpFacade.Request request) {
+        String webContext = getDeploymentKeyForURI(request);
+
+        return getOrCreateDeployment(webContext);
+    }
+
+    /**
+     * {@code pathFragment} is a key for {@link KeycloakDeployment deployments}. The key is used to construct
+     * a path relative to {@code keycloak.config} or {@code karaf.etc} system properties.
+     * For given key, {@code <key>-keycloak.json} file is checked.
+     * @param pathFragment
+     * @return
+     */
+    protected synchronized KeycloakDeployment getOrCreateDeployment(String pathFragment) {
+        KeycloakDeployment deployment = getCachedDeployment(pathFragment);
+        if (null == deployment) {
+            // not found on the simple cache, try to load it from the file system
+            if (keycloakConfigLocation == null) {
+                throw new IllegalStateException("Neither \"keycloak.config\" nor \"karaf.etc\" java properties are set." +
+                        " Please set one of them.");
+            }
+
+            File configuration = new File(keycloakConfigLocation, pathFragment + ("".equals(pathFragment) ? "" : "-")
+                    + "keycloak.json");
+            if (!cacheConfiguration(pathFragment, configuration)) {
+                throw new IllegalStateException("Not able to read the file " + configuration);
+            }
+        }
+
+        return deployment;
+    }
+
+    protected synchronized KeycloakDeployment getCachedDeployment(String pathFragment) {
+        return cache.get(pathFragment);
+    }
+
+    /**
+     * If there's a need, we can pre populate the cache of deployments.
+     */
+    protected void prepopulateCache() {
+        if (keycloakConfigLocation == null || !keycloakConfigLocation.isDirectory()) {
+            log.warn("Can't cache Keycloak configurations. No configuration storage is accessible." +
+                    " Please set either \"keycloak.config\" or \"karaf.etc\" system properties");
+            return;
+        }
+
+        File[] configs = keycloakConfigLocation.listFiles(new FileFilter() {
+            @Override
+            public boolean accept(File pathname) {
+                return pathname.isFile() && pathname.getName().endsWith("keycloak.json");
+            }
+        });
+        if (configs != null) {
+            for (File config: configs) {
+                String pathFragment = null;
+                if ("keycloak.json".equals(config.getName())) {
+                    pathFragment = "";
+                } else if (config.getName().endsWith("-keycloak.json")) {
+                    pathFragment = config.getName()
+                            .substring(0, config.getName().length() - "-keycloak.json".length());
+                }
+                cacheConfiguration(pathFragment, config);
+            }
+        }
+    }
+
+    private boolean cacheConfiguration(String key, File config) {
+        try {
+            InputStream is = new FileInputStream(config);
+            KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(is);
+            cache.put(key, deployment);
+            return true;
+        } catch (FileNotFoundException | RuntimeException e) {
+            log.warn("Can't cache " + config + ": " + e.getMessage(), e);
+            return false;
+        }
+    }
+
+    /**
+     * Finds a context path from given {@link HttpFacade.Request}. For default context, first path segment
+     * is returned.
+     * @param request
+     * @return
+     */
+    private String getDeploymentKeyForURI(HttpFacade.Request request) {
        String uri = request.getURI();
        String relativePath = request.getRelativePath();
        String webContext = null;
@@ -48,7 +158,9 @@ public class PathBasedKeycloakConfigResolver implements KeycloakConfigResolver {
        } else {
            URI parsedURI = URI.create(uri);
            String path = parsedURI.getPath();
-            path = path.substring(0, path.indexOf(relativePath));
+            if (path.contains(relativePath)) {
+                path = path.substring(0, path.indexOf(relativePath));
+            }
            while (path.startsWith("/")) {
                path = path.substring(1);
            }
@@ -65,31 +177,7 @@ public class PathBasedKeycloakConfigResolver implements KeycloakConfigResolver {
            }
        }

-        KeycloakDeployment deployment = cache.get(webContext);
-        if (null == deployment) {
-            // not found on the simple cache, try to load it from the file system
-            String keycloakConfig = (String) System.getProperties().get("keycloak.config");
-            if(keycloakConfig == null || "".equals(keycloakConfig.trim())){
-                String karafEtc = (String) System.getProperties().get("karaf.etc");
-                if(karafEtc == null || "".equals(karafEtc.trim())){
-                    throw new IllegalStateException("Neither \"keycloak.config\" nor \"karaf.etc\" java properties are set. Please set one of them.");
-                }
-                keycloakConfig = karafEtc;
-            }
-
-            String absolutePath = keycloakConfig + File.separator + webContext + ("".equals(webContext) ? "" : "-")
-                    + "keycloak.json";
-            InputStream is = null;
-            try {
-                is = new FileInputStream(absolutePath);
-            } catch (FileNotFoundException e){
-                throw new IllegalStateException("Not able to find the file " + absolutePath);
-            }
-            deployment = KeycloakDeploymentBuilder.build(is);
-            cache.put(webContext, deployment);
-        }
-
-        return deployment;
+        return webContext;
    }

 }
@@ -0,0 +1,162 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.osgi;
+
+import java.io.InputStream;
+import java.lang.reflect.Field;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.Test;
+import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.spi.AuthenticationError;
+import org.keycloak.adapters.spi.HttpFacade;
+import org.keycloak.adapters.spi.LogoutError;
+
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
+
+public class HierarchicalPathBasedKeycloakConfigResolverTest {
+
+    @Test
+    public void genericAndSpecificConfigurations() throws Exception {
+        HierarchicalPathBasedKeycloakConfigResolver resolver = new HierarchicalPathBasedKeycloakConfigResolver();
+        populate(resolver, true);
+
+        assertThat(resolver.resolve(new MockRequest("http://localhost/a/b/c/d/e?a=b")).getRealm(), equalTo("a-b-c-d-e"));
+        assertThat(resolver.resolve(new MockRequest("http://localhost/a/b/c/d/x?a=b")).getRealm(), equalTo("a-b-c-d"));
+        assertThat(resolver.resolve(new MockRequest("http://localhost/a/b/c/x/x?a=b")).getRealm(), equalTo("a-b-c"));
+        assertThat(resolver.resolve(new MockRequest("http://localhost/a/b/x/x/x?a=b")).getRealm(), equalTo("a-b"));
+        assertThat(resolver.resolve(new MockRequest("http://localhost/a/x/x/x/x?a=b")).getRealm(), equalTo("a"));
+        assertThat(resolver.resolve(new MockRequest("http://localhost/x/x/x/x/x?a=b")).getRealm(), equalTo(""));
+
+        populate(resolver, false);
+        try {
+            resolver.resolve(new MockRequest("http://localhost/x/x/x/x/x?a=b"));
+            fail("Expected java.lang.IllegalStateException: Can't find Keycloak configuration ...");
+        } catch (IllegalStateException expected) {
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    private PathBasedKeycloakConfigResolver populate(PathBasedKeycloakConfigResolver resolver, boolean fallback)
+            throws Exception {
+        Field f = PathBasedKeycloakConfigResolver.class.getDeclaredField("cache");
+        f.setAccessible(true);
+        Map<String, KeycloakDeployment> cache = (Map<String, KeycloakDeployment>) f.get(resolver);
+        cache.clear();
+        cache.put("a-b-c-d-e", newKeycloakDeployment("a-b-c-d-e"));
+        cache.put("a-b-c-d", newKeycloakDeployment("a-b-c-d"));
+        cache.put("a-b-c", newKeycloakDeployment("a-b-c"));
+        cache.put("a-b", newKeycloakDeployment("a-b"));
+        cache.put("a", newKeycloakDeployment("a"));
+        if (fallback) {
+            cache.put("", newKeycloakDeployment(""));
+        }
+
+        return resolver;
+    }
+
+    private KeycloakDeployment newKeycloakDeployment(String realm) {
+        KeycloakDeployment deployment = new KeycloakDeployment();
+        deployment.setRealm(realm);
+
+        return deployment;
+    }
+
+    private class MockRequest implements OIDCHttpFacade.Request {
+
+        private String uri;
+
+        public MockRequest(String uri) {
+            this.uri = uri;
+        }
+
+        @Override
+        public String getMethod() {
+            return null;
+        }
+
+        @Override
+        public String getURI() {
+            return this.uri;
+        }
+
+        @Override
+        public String getRelativePath() {
+            return null;
+        }
+
+        @Override
+        public boolean isSecure() {
+            return false;
+        }
+
+        @Override
+        public String getFirstParam(String param) {
+            return null;
+        }
+
+        @Override
+        public String getQueryParamValue(String param) {
+            return null;
+        }
+
+        @Override
+        public HttpFacade.Cookie getCookie(String cookieName) {
+            return null;
+        }
+
+        @Override
+        public String getHeader(String name) {
+            return null;
+        }
+
+        @Override
+        public List<String> getHeaders(String name) {
+            return null;
+        }
+
+        @Override
+        public InputStream getInputStream() {
+            return null;
+        }
+
+        @Override
+        public InputStream getInputStream(boolean buffered) {
+            return null;
+        }
+
+        @Override
+        public String getRemoteAddr() {
+            return null;
+        }
+
+        @Override
+        public void setError(AuthenticationError error) {
+
+        }
+
+        @Override
+        public void setError(LogoutError error) {
+
+        }
+    }
+
+}
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak OIDC Client Adapter Modules</name>
@@ -31,38 +31,25 @@
    <packaging>pom</packaging>

    <modules>
+        <module>adapter-core</module>
+        <module>as7-eap6</module>
+        <module>installed</module>
+        <module>fuse7</module>
+        <module>kcinit</module>
+        <module>jaxrs-oauth-client</module>
+        <module>jetty</module>
        <module>js</module>
+        <module>osgi-adapter</module>
+        <module>servlet-filter</module>
+        <module>servlet-oauth-client</module>
+        <module>spring-boot</module>
+        <module>spring-boot2</module>
+        <module>spring-boot-adapter-core</module>
+        <module>spring-boot-container-bundle</module>
+        <module>spring-security</module>
+        <module>tomcat</module>
+        <module>undertow</module>
+        <module>wildfly</module>
+        <module>wildfly-elytron</module>
    </modules>
-
-    <profiles>
-        <profile>
-            <id>nonServer</id>
-            <activation>
-                <property>
-                    <name>!serverOnly</name>
-                </property>
-            </activation>
-            <modules>
-                <module>adapter-core</module>
-                <module>as7-eap6</module>
-                <module>installed</module>
-                <module>fuse7</module>
-                <module>kcinit</module>
-                <module>jaxrs-oauth-client</module>
-                <module>jetty</module>
-                <module>osgi-adapter</module>
-                <module>servlet-filter</module>
-                <module>servlet-oauth-client</module>
-                <module>spring-boot</module>
-                <module>spring-boot2</module>
-                <module>spring-boot-adapter-core</module>
-                <module>spring-boot-container-bundle</module>
-                <module>spring-security</module>
-                <module>tomcat</module>
-                <module>undertow</module>
-                <module>wildfly</module>
-                <module>wildfly-elytron</module>
-            </modules>
-        </profile>
-    </profiles>
 </project>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.1.0.Final-SNAPSHOT</version>
+    <version>4.2.1.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -223,9 +223,12 @@ public class KeycloakBaseSpringBootConfiguration {

            for (KeycloakSpringBootProperties.SecurityConstraint constraint : keycloakProperties.getSecurityConstraints()) {
                SecurityConstraint tomcatConstraint = new SecurityConstraint();
-
                for (String authRole : constraint.getAuthRoles()) {
                    tomcatConstraint.addAuthRole(authRole);
+                    if(authRole.equals("*") || authRole.equals("**")) {
+                        // For some reasons embed tomcat don't set the auth constraint on true when wildcard is used
+                        tomcatConstraint.setAuthConstraint(true);
+                    }
                }

                for (KeycloakSpringBootProperties.SecurityCollection collection : constraint.getSecurityCollections()) {
@@ -4,7 +4,7 @@
    <parent>
      <artifactId>keycloak-parent</artifactId>
      <groupId>org.keycloak</groupId>
-      <version>4.1.0.Final-SNAPSHOT</version>
+      <version>4.2.1.Final</version>
      <relativePath>../../../pom.xml</relativePath>
    </parent>
    <artifactId>spring-boot-container-bundle</artifactId>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.1.0.Final-SNAPSHOT</version>
+    <version>4.2.1.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
  <parent>
    <artifactId>keycloak-parent</artifactId>
    <groupId>org.keycloak</groupId>
-    <version>4.1.0.Final-SNAPSHOT</version>
+    <version>4.2.1.Final</version>
    <relativePath>../../../pom.xml</relativePath>
  </parent>
  <modelVersion>4.0.0</modelVersion>
@@ -31,7 +31,7 @@
  <description/>

  <properties>
-    <spring-boot.version>2.0.0.RELEASE</spring-boot.version>
+    <spring-boot.version>2.0.3.RELEASE</spring-boot.version>
    <spring.version>5.0.2.RELEASE</spring.version>
    <mockito.version>1.9.5</mockito.version>
  </properties>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -94,11 +94,6 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
        return new KeycloakPreAuthActionsFilter(httpSessionManager());
    }

-    @Bean
-    protected KeycloakAuthenticatedActionsFilter keycloakAuthenticatedActionsFilter() {
-        return new KeycloakAuthenticatedActionsFilter();
-    }
-
    protected KeycloakCsrfRequestMatcher keycloakCsrfRequestMatcher() {
        return new KeycloakCsrfRequestMatcher();
    }
@@ -125,8 +120,8 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
                .and()
                .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
                .addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class)
-                .addFilterBefore(keycloakAuthenticatedActionsFilter(), BasicAuthenticationFilter.class)
                .addFilterAfter(keycloakSecurityContextRequestFilter(), SecurityContextHolderAwareRequestFilter.class)
+                .addFilterAfter(keycloakAuthenticatedActionsRequestFilter(), KeycloakSecurityContextRequestFilter.class)
                .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
                .and()
                .logout()
@@ -139,4 +134,9 @@ public abstract class KeycloakWebSecurityConfigurerAdapter extends WebSecurityCo
    protected KeycloakSecurityContextRequestFilter keycloakSecurityContextRequestFilter() {
        return new KeycloakSecurityContextRequestFilter();
    }
+
+    @Bean
+    protected KeycloakAuthenticatedActionsFilter keycloakAuthenticatedActionsRequestFilter() {
+        return new KeycloakAuthenticatedActionsFilter();
+    }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
 * and other contributors as indicated by the @author tags.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,7 +14,6 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-
 package org.keycloak.adapters.springsecurity.filter;

 import java.io.IOException;
@@ -26,65 +25,84 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

+import org.keycloak.KeycloakPrincipal;
+import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AuthenticatedActionsHandler;
-import org.keycloak.adapters.NodesRegistrationManagement;
+import org.keycloak.adapters.KeycloakDeployment;
 import org.keycloak.adapters.OIDCHttpFacade;
+import org.keycloak.adapters.RefreshableKeycloakSecurityContext;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.adapters.springsecurity.facade.SimpleHttpFacade;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.BeansException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.ApplicationContextAware;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.web.filter.GenericFilterBean;

 /**
- * Exposes a Keycloak adapter {@link AuthenticatedActionsHandler} as a Spring Security filter.
- *
- * @author <a href="mailto:srossillo@smartling.com">Scott Rossillo</a>
- * @version $Revision: 1 $
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
 */
 public class KeycloakAuthenticatedActionsFilter extends GenericFilterBean implements ApplicationContextAware {

-    private static final Logger log = LoggerFactory.getLogger(KeycloakAuthenticatedActionsFilter.class);
+    private static final String FILTER_APPLIED = KeycloakAuthenticatedActionsFilter.class.getPackage().getName() + ".authenticated-actions";

-    private final NodesRegistrationManagement management = new NodesRegistrationManagement();
    private ApplicationContext applicationContext;
    private AdapterDeploymentContext deploymentContext;

-    
-    public KeycloakAuthenticatedActionsFilter() {
-        super();
-    }
-
    @Override
-    protected void initFilterBean() throws ServletException {
-        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
-    }
-
-    @Override
-    public void destroy() {
-        log.debug("Unregistering deployment");
-        management.stop();
-    }
-
-    @Override
-    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-            throws IOException, ServletException {
-
-        HttpFacade facade = new SimpleHttpFacade((HttpServletRequest)request, (HttpServletResponse)response);
-        AuthenticatedActionsHandler handler = new AuthenticatedActionsHandler(deploymentContext.resolveDeployment(facade), (OIDCHttpFacade)facade);
-        boolean handled = handler.handledRequest();
-        if (handled) {
-            log.debug("Authenticated filter handled request: {}", ((HttpServletRequest) request).getRequestURI());
-        } else {
-            chain.doFilter(request, response);
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
+        if (request.getAttribute(FILTER_APPLIED) != null) {
+            filterChain.doFilter(request, response);
+            return;
        }
+
+        request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
+
+        KeycloakSecurityContext keycloakSecurityContext = getKeycloakPrincipal();
+
+        if (keycloakSecurityContext instanceof RefreshableKeycloakSecurityContext) {
+            HttpFacade facade = new SimpleHttpFacade((HttpServletRequest) request, (HttpServletResponse) response);
+            KeycloakDeployment deployment = resolveDeployment(request, response);
+            AuthenticatedActionsHandler actions = new AuthenticatedActionsHandler(deployment, OIDCHttpFacade.class.cast(facade));
+            if (actions.handledRequest()) {
+                return;
+            }
+        }
+
+        filterChain.doFilter(request, response);
+    }
+
+    @Override
+    protected void initFilterBean() {
+        deploymentContext = applicationContext.getBean(AdapterDeploymentContext.class);
    }

    @Override
    public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
        this.applicationContext = applicationContext;
    }
+
+    private KeycloakSecurityContext getKeycloakPrincipal() {
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+        if (authentication != null) {
+            Object principal = authentication.getPrincipal();
+
+            if (principal instanceof KeycloakPrincipal) {
+                return KeycloakPrincipal.class.cast(principal).getKeycloakSecurityContext();
+            }
+        }
+
+        return null;
+    }
+
+    private KeycloakDeployment resolveDeployment(ServletRequest servletRequest, ServletResponse servletResponse) {
+        return deploymentContext.resolveDeployment(new SimpleHttpFacade(HttpServletRequest.class.cast(servletRequest), HttpServletResponse.class.cast(servletResponse)));
+    }
+
+    private void clearAuthenticationContext() {
+        SecurityContextHolder.clearContext();
+    }
 }
@@ -27,7 +27,9 @@ import javax.servlet.http.HttpServletResponse;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.adapters.AdapterDeploymentContext;
 import org.keycloak.adapters.AdapterTokenStore;
+import org.keycloak.adapters.AuthenticatedActionsHandler;
 import org.keycloak.adapters.KeycloakDeployment;
+import org.keycloak.adapters.OIDCHttpFacade;
 import org.keycloak.adapters.RequestAuthenticator;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
@@ -70,6 +70,8 @@ public class KeycloakSecurityContextRequestFilter extends GenericFilterBean impl
                    clearAuthenticationContext();
                }
            }
+
+            request.setAttribute(KeycloakSecurityContext.class.getName(), keycloakSecurityContext);
        }

        filterChain.doFilter(request, response);
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak Tomcat Integration</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-tomcat-integration-pom</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -22,7 +22,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -95,5 +95,10 @@
            <artifactId>jboss-servlet-api_3.0_spec</artifactId>
            <scope>provided</scope>
        </dependency>
+        <dependency>
+            <groupId>io.undertow</groupId>
+            <artifactId>undertow-servlet</artifactId>
+            <scope>provided</scope>
+        </dependency>
    </dependencies>
 </project>
@@ -78,7 +78,7 @@ public class ElytronAccount implements OidcKeycloakAccount {
        return false;
    }

-    boolean tryRefresh(CallbackHandler callbackHandler) {
+    boolean tryRefresh() {
        log.debug("Trying to refresh");

        RefreshableKeycloakSecurityContext securityContext = getKeycloakSecurityContext();
@@ -88,14 +88,8 @@ public class ElytronAccount implements OidcKeycloakAccount {
        }

        if (securityContext.refreshExpiredToken(false)) {
-            SecurityIdentity securityIdentity = SecurityIdentityUtil.authorize(callbackHandler, principal);
-
-            if (securityIdentity != null) {
-                log.debug("refresh succeeded");
-                return true;
-            }
-
-            return false;
+            log.debug("refresh succeeded");
+            return true;
        }

        return checkActive();
@@ -88,7 +88,7 @@ public class ElytronCookieTokenStore implements ElytronTokeStore {
        boolean active = account.checkActive();

        if (!active) {
-            active = account.tryRefresh(this.callbackHandler);
+            active = account.tryRefresh();
        }

        if (active) {
@@ -18,6 +18,7 @@

 package org.keycloak.adapters.elytron;

+import io.undertow.server.handlers.CookieImpl;
 import org.bouncycastle.asn1.cmp.Challenge;
 import org.keycloak.KeycloakSecurityContext;
 import org.keycloak.adapters.AdapterDeploymentContext;
@@ -62,6 +63,8 @@ import java.util.function.Consumer;
 */
 class ElytronHttpFacade implements OIDCHttpFacade {

+    static final String UNDERTOW_EXCHANGE = ElytronHttpFacade.class.getName() + ".undertow.exchange";
+
    private final HttpServerRequest request;
    private final CallbackHandler callbackHandler;
    private final AdapterTokenStore tokenStore;
@@ -312,6 +315,17 @@ class ElytronHttpFacade implements OIDCHttpFacade {
            @Override
            public void resetCookie(final String name, final String path) {
                responseConsumer = responseConsumer.andThen(response -> setCookie(name, "", path, null, 0, false, false, response));
+                HttpScope exchangeScope = getScope(Scope.EXCHANGE);
+                ProtectedHttpServerExchange undertowExchange = ProtectedHttpServerExchange.class.cast(exchangeScope.getAttachment(UNDERTOW_EXCHANGE));
+
+                if (undertowExchange != null) {
+                    CookieImpl cookie = new CookieImpl(name, "");
+
+                    cookie.setMaxAge(0);
+                    cookie.setPath(path);
+
+                    undertowExchange.getExchange().setResponseCookie(cookie);
+                }
            }

            @Override
@@ -104,7 +104,7 @@ public class ElytronSessionTokenStore implements ElytronTokeStore {
        boolean active = account.checkActive();

        if (!active) {
-            active = account.tryRefresh(this.callbackHandler);
+            active = account.tryRefresh();
        }

        if (active) {
@@ -43,7 +43,8 @@ import java.io.InputStream;
 */
 public class KeycloakConfigurationServletListener implements ServletContextListener {

-    static final String ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE = AdapterDeploymentContext.class.getName() + ".elytron";
+    static final String ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE = AdapterDeploymentContext.class.getName();
+    static final String ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE_ELYTRON = AdapterDeploymentContext.class.getName() + ".elytron";

    @Override
    public void contextInitialized(ServletContextEvent sce) {
@@ -76,6 +77,7 @@ public class KeycloakConfigurationServletListener implements ServletContextListe
        }

        servletContext.setAttribute(ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE, deploymentContext);
+        servletContext.setAttribute(ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE_ELYTRON, deploymentContext);
    }

    @Override
@@ -126,7 +126,7 @@ class KeycloakHttpServerAuthenticationMechanism implements HttpServerAuthenticat

    private AdapterDeploymentContext getDeploymentContext(HttpServerRequest request) {
        if (this.deploymentContext == null) {
-            return (AdapterDeploymentContext) request.getScope(Scope.APPLICATION).getAttachment(KeycloakConfigurationServletListener.ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE);
+            return (AdapterDeploymentContext) request.getScope(Scope.APPLICATION).getAttachment(KeycloakConfigurationServletListener.ADAPTER_DEPLOYMENT_CONTEXT_ATTRIBUTE_ELYTRON);
        }

        return this.deploymentContext;
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.elytron;
+
+import javax.servlet.ServletContext;
+import javax.servlet.ServletRequest;
+
+import io.undertow.server.HttpHandler;
+import io.undertow.servlet.ServletExtension;
+import io.undertow.servlet.api.DeploymentInfo;
+import io.undertow.servlet.handlers.ServletRequestContext;
+
+/**
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public class KeycloakServletExtension implements ServletExtension {
+
+    @Override
+    public void handleDeployment(DeploymentInfo deploymentInfo, ServletContext servletContext) {
+        deploymentInfo.addOuterHandlerChainWrapper(handler -> (HttpHandler) exchange -> {
+            ServletRequest servletRequest = exchange.getAttachment(ServletRequestContext.ATTACHMENT_KEY).getServletRequest();
+
+            servletRequest.setAttribute(ElytronHttpFacade.UNDERTOW_EXCHANGE, new ProtectedHttpServerExchange(exchange));
+
+            handler.handleRequest(exchange);
+        });
+    }
+}
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.adapters.elytron;
+
+import io.undertow.server.HttpServerExchange;
+
+/**
+ * <p>A wrapper for {@code {@link HttpServerExchange}} accessible only from classes in the same package.
+ *
+ * <p>This class is used to provide to the elytron mechanism access to the current exchange in order to allow making
+ * changes to the exchange (e.g. response) during the evaluation of requests. By default, changes to the exchange are only
+ * propagated after the execution of the mechanism. But in certain situations, such as when making a programmatic logout (HttpServletRequest.logout()) from
+ * within application code, any change made to the exchange is not propagated.
+ *
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+class ProtectedHttpServerExchange {
+
+    private final HttpServerExchange exchange;
+
+    public ProtectedHttpServerExchange(HttpServerExchange exchange) {
+        this.exchange = exchange;
+    }
+
+    HttpServerExchange getExchange() {
+        return exchange;
+    }
+}
@@ -0,0 +1,52 @@
+#
+# * Copyright 2018 Red Hat, Inc. and/or its affiliates
+# * and other contributors as indicated by the @author tags.
+# *
+# * Licensed under the Apache License, Version 2.0 (the "License");
+# * you may not use this file except in compliance with the License.
+# * You may obtain a copy of the License at
+# *
+# * http://www.apache.org/licenses/LICENSE-2.0
+# *
+# * Unless required by applicable law or agreed to in writing, software
+# * distributed under the License is distributed on an "AS IS" BASIS,
+# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# * See the License for the specific language governing permissions and
+# * limitations under the License.
+#
+
+#
+# * Copyright 2018 Red Hat, Inc. and/or its affiliates
+# * and other contributors as indicated by the @author tags.
+# *
+# * Licensed under the Apache License, Version 2.0 (the "License");
+# * you may not use this file except in compliance with the License.
+# * You may obtain a copy of the License at
+# *
+# * http://www.apache.org/licenses/LICENSE-2.0
+# *
+# * Unless required by applicable law or agreed to in writing, software
+# * distributed under the License is distributed on an "AS IS" BASIS,
+# * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# * See the License for the specific language governing permissions and
+# * limitations under the License.
+#
+
+#
+# Copyright 2016 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+org.keycloak.adapters.elytron.KeycloakServletExtension
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak WildFly Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -187,6 +187,13 @@ public class SharedAttributeDefinitons {
            .setDefaultValue(new ModelNode(false))
            .build();

+    protected static final SimpleAttributeDefinition PROXY_URL =
+            new SimpleAttributeDefinitionBuilder("proxy-url", ModelType.STRING, true)
+                    .setXmlName("proxy-url")
+                    .setAllowExpression(true)
+                    .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
+                    .build();
+
    protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
    static {
        ATTRIBUTES.add(REALM_PUBLIC_KEY);
@@ -214,6 +221,7 @@ public class SharedAttributeDefinitons {
        ATTRIBUTES.add(PRINCIPAL_ATTRIBUTE);
        ATTRIBUTES.add(AUTODETECT_BEARER_ONLY);
        ATTRIBUTES.add(IGNORE_OAUTH_QUERY_PARAMETER);
+        ATTRIBUTES.add(PROXY_URL);
    }

    /**
@@ -49,6 +49,7 @@ keycloak.realm.token-store=cookie or session storage for auth session data
 keycloak.realm.principal-attribute=token attribute to use to set Principal name
 keycloak.realm.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.realm.ignore-oauth-query-parameter=disable query parameter parsing for access_token
+keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.

 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -88,7 +89,7 @@ keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh t
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
 keycloak.secure-deployment.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.secure-deployment.ignore-oauth-query-parameter=disable query parameter parsing for access_token
-
+keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.
 keycloak.secure-deployment.credential=Credential value

 keycloak.credential=Credential
@@ -68,6 +68,7 @@
            <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
            <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
            <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -113,6 +114,7 @@
            <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
            <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
            <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -28,6 +28,7 @@
        </realm-public-key>
        <auth-server-url>http://localhost:8080/auth</auth-server-url>
        <ssl-required>EXTERNAL</ssl-required>
+        <proxy-url>http://localhost:9000</proxy-url>
        <credential name="secret">0aa31d98-e0aa-404c-b6e0-e771dba1e798</credential>
    </secure-deployment>
    <secure-deployment name="http-endpoint">
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-parent</artifactId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../../pom.xml</relativePath>
    </parent>

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2018 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.subsystem.adapter.extension;
+
+import org.jboss.as.server.deployment.DeploymentPhaseContext;
+import org.jboss.as.server.deployment.DeploymentUnit;
+import org.jboss.as.web.common.WarMetaData;
+import org.jboss.metadata.web.jboss.JBossWebMetaData;
+import org.jboss.msc.service.ServiceName;
+
+/**
+ * Utility class for Elytron integration
+ *
+ * @author <a href="mailto:psilva@redhat.com">Pedro Igor</a>
+ */
+public final class Elytron {
+
+    private static final String DEFAULT_SECURITY_DOMAIN = "other";
+    private static final String UNDERTOW_APPLICATION_SECURITY_DOMAIN = "org.wildfly.undertow.application-security-domain.";
+
+    static boolean isElytronEnabled(DeploymentPhaseContext phaseContext) {
+        String securityDomain = getSecurityDomain(phaseContext.getDeploymentUnit());
+        ServiceName serviceName = ServiceName.parse(new StringBuilder(UNDERTOW_APPLICATION_SECURITY_DOMAIN).append(securityDomain).toString());
+        return phaseContext.getServiceRegistry().getService(serviceName) != null;
+    }
+
+    private static String getSecurityDomain(DeploymentUnit deploymentUnit) {
+        WarMetaData warMetaData = deploymentUnit.getAttachment(WarMetaData.ATTACHMENT_KEY);
+
+        if (warMetaData != null) {
+            JBossWebMetaData webMetaData = warMetaData.getMergedJBossWebMetaData();
+
+            if (webMetaData != null) {
+                String configuredSecurityDomain = webMetaData.getSecurityDomain();
+
+                if (configuredSecurityDomain != null) {
+                    return configuredSecurityDomain;
+                }
+            }
+        }
+
+        return DEFAULT_SECURITY_DOMAIN;
+    }
+}
@@ -17,6 +17,8 @@

 package org.keycloak.subsystem.adapter.extension;

+import static org.keycloak.subsystem.adapter.extension.Elytron.isElytronEnabled;
+
 import org.jboss.as.server.deployment.DeploymentPhaseContext;
 import org.jboss.as.server.deployment.DeploymentUnit;
 import org.jboss.as.server.deployment.DeploymentUnitProcessingException;
@@ -73,7 +75,7 @@ public class KeycloakAdapterConfigDeploymentProcessor implements DeploymentUnitP
            addKeycloakAuthData(phaseContext, service);
        }

-        addConfigurationListener(deploymentUnit);
+        addConfigurationListener(phaseContext);

        // FYI, Undertow Extension will find deployments that have auth-method set to KEYCLOAK

@@ -125,7 +127,8 @@ public class KeycloakAdapterConfigDeploymentProcessor implements DeploymentUnitP
        webMetaData.setContextParams(contextParams);
    }

-    private void addConfigurationListener(DeploymentUnit deploymentUnit) {
+    private void addConfigurationListener(DeploymentPhaseContext phaseContext) {
+        DeploymentUnit deploymentUnit = phaseContext.getDeploymentUnit();
        WarMetaData warMetaData = deploymentUnit.getAttachment(WarMetaData.ATTACHMENT_KEY);
        if (warMetaData == null) {
            return;
@@ -144,16 +147,18 @@ public class KeycloakAdapterConfigDeploymentProcessor implements DeploymentUnitP
        if (!loginConfig.getAuthMethod().equals("KEYCLOAK")) {
            return;
        }
-        ListenerMetaData listenerMetaData = new ListenerMetaData();

-        listenerMetaData.setListenerClass(KeycloakConfigurationServletListener.class.getName());
+        if (isElytronEnabled(phaseContext)) {
+            ListenerMetaData listenerMetaData = new ListenerMetaData();

-        webMetaData.getListeners().add(listenerMetaData);
+            listenerMetaData.setListenerClass(KeycloakConfigurationServletListener.class.getName());
+
+            webMetaData.getListeners().add(listenerMetaData);
+        }
    }

    @Override
    public void undeploy(DeploymentUnit du) {

    }
-
 }
@@ -63,7 +63,7 @@ public abstract class KeycloakDependencyProcessor implements DeploymentUnitProce
        final ModuleSpecification moduleSpecification = deploymentUnit.getAttachment(Attachments.MODULE_SPECIFICATION);
        final ModuleLoader moduleLoader = Module.getBootModuleLoader();
        addCommonModules(moduleSpecification, moduleLoader);
-        addPlatformSpecificModules(moduleSpecification, moduleLoader);
+        addPlatformSpecificModules(phaseContext, moduleSpecification, moduleLoader);
    }
    
    private void addCommonModules(ModuleSpecification moduleSpecification, ModuleLoader moduleLoader) {
@@ -74,7 +74,7 @@ public abstract class KeycloakDependencyProcessor implements DeploymentUnitProce
        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_COMMON, false, false, false, false));
    }

-    abstract protected void addPlatformSpecificModules(ModuleSpecification moduleSpecification, ModuleLoader moduleLoader);
+    abstract protected void addPlatformSpecificModules(DeploymentPhaseContext phaseContext, ModuleSpecification moduleSpecification, ModuleLoader moduleLoader);

    @Override
    public void undeploy(DeploymentUnit du) {
@@ -17,6 +17,9 @@

 package org.keycloak.subsystem.adapter.extension;

+import static org.keycloak.subsystem.adapter.extension.Elytron.isElytronEnabled;
+
+import org.jboss.as.server.deployment.DeploymentPhaseContext;
 import org.jboss.as.server.deployment.module.ModuleDependency;
 import org.jboss.as.server.deployment.module.ModuleSpecification;
 import org.jboss.modules.ModuleIdentifier;
@@ -34,9 +37,12 @@ public class KeycloakDependencyProcessorWildFly extends KeycloakDependencyProces
    private static final ModuleIdentifier KEYCLOAK_UNDERTOW_ADAPTER = ModuleIdentifier.create("org.keycloak.keycloak-undertow-adapter");

    @Override
-    protected void addPlatformSpecificModules(ModuleSpecification moduleSpecification, ModuleLoader moduleLoader) {
-        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_WILDFLY_ADAPTER, false, false, true, false));
-        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_UNDERTOW_ADAPTER, false, false, false, false));
-        moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_ELYTRON_ADAPTER, true, false, false, false));
+    protected void addPlatformSpecificModules(DeploymentPhaseContext phaseContext, ModuleSpecification moduleSpecification, ModuleLoader moduleLoader) {
+        if (isElytronEnabled(phaseContext)) {
+            moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_ELYTRON_ADAPTER, true, false, true, false));
+        } else {
+            moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_WILDFLY_ADAPTER, false, false, true, false));
+            moduleSpecification.addSystemDependency(new ModuleDependency(moduleLoader, KEYCLOAK_UNDERTOW_ADAPTER, false, false, false, false));
+        }
    }
 }
@@ -193,6 +193,13 @@ public class SharedAttributeDefinitons {
                    .setDefaultValue(new ModelNode(8443))
                    .build();

+    protected static final SimpleAttributeDefinition PROXY_URL =
+            new SimpleAttributeDefinitionBuilder("proxy-url", ModelType.STRING, true)
+                    .setXmlName("proxy-url")
+                    .setAllowExpression(true)
+                    .setValidator(new StringLengthValidator(1, Integer.MAX_VALUE, true, true))
+                    .build();
+

    protected static final List<SimpleAttributeDefinition> ATTRIBUTES = new ArrayList<SimpleAttributeDefinition>();
    static {
@@ -222,6 +229,7 @@ public class SharedAttributeDefinitons {
        ATTRIBUTES.add(PRINCIPAL_ATTRIBUTE);
        ATTRIBUTES.add(AUTODETECT_BEARER_ONLY);
        ATTRIBUTES.add(IGNORE_OAUTH_QUERY_PARAMETER);
+        ATTRIBUTES.add(PROXY_URL);
    }

    private static boolean isSet(ModelNode attributes, SimpleAttributeDefinition def) {
@@ -52,6 +52,7 @@ keycloak.realm.token-store=cookie or session storage for auth session data
 keycloak.realm.principal-attribute=token attribute to use to set Principal name
 keycloak.realm.autodetect-bearer-only=autodetect bearer-only requests
 keycloak.realm.ignore-oauth-query-parameter=disable query parameter parsing for access_token
+keycloak.realm.proxy-url=The URL for the HTTP proxy if one is used.

 keycloak.secure-deployment=A deployment secured by Keycloak
 keycloak.secure-deployment.add=Add a deployment to be secured by Keycloak
@@ -93,6 +94,7 @@ keycloak.secure-deployment.turn-off-change-session-id-on-login=The session id is
 keycloak.secure-deployment.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-deployment.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
 keycloak.secure-deployment.ignore-oauth-query-parameter=disable query parameter parsing for access_token
+keycloak.secure-deployment.proxy-url=The URL for the HTTP proxy if one is used.

 keycloak.secure-server=A deployment secured by Keycloak
 keycloak.secure-server.add=Add a deployment to be secured by Keycloak
@@ -134,6 +136,7 @@ keycloak.secure-server.turn-off-change-session-id-on-login=The session id is cha
 keycloak.secure-server.token-minimum-time-to-live=The adapter will refresh the token if the current token is expired OR will expire in 'token-minimum-time-to-live' seconds or less
 keycloak.secure-server.min-time-between-jwks-requests=If adapter recognize token signed by unknown public key, it will try to download new public key from keycloak server. However it won't try to download if already tried it in less than 'min-time-between-jwks-requests' seconds
 keycloak.secure-server.ignore-oauth-query-parameter=disable query parameter parsing for access_token
+keycloak.secure-server.proxy-url=The URL for the HTTP proxy if one is used.

 keycloak.secure-deployment.credential=Credential value
 keycloak.secure-server.credential=Credential value
@@ -70,6 +70,7 @@
            <xs:element name="principal-attribute" type="xs:string" minOccurs="0" maxOccurs="1"/>
            <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
            <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -117,6 +118,7 @@
            <xs:element name="min-time-between-jwks-requests" type="xs:integer" minOccurs="0" maxOccurs="1"/>
            <xs:element name="autodetect-bearer-only" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
            <xs:element name="ignore-oauth-query-parameter" type="xs:boolean" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="proxy-url" type="xs:string" minOccurs="0" maxOccurs="1"/>
        </xs:all>
        <xs:attribute name="name" type="xs:string" use="required">
            <xs:annotation>
@@ -40,6 +40,7 @@
        <register-node-period>60</register-node-period>
        <token-store>session</token-store>
        <principal-attribute>sub</principal-attribute>
+        <proxy-url>http://localhost:9000</proxy-url>
    </realm>
    <realm name="jboss-infra">
        <realm-public-key>MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqKoq+a9MgXepmsPJDmo45qswuChW9pWjanX68oIBuI4hGvhQxFHryCow230A+sr7tFdMQMt8f1l/ysmV/fYAuW29WaoY4kI4Ou1yYPuwywKSsxT6PooTs83hKyZ1h4LZMj5DkLGDDDyVRHob2WmPaYg9RGVRw3iGGsD/p+Yb+L/gnBYQnZZ7lYqmN7h36p5CkzzlgXQA1Ha8sQxL+rJNH8+sZm0vBrKsoII3Of7TqHGsm1RwFV3XCuGJ7S61AbjJMXL5DQgJl9Z5scvxGAyoRLKC294UgMnQdzyBTMPw2GybxkRKmiK2KjQKmcopmrJp/Bt6fBR6ZkGSs9qUlxGHgwIDAQAB</realm-public-key>
@@ -58,6 +59,7 @@
        <auth-server-url>http://localhost:8080/auth</auth-server-url>
        <ssl-required>EXTERNAL</ssl-required>
        <confidential-port>443</confidential-port>
+        <proxy-url>http://localhost:9000</proxy-url>
        <credential name="secret">0aa31d98-e0aa-404c-b6e0-e771dba1e798</credential>
        <redirect-rewrite-rule name="^/wsmaster/api/(.*)$">api/$1/</redirect-rewrite-rule>
    </secure-deployment>
@@ -88,5 +90,6 @@
        <public-client>true</public-client>
        <ssl-required>EXTERNAL</ssl-required>
        <confidential-port>443</confidential-port>
+        <proxy-url>http://localhost:9000</proxy-url>
    </secure-server>
 </subsystem>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <name>Keycloak Adapters</name>
@@ -31,21 +31,8 @@
    <packaging>pom</packaging>

    <modules>
+        <module>spi</module>
+        <module>saml</module>
        <module>oidc</module>
    </modules>
-
-    <profiles>
-        <profile>
-            <id>nonServer</id>
-            <activation>
-                <property>
-                    <name>!serverOnly</name>
-                </property>
-            </activation>
-            <modules>
-                <module>spi</module>
-                <module>saml</module>
-            </modules>
-        </profile>
-    </profiles>
 </project>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML EAP Integration</name>
@@ -21,7 +21,7 @@
    <parent>
        <groupId>org.keycloak</groupId>
        <artifactId>keycloak-saml-eap-integration-pom</artifactId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../pom.xml</relativePath>
    </parent>

@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <modelVersion>4.0.0</modelVersion>
@@ -25,12 +25,21 @@ import org.keycloak.adapters.spi.HttpFacade;
 */
 public class SamlDeploymentContext {
    private SamlDeployment deployment = null;
+    private SamlConfigResolver resolver = null;

    public SamlDeploymentContext(SamlDeployment deployment) {
        this.deployment = deployment;
    }

+    public SamlDeploymentContext(SamlConfigResolver resolver) {
+        this.resolver = resolver;
+    }
+
    public SamlDeployment resolveDeployment(HttpFacade facade) {
-        return deployment;
+        if (deployment != null) {
+            return deployment;
+        } else {
+            return resolver.resolve(facade.getRequest());
+        }
    }
 }
@@ -339,7 +339,7 @@ public abstract class AbstractSamlAuthenticationHandler implements SamlAuthentic
            return AuthOutcome.FAILED;
        }
        try {
-            assertion = AssertionUtil.getAssertion(responseType, deployment.getDecryptionKey());
+            assertion = AssertionUtil.getAssertion(responseHolder, responseType, deployment.getDecryptionKey());
            if (AssertionUtil.hasExpired(assertion)) {
                return initiateLogin();
            }
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
 		<relativePath>../../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Jetty Integration</name>
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Client Adapter Modules</name>
@@ -21,7 +21,7 @@
    <parent>
 		<artifactId>keycloak-parent</artifactId>
 		<groupId>org.keycloak</groupId>
-		<version>4.1.0.Final-SNAPSHOT</version>
+		<version>4.2.1.Final</version>
 		<relativePath>../../../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
@@ -19,6 +19,7 @@ package org.keycloak.adapters.saml.servlet;

 import org.keycloak.adapters.saml.DefaultSamlDeployment;
 import org.keycloak.adapters.saml.SamlAuthenticator;
+import org.keycloak.adapters.saml.SamlConfigResolver;
 import org.keycloak.adapters.saml.SamlDeployment;
 import org.keycloak.adapters.saml.SamlDeploymentContext;
 import org.keycloak.adapters.saml.SamlSession;
@@ -52,6 +53,7 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import java.util.regex.Pattern;

 /**
 * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -61,6 +63,7 @@ public class SamlFilter implements Filter {
    protected SamlDeploymentContext deploymentContext;
    protected SessionIdMapper idMapper;
    private final static Logger log = Logger.getLogger("" + SamlFilter.class);
+    private static final Pattern PROTOCOL_PATTERN = Pattern.compile("^[a-zA-Z][a-zA-Z0-9+.-]*:");

    @Override
    public void init(final FilterConfig filterConfig) throws ServletException {
@@ -72,15 +75,12 @@ public class SamlFilter implements Filter {
        String configResolverClass = filterConfig.getInitParameter("keycloak.config.resolver");
        if (configResolverClass != null) {
            try {
-                throw new RuntimeException("Not implemented yet");
-                // KeycloakConfigResolver configResolver = (KeycloakConfigResolver)
-                // context.getLoader().getClassLoader().loadClass(configResolverClass).newInstance();
-                // deploymentContext = new SamlDeploymentContext(configResolver);
-                // log.log(Level.INFO, "Using {0} to resolve Keycloak configuration on a per-request basis.",
-                // configResolverClass);
+                SamlConfigResolver configResolver = (SamlConfigResolver) getClass().getClassLoader().loadClass(configResolverClass).newInstance();
+                deploymentContext = new SamlDeploymentContext(configResolver);
+                log.log(Level.INFO, "Using {0} to resolve Keycloak configuration on a per-request basis.", configResolverClass);
            } catch (Exception ex) {
-                log.log(Level.FINE, "The specified resolver {0} could NOT be loaded. Keycloak is unconfigured and will deny all requests. Reason: {1}", new Object[] { configResolverClass, ex.getMessage() });
-                // deploymentContext = new AdapterDeploymentContext(new KeycloakDeployment());
+                log.log(Level.WARNING, "The specified resolver {0} could NOT be loaded. Keycloak is unconfigured and will deny all requests. Reason: {1}", new Object[] { configResolverClass, ex.getMessage() });
+                deploymentContext = new SamlDeploymentContext(new DefaultSamlDeployment());
            }
        } else {
            String fp = filterConfig.getInitParameter("keycloak.config.file");
@@ -137,7 +137,7 @@ public class SamlFilter implements Filter {
        }
        FilterSamlSessionStore tokenStore = new FilterSamlSessionStore(request, facade, 100000, idMapper);
        boolean isEndpoint = request.getRequestURI().substring(request.getContextPath().length()).endsWith("/saml");
-        SamlAuthenticator authenticator = null;
+        SamlAuthenticator authenticator;
        if (isEndpoint) {
            authenticator = new SamlAuthenticator(facade, deployment, tokenStore) {
                @Override
@@ -176,9 +176,15 @@ public class SamlFilter implements Filter {
        }
        if (outcome == AuthOutcome.LOGGED_OUT) {
            tokenStore.logoutAccount();
-            if (deployment.getLogoutPage() != null) {
-                RequestDispatcher disp = req.getRequestDispatcher(deployment.getLogoutPage());
-                disp.forward(req, res);
+            String logoutPage = deployment.getLogoutPage();
+            if (logoutPage != null) {
+                if (PROTOCOL_PATTERN.matcher(logoutPage).find()) {
+                    response.sendRedirect(logoutPage);
+                    log.log(Level.FINE, "Redirected to logout page {0}", logoutPage);
+                } else {
+                    RequestDispatcher disp = req.getRequestDispatcher(logoutPage);
+                    disp.forward(req, res);
+                }
                return;
            }
            chain.doFilter(req, res);
@@ -20,7 +20,7 @@
    <parent>
        <artifactId>keycloak-parent</artifactId>
        <groupId>org.keycloak</groupId>
-        <version>4.1.0.Final-SNAPSHOT</version>
+        <version>4.2.1.Final</version>
        <relativePath>../../../pom.xml</relativePath>
    </parent>
    <name>Keycloak SAML Tomcat Integration</name>
Author	SHA1	Message	Date
keycloak-bot	c97faa93a5	Set version to 4.2.1.Final	2018-08-02 15:46:28 +00:00
Hynek Mlnarik	5b84c78ca2	KEYCLOAK-7986 Fix realm definition	2018-08-02 16:55:58 +02:00
Hiroyuki Wada	ad01100722	KEYCLOAK-7984 Fix migration issue	2018-08-02 16:55:41 +02:00
alva.huang	e8246f99df	[KEYCLOAK-7985] fix the table name error, from RESOURCE_URI to RESOURCE_URIS Signed-off-by: alva.huang <alva@izhiju.cn>	2018-08-02 16:55:25 +02:00
mposolda	a2afe7c205	KEYCLOAK-7977 Release failing due the NPE during swagger2markup-maven-plugin execution	2018-07-31 22:05:34 +02:00
Cedric Veilleux	f32e258a18	i18n : Unicode encoding issue in french email One accentuated character was missing unicode escaping in french reset email translation.	2018-07-31 21:55:34 +02:00
Takashi Norimatsu	665bcaebbb	KEYCLOAK-7959 OAuth 2.0 Certificate Bound Access Tokens in Rev Proxy	2018-07-31 21:53:46 +02:00
Hiroyuki Wada	398f7d950f	KEYCLOAK-7910 Store credentials when updating user via Admin REST API	2018-07-31 15:36:21 +02:00
Martin Kanis	e6ad0d63a1	KEYCLOAK-7974 Fix typo in remove credentials alert	2018-07-31 15:29:50 +02:00
Martin Kanis	f0808d6882	KEYCLOAK-7973 Possibility to add classpath elements to KeycloakServer	2018-07-31 14:32:58 +02:00
Martin Kanis	a4fd7e9f7f	KEYCLOAK-6308 Disable secret question credentials fails	2018-07-31 12:15:48 +02:00
Hynek Mlnarik	7a978ff3f6	KEYCLOAK-4407 Execute cross-dc tests selectively in travis	2018-07-31 10:30:38 +02:00
mhajas	9b0930a289	KEYCLOAK-7792 Add tests for fragment in redirect URL	2018-07-31 10:24:58 +02:00
Takashi Mogi	959e7b1b01	KEYCLOAK-7201 OIDC Identity Brokering with Client parameter forward Forward "custom" (non-standard) query parameters to external IDP	2018-07-31 10:18:29 +02:00
ssilvert@win.redhat.com	40cc826586	Fix test side effect.	2018-07-30 13:15:02 -04:00
ssilvert@win.redhat.com	6c593bab5a	Check credential confirmation on server side.	2018-07-30 13:15:02 -04:00
Timothy Lee	9c18d0e628	remove a redundant div end tag	2018-07-30 18:41:03 +02:00
vramikandHynek Mlnarik	ecd3fcc0af	KEYCLOAK-7924 Speed-up crossdc tests Co-Authored-By: Hynek Mlnarik <hmlnarik@redhat.com>	2018-07-27 20:53:58 +02:00
vramik	38017d3cec	KEYCLOAK-4407 Ability to restart arquillian containers from test Co-Authored-By: Hynek Mlnarik <hmlnarik@redhat.com> KEYCLOAK-4407 Fix connection error if underlying container restarts (63b9da857a8174a0b5e65e70c47ef2e2842f4d4e)	2018-07-27 20:53:58 +02:00
Tair Sabirgaliev	d88568266f	KEYCLOAK-7821 Enable tomcat-specific features: `` (all roles), `*` (authenticated user) in `authRoles` constraint	2018-07-27 14:24:49 +02:00
Hynek Mlnarik	f43519a16e	KEYCLOAK-6708 Fix NPE when email not set for email NameIDFormat	2018-07-27 11:10:35 +02:00
fisache	771d7f1724	[KEYCLOAK-7872] Fix. Remove Identity Provider Mapper when remove identity provider	2018-07-26 08:45:26 +02:00
ssilvert@win.redhat.com	0844aa8d68	KEYCLOAK-7857: Fix notifications	2018-07-25 08:59:25 -04:00
ssilvert@win.redhat.com	d73c4288ae	KEYCLOAK-7294: Password page - Angular	2018-07-25 08:59:25 -04:00
vramik	9c1a411c6e	KEYCLOAK-7310 Add migration test from 3.4.x to 4.x	2018-07-25 13:48:02 +02:00
Tomas Kyjovsky	8eabd4ae89	KEYCLOAK-7934 Dataset generator cannot create "empty" mappings	2018-07-24 23:53:48 +02:00
vramik	524ab44160	KEYCLOAK-6866 Error 404 after changing locale while authenticating using X.509	2018-07-24 17:24:32 +02:00
Tomas Kyjovsky	ea8eaaff07	KEYCLOAK-7599 Improve handling of test datasets	2018-07-24 15:07:32 +02:00
mhajas	a6e4f4f9aa	KEYCLOAK-7922 Use Time.currentTimeMillis() instead of System.currentTimeMillis() in PathCache	2018-07-24 08:52:48 -03:00
Daniil Filippov	af72c1374a	KEYCLOAK-7823 Fix HTTP status returned during SPNEGO auth	2018-07-24 10:38:42 +02:00
Hiroyuki Wada	7c0ca9aad2	KEYCLOAK-6313 Add required action's priority for customizing the execution order	2018-07-23 22:21:04 +02:00
Hynek Mlnarik	b43392bac8	KEYCLOAK-6577 KEYCLOAK-5609 Support dot in claim names by escaping with backslash	2018-07-23 14:46:25 +02:00
Hynek Mlnarik	c8bc0d6d7b	KEYCLOAK-7400 Remove dead code This commit can only be merged once the Camel 2.21.2 would be released, otherwise the code won't compile due to missing dependencies. See https://issues.apache.org/jira/browse/CAMEL-12514 for details.	2018-07-23 14:46:00 +02:00
Peter Zaoral	c4b375c1fc	KEYCLOAK-7802 Fix broken HoKTest Signed-off-by: Peter Zaoral <pzaoral@redhat.com>	2018-07-23 12:30:54 +02:00
mhajas	1308a3231d	KEYCLOAK-7931 Correct wrong JPA changelog filenames	2018-07-23 11:49:54 +02:00
pskopek	2eefd60344	[KEYCLOAK-7898] Align versions to match EAP 7.1.4.CR1	2018-07-20 21:32:48 +02:00
sebastienblanc	5472364265	fixed the bom	2018-07-20 10:02:20 +02:00
Hynek Mlnarik	26bf7f251d	KEYCLOAK-7888 Update Fuse adapter examples to new CXF registration	2018-07-19 15:22:42 +02:00
Pedro Igor	7c14a6a503	[KEYCLOAK-6547] - AuthenticatedActionsHandler should process responses after identity is established	2018-07-19 10:05:04 -03:00
Pedro Igor	acc5f5c6d1	[KEYCLOAK-7864] - Authorization claim not set in refresh token when issuing a new refresh token	2018-07-19 09:56:59 -03:00
Grzegorz Grzybek	2cb7ec9432	[KEYCLOAK-7703] HierarchicalPathBasedKeycloakConfigResolver for more fine/coarse grained Keycloak configuration in Karaf	2018-07-19 14:25:52 +02:00
Pedro Igor	8b6979ac18	[KEYCLOAK-7849] - Improvements to RPT upgrade	2018-07-18 16:40:55 -03:00
Martin Kanis	34407957b9	KEYCLOAK-6314 Internal server error after T&C rejection	2018-07-18 15:05:22 +02:00
Jannik Hüls	44f5cf3020	KEYCLOAK-6707 change verfiyEmail tooltip	2018-07-18 09:14:41 -03:00
vramik	54fcbf12b0	KEYCLOAK-7666 - adapter tests - eap6-fuse6 provider	2018-07-18 13:46:56 +02:00
wyvie	31f6cf9ab5	[KEYCLOAK-7868] fix correct condition for spring boot tests Also ignore the AccountLinkSpringBootTest#testErrorConditions for now until we have a clue why it does not work as intended	2018-07-18 13:46:07 +02:00
Gregor Tudan	3417b569c0	KEYCLOAK-2606: add support for native browsers on cordova KEYCLOAK-2606 Added cordova native KEYCLOAK-2606 Some more fixes and tweaks Fix redirect in example realm feature(cordova-native): fix universalLinks and kc options Added 'cordova-native' to typings Added an option to define a "default" redirectUri in keycloak.js Added 'login' and 'logout' event to universalLinks configuration in config.xml Improved 'cordova-native' example to always use a redirectUri and update state after successfull logout Setting the 'authenticated' flag for the keycloak instance to 'false' after a logout redirect KEYCLOAK-2606: Simplify example for cordova-native I wanted to make it explicit which options are actually needed, so I didn't want to reuse the keycloak conf KEYCLOAK-2606: simplify example The update state after logout shouldn't be necessary as it is set in `keycloak.onAuthLogout = updateState;` Not sure why it is called after the login promise... Fixes	2018-07-18 10:51:59 +02:00
vramik	8e20986335	KEYCLOAK-7876 Improve stability of fuse7 hawtio test	2018-07-18 10:51:32 +02:00
ssilvert@win.redhat.com	385e1c6122	KEYCLOAK-7846: Add missing features.ts file	2018-07-17 12:44:06 -04:00
ssilvert@win.redhat.com	3e158c0321	KEYCLOAK-7846: Turn off disallowed features	2018-07-17 12:44:06 -04:00
ssilvert@win.redhat.com	c969c4c903	Cleanup console.log	2018-07-17 12:43:20 -04:00
ssilvert@win.redhat.com	8533bc7f00	KEYCLOAK-7795: "Back to <app>" missing from Welcome Page	2018-07-17 12:43:20 -04:00
ssilvert@win.redhat.com	2adff375db	KEYCLOAK-7497: Remove babel transpiler. Use UMD files from patternfly-ng.	2018-07-17 12:42:14 -04:00
ssilvert@win.redhat.com	d959e501ae	KEYCLOAK-7524: Vertical Nav doesn't close on secondary click	2018-07-17 12:42:14 -04:00
Phani Kiran Thaticharla	886362ebf2	Fixed typo in misc/Testsuite.md	2018-07-17 10:05:05 +02:00
wyvie	8e221ea597	[KEYCLOAK-7835] BrokerLinkAndTokenExchangeTest turned off Until TOKEN_ECHANGE is enabled (means currently turned off for prod profile)	2018-07-16 10:27:56 +02:00
mhajas	432ea277a7	KEYCLOAK-7816 Assume preview profile in authz tests	2018-07-13 12:53:46 -03:00
Martin Kanis	b520dda3ef	KEYCLOAK-4662 Keycloak adapter missing configuration attribute proxy-url	2018-07-13 14:30:40 +02:00
Pedro Igor	90bfa2bff5	[KEYCLOAK-7781] - More validations to authorization requests	2018-07-13 09:18:05 -03:00
Pedro Igor	3fc6eed1ce	[KEYCLOAK-7827] - Missing org.jboss.logging dependency to keycloak-authz-client module	2018-07-13 09:17:49 -03:00
Juravenator	fbbc670d1f	KEYCLOAK-7854: Tiny typo in ExampleServiceImpl.java	2018-07-13 09:11:17 -03:00
stianst	f022bc1269	[KEYCLOAK-5629] Add credential endpoints to account service	2018-07-12 13:00:25 -04:00
mhajas	5aebc74f8c	KEYCLOAK-7269 Setting more uris for Authorization Resource	2018-07-11 17:48:34 -03:00
Tommy Cheng	fba2bf0b2f	[KEYCLOAK-7822] - Fix access token and refresh token timeout in resource server	2018-07-11 15:13:50 -03:00
Pedro Igor	55550f2023	[KEYCLOAK-6547] - AuthenticatedActionsHandler should process responses after identity is established	2018-07-11 11:33:31 -03:00
vramik	401a347f6f	KEYCLOAK-7817 Update eap6.version in testsuite	2018-07-11 15:28:33 +02:00
vmuzikar	0432a566dd	KEYCLOAK-7805 Fix PayPal and Bitbucket Social Login tests	2018-07-11 10:19:24 +02:00
rmartinc	4a82979792	KEYCLOAK-1925: SAML adapter multitenant support	2018-07-10 13:21:11 +02:00
Sebastian Laskawiec	3918dbed59	KEYCLOAK-2886 Turn off clustered tests from IDE	2018-07-10 12:37:21 +02:00
zhutaoredhat	b80b480769	Fixes KEYCLOAK-7535 - reupdate resource html	2018-07-06 07:40:41 -03:00
mposolda	d0a824dde4	Updating version to 4.2.0.Final-SNAPSHOT	2018-07-05 07:42:48 -04:00
mposolda	01da592f77	KEYCLOAK-7769 Outdated tabs on realm-keys-generic.html	2018-07-04 10:42:30 +02:00
mposolda	40d129cf54	KEYCLOAK-7489 Replace failed for entity repeats infinitely	2018-07-04 10:22:49 +02:00
mposolda	8c66f520af	KEYCLOAK-7745 JTA error if offline sessions can't be preloaded at startup within 5 minutes	2018-07-04 10:22:13 +02:00
vmuzikar	64b391cc1b	KEYCLOAK-7761 Fix Instagram Social Login test	2018-07-04 09:00:54 +02:00
vramik	8a37395760	KEYCLOAK-7722 Move eap6 specific config files to its module	2018-07-04 08:56:24 +02:00
sebastienblanc	f5d00ddffb	making Spring Boot 2 the default starter	2018-07-03 22:04:16 +02:00
Pedro Igor	dafd567e68	[KEYCLOAK-7763] - NPE when enabling authorization to security-admin-console	2018-07-03 13:18:53 -03:00
ssilvert@win.redhat.com	d55ccf5312	KEYCLOAK-7015: Not allowing two users to have empty string emails addrs.	2018-07-03 11:04:36 -04:00
Pedro Igor	871be4ad87	[KEYCLOAK-7764] - Error when processing resource-less permissions	2018-07-03 10:35:11 -03:00
Pedro Igor	6f3c59e086	[KEYCLOAK-7062] - Groups claim should be optional	2018-07-03 10:03:20 -03:00
June Zhang	fc0d510e85	Fixes KEYCLOAK-7689 Authenticator - Mobile Setup HTML	2018-07-03 08:58:17 -04:00
vramik	742a280f5d	KEYCLOAK-5556 support for POST for AuthorizationEndpoint	2018-07-03 10:38:10 +02:00
vramik	87126704cd	KEYCLOAK-7746 remove dead code	2018-07-03 10:35:11 +02:00
wyvie	1450a7fad4	[KEYCLOAK-7569] support for authentication flow update Added support for the PUT method of the authentication flow endpoint in the admin API. Now it's possible to run the 'update' method for authentication/flows in kcadm.sh.	2018-07-03 10:31:23 +02:00
ssilvert@win.redhat.com	65551159e0	KEYCLOAK-7634: Export error on client if no mappers	2018-07-03 08:54:40 +02:00
vmuzikar	d99dca2db3	KEYCLOAK-7743 Fix broken X.509 tests	2018-07-02 12:42:50 +02:00
vmuzikar	3355399b4e	KEYCLOAK-7741 Fix broken test modules	2018-06-29 10:17:06 -03:00
Pedro Igor	dcadc61220	[KEYCLOAK-7670] - PEP not returning correct status code when authorization header is not set	2018-06-29 09:39:55 -03:00
stianst	3c5027de3c	KEYCLOAK-7701 Refactor key providers to support additional algorithms	2018-06-29 14:14:25 +02:00
Hiroyuki Wada	a5d155a35a	KEYCLOAK-7674 Fix colspan	2018-06-28 18:39:10 -03:00
zhutaoredhat	05bbd9ace3	Fixes KEYCLOAK-7535 - My Resources - HTML update Updated the responsive status to make the page looks much more clear. This PR is to provide HTML and CSS code	2018-06-28 13:08:17 -04:00
vramik	559a8b2a2c	KEYCLOAK-7588, KEYCLOAK-7589 - update HOW-TO-RUN	2018-06-28 16:27:38 +02:00
vramik	c97e7e720e	KEYCLOAK-7550 - adapter tests - Fuse7.1 provider	2018-06-28 16:24:02 +02:00
Pedro Igor	f10c47955f	[KEYCLOAK-7427] - Fix to support writing to response when doing programmatic logouts	2018-06-28 11:08:28 -03:00
Pedro Igor	23db2b852b	[KEYCLOAK-7679] - Wildfly adapter must be disabled when using Elytron	2018-06-28 11:08:28 -03:00
vramik	591093f867	KEYCLOAK-7730 - revert OSGiApplicationArchiveProcessor moved into fuse app servers	2018-06-28 10:22:25 -03:00
vramik	9039b44f4d	KEYCLOAK-7718 DemoFilterServletAdapterTest test not configured correctly	2018-06-28 09:33:52 -03:00
stianst	5f0c86a49f	KEYCLOAK-6663 Add test to check custom uri scheme in redirect URI	2018-06-28 11:14:05 +02:00
vramik	8ac7bda52c	KEYCLOAK-7589 - adapter tests - Fuse7.0 provider	2018-06-28 08:45:02 +02:00
Martin Kanis	0e2e867e4a	KEYCLOAK-5023 database migration fails if mysql schema name has hyphen	2018-06-27 10:11:09 +02:00
stianst	0d9ccba566	Some work on deprecated testsuite migration	2018-06-27 08:16:14 +02:00
zhutaoredhat	30e8071d1d	Fixes KEYCLOAK-7535 - My Resources - HTML This PR is to provide HTML and CSS code JIRA task: https://issues.jboss.org/browse/KEYCLOAK-7535	2018-06-26 13:30:08 -04:00
vramik	39cbf4e9ab	KEYCLOAK-7588 - adapter tests - Fuse6.3 provider	2018-06-26 16:47:01 +02:00
Jean-Loup Maillet	af47bd5da8	corrected groups set to be able to add group & explicit imports	2018-06-26 13:30:44 +02:00
J-Loup	0ee5c97b1c	Tooltip correction on group selection Tooltip correction on group selection for hardcoded-ldap-group-mapper	2018-06-26 13:30:44 +02:00
Jean-Loup Maillet	d07f13eace	hardcoded-ldap-group-mapper	2018-06-26 13:30:44 +02:00
Johannes Knutsen	fc3ca33033	Set hardcoded user session attribute after IDP first login flow	2018-06-26 10:31:55 +02:00
Takashi Norimatsu	2fb022e501	KEYCLOAK-7688 Offline Session Max for Offline Token	2018-06-26 08:25:06 +02:00
vramik	b478472b35	KEYCLOAK-7478 Add key query param to change locale url	2018-06-26 08:19:25 +02:00
vramik	8fdadcc596	KEYCLOAK-7475 adapter tests - add Wildfly10 and Wildfly9 providers	2018-06-25 14:31:11 +02:00
June Zhang	ca06043b00	Fixes KEYCLOAK-7533 Authenticator List page - HTML	2018-06-22 15:43:24 -04:00
Grzegorz GrzybekandHynek Mlnarik	3c9d3c2c04	[KEYCLOAK-7681] Review pax-web OSGi dependencies Co-Authored-By: Hynek Mlnarik <hmlnarik@redhat.com>	2018-06-22 13:47:20 +02:00
Martin Kanis	998227ac53	KEYCLOAK-5461 Upgrade to Liquibase 3.5.5	2018-06-22 13:20:10 +02:00
Oskars Pakers	30a066db41	[master]: Fix translation for allowed-clock-skew	2018-06-22 11:45:35 +02:00
vramik	d9f79fae79	KEYCLOAK-7510 Add Support for server specific ArchiveProcessor	2018-06-22 11:38:57 +02:00
Hynek Mlnarik	530a710dce	KEYCLOAK-7412 Tests for Fuse 7.0	2018-06-22 08:59:44 +02:00
Thomas Darimont	f5ca4840d6	Fix typo (TThis)	2018-06-22 06:43:51 +02:00
Hynek Mlnarik	d3a6b6f587	KEYCLOAK-7678 Remove osgi-thirdparty module	2018-06-21 15:35:03 +02:00
Grzegorz Grzybek	f90e0fc14c	[KEYCLOAK-7425] Correctly import packages of httpclient and http core, fix Karaf feature	2018-06-21 14:28:47 +02:00
Hynek Mlnarik	6b968796ce	KEYCLOAK-7667 Fix namespace handling when decrypting assertion	2018-06-21 13:09:18 +02:00
zhutaoredhat	1277f8bb3b	Fixes KEYCLOAK-7384 - Linked Accounts HTML Update This PR is to provide HTML and CSS code JIRA task: https://issues.jboss.org/browse/KEYCLOAK-7384	2018-06-20 21:30:27 -04:00
ssilvert@win.redhat.com	63a6ba53df	KEYCLOAK-7657: My Resources placeholder components.	2018-06-19 16:28:17 -04:00
ssilvert@win.redhat.com	9af51fb664	KEYCLOAK-7662: Placeholder components for authenticator.	2018-06-19 15:56:37 -04:00
Hiroyuki Wada	c2012a595b	KEYCLOAK-7650 Don't display disabled identity providers	2018-06-19 08:55:24 -04:00
vramik	2fcfa5cf71	KEYCLOAK-7094 Support redirect to external logout page for saml filter adapter	2018-06-19 13:23:18 +02:00
ssilvert@win.redhat.com	e638391182	KEYCLOAK-7330 KEYCLOAK-7439 KEYCLOAK-7503 404-error on Token tab	2018-06-18 15:12:21 -04:00