more

core/src/main/java/org/keycloak/RSATokenVerifier.java

@@ -18,7 +18,11 @@ public class RSATokenVerifier
    {
       PublicKey realmKey = metadata.getRealmKey();
       String realm = metadata.getRealm();
-      String resource = metadata.getResourceName();
+      return verifyToken(tokenString, realmKey, realm);
+   }
+
+   public static SkeletonKeyToken verifyToken(String tokenString, PublicKey realmKey, String realm) throws VerificationException
+   {
       JWSInput input = new JWSInput(tokenString);
       boolean verified = false;
       try

core/src/main/java/org/keycloak/representations/idm/PublishedRealmRepresentation.java

@@ -30,6 +30,9 @@ public class PublishedRealmRepresentation
    @JsonProperty("grants")
    protected String grantUrl;
 
+   @JsonProperty("identity-grants")
+   protected String identityGrantUrl;
+
    @JsonIgnore
    protected volatile transient PublicKey publicKey;
 
@@ -133,4 +136,14 @@ public class PublishedRealmRepresentation
    {
       this.grantUrl = grantUrl;
    }
+
+   public String getIdentityGrantUrl()
+   {
+      return identityGrantUrl;
+   }
+
+   public void setIdentityGrantUrl(String identityGrantUrl)
+   {
+      this.identityGrantUrl = identityGrantUrl;
+   }
 }

core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java

@@ -2,6 +2,7 @@ package org.keycloak.representations.idm;
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -16,6 +17,7 @@ public class RealmRepresentation
    protected boolean enabled;
    protected boolean sslNotRequired;
    protected boolean cookieLoginAllowed;
+   protected Set<String> roles;
    protected List<RequiredCredentialRepresentation> requiredCredentials;
    protected List<UserRepresentation> users;
    protected List<RoleMappingRepresentation> roleMappings;
@@ -168,4 +170,14 @@ public class RealmRepresentation
    {
       this.accessCodeLifespan = accessCodeLifespan;
    }
+
+   public Set<String> getRoles()
+   {
+      return roles;
+   }
+
+   public void setRoles(Set<String> roles)
+   {
+      this.roles = roles;
+   }
 }

core/src/main/java/org/keycloak/representations/idm/RoleMappingRepresentation.java

@@ -14,7 +14,6 @@ public class RoleMappingRepresentation
    protected String self; // link
    protected String username;
    protected Set<String> roles;
-   protected Set<String> surrogates;
 
    public String getSelf()
    {
@@ -41,24 +40,6 @@ public class RoleMappingRepresentation
       return roles;
    }
 
-   public Set<String> getSurrogates()
-   {
-      return surrogates;
-   }
-
-   public void setSurrogates(Set<String> surrogates)
-   {
-      this.surrogates = surrogates;
-   }
-
-   public RoleMappingRepresentation surrogate(String surrogate)
-   {
-      if (this.surrogates == null) this.surrogates = new HashSet<String>();
-      this.surrogates.add(surrogate);
-      return this;
-   }
-
-
    public void setRoles(Set<String> roles)
    {
       this.roles = roles;

services/src/main/java/org/keycloak/services/IdentityManagerAdapter.java

@@ -1,84 +0,0 @@
-package org.keycloak.services;
-
-import org.keycloak.services.model.data.RealmModel;
-import org.keycloak.services.model.data.RequiredCredentialModel;
-import org.keycloak.services.model.data.ResourceModel;
-import org.keycloak.services.model.data.RoleMappingModel;
-import org.keycloak.services.model.data.RoleModel;
-import org.keycloak.services.model.data.ScopeMappingModel;
-import org.keycloak.services.model.data.UserAttributeModel;
-import org.keycloak.services.model.data.UserCredentialModel;
-import org.keycloak.services.model.data.UserModel;
-
-import java.util.List;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public interface IdentityManagerAdapter
-{
-   RealmModel getRealm(String id);
-   RealmModel create(RealmModel realm);
-   void update(RealmModel realm);
-   void delete(RealmModel realm);
-   List<RequiredCredentialModel> getRequiredCredentials(RealmModel realm);
-   RequiredCredentialModel getRealmCredential(String id);
-   RequiredCredentialModel create(RealmModel realm, RequiredCredentialModel cred);
-   void update(RequiredCredentialModel cred);
-   void delete(RequiredCredentialModel cred);
-
-   UserModel getUser(RealmModel realm, String username);
-   UserModel create(RealmModel realm, UserModel user);
-   void update(RealmModel realm, UserModel user);
-   void delete(RealmModel realm,UserModel user);
-
-   List<UserCredentialModel> getCredentials(UserModel user);
-   UserCredentialModel getCredential(String id);
-   UserCredentialModel create(UserModel user, UserCredentialModel cred);
-   void update(UserCredentialModel cred);
-   void delete(UserCredentialModel cred);
-
-   UserAttributeModel getUserAttribute(String id);
-   UserAttributeModel create(UserModel user, UserAttributeModel attribute);
-   void update(UserAttributeModel attribute);
-   void delete(UserAttributeModel attribute);
-
-   ResourceModel getResource(String resourceid);
-   List<ResourceModel> getResources(RealmModel realm);
-   ResourceModel create(RealmModel realm, ResourceModel resource);
-   void update(ResourceModel resource);
-   void delete(ResourceModel resource);
-
-
-   RoleModel getRoleByName(RealmModel realm, String roleName);
-   RoleModel getRoleByName(ResourceModel resource, String roleName);
-   List<RoleModel> getRoles(RealmModel realm, ResourceModel resource);
-   List<RoleModel> getRoles(RealmModel realm);
-   RoleModel getRole(String id);
-   RoleModel create(RealmModel realm, ResourceModel resource, String role);
-   RoleModel create(RealmModel realm, String role);
-   void delete(RoleModel role);
-
-   List<RoleMappingModel> getRoleMappings(RealmModel realm);
-   List<RoleMappingModel> getRoleMappings(RealmModel realm, ResourceModel resource);
-   RoleMappingModel getRoleMapping(RealmModel realm, UserModel user);
-   RoleMappingModel getRoleMapping(RealmModel realm, ResourceModel resource, UserModel user);
-   RoleMappingModel getRoleMapping(String id);
-   RoleMappingModel create(RealmModel realm, UserModel user, RoleMappingModel mapping);
-   RoleMappingModel create(RealmModel realm, ResourceModel resource, UserModel user, RoleMappingModel mapping);
-   void delete(RoleMappingModel role);
-
-   List<ScopeMappingModel> getScopeMappings(RealmModel realm);
-   List<ScopeMappingModel> getScopeMappings(RealmModel realm, ResourceModel resource);
-   ScopeMappingModel getScopeMapping(RealmModel realm, UserModel user);
-   ScopeMappingModel getScopeMapping(RealmModel realm, ResourceModel resource, UserModel user);
-   ScopeMappingModel getScopeMapping(String id);
-   ScopeMappingModel create(RealmModel realm, UserModel user, ScopeMappingModel mapping);
-   ScopeMappingModel create(RealmModel realm, ResourceModel resource, UserModel user, ScopeMappingModel mapping);
-   void delete(ScopeMappingModel scope);
-
-
-   List<RealmModel> getRealmsByName(String name);
-}

services/src/main/java/org/keycloak/services/managers/AuthenticationManager.java

@@ -1,16 +1,21 @@
-package org.keycloak.services.service;
+package org.keycloak.services.managers;
 
 import org.jboss.resteasy.logging.Logger;
+import org.keycloak.RSATokenVerifier;
+import org.keycloak.VerificationException;
+import org.keycloak.representations.SkeletonKeyToken;
 import org.keycloak.representations.idm.RequiredCredentialRepresentation;
-import org.keycloak.services.model.RealmManager;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.RealmModel;
+import org.keycloak.services.models.RealmModel;
-import org.keycloak.services.model.RequiredCredentialModel;
+import org.keycloak.services.models.RequiredCredentialModel;
 import org.picketlink.idm.credential.Credentials;
 import org.picketlink.idm.credential.Password;
 import org.picketlink.idm.credential.TOTPCredentials;
 import org.picketlink.idm.credential.UsernamePasswordCredentials;
 import org.picketlink.idm.model.User;
 
+import javax.ws.rs.NotAuthorizedException;
+import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MultivaluedMap;
 import java.util.HashSet;
 import java.util.Set;
@@ -30,7 +35,45 @@ public class AuthenticationManager
       this.adapter = adapter;
    }
 
-   public boolean authenticate(RealmModel realm, User user, MultivaluedMap<String, String> formData)
+   public User authenticateToken(RealmModel realm, HttpHeaders headers)
+   {
+      String tokenString = null;
+      String authHeader = headers.getHeaderString(HttpHeaders.AUTHORIZATION);
+      if (authHeader == null)
+      {
+         throw new NotAuthorizedException("Bearer");
+      }
+      else
+      {
+         String[] split = authHeader.trim().split("\\s+");
+         if (split == null || split.length != 2) throw new NotAuthorizedException("Bearer");
+         if (!split[0].equalsIgnoreCase("Bearer")) throw new NotAuthorizedException("Bearer");
+         tokenString = split[1];
+      }
+
+
+      try
+      {
+         SkeletonKeyToken token = RSATokenVerifier.verifyToken(tokenString, realm.getPublicKey(), realm.getId());
+         if (!token.isActive())
+         {
+            throw new NotAuthorizedException("token_expired");
+         }
+         User user = realm.getIdm().getUser(token.getPrincipal());
+         if (user == null || !user.isEnabled())
+         {
+            throw new NotAuthorizedException("invalid_user");
+         }
+         return user;
+      }
+      catch (VerificationException e)
+      {
+         logger.error("Failed to verify token", e);
+         throw new NotAuthorizedException("invalid_token");
+      }
+   }
+
+   public boolean authenticateForm(RealmModel realm, User user, MultivaluedMap<String, String> formData)
    {
       String username = user.getLoginName();
       Set<String> types = new HashSet<String>();

services/src/main/java/org/keycloak/services/managers/TokenManager.java

@@ -1,13 +1,13 @@
-package org.keycloak.services.service;
+package org.keycloak.services.managers;
 
 import org.jboss.resteasy.jose.Base64Url;
 import org.jboss.resteasy.jose.jws.JWSBuilder;
 import org.jboss.resteasy.jwt.JsonSerialization;
 import org.keycloak.representations.SkeletonKeyScope;
 import org.keycloak.representations.SkeletonKeyToken;
-import org.keycloak.services.model.RealmManager;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.RealmModel;
+import org.keycloak.services.models.RealmModel;
-import org.keycloak.services.model.ResourceModel;
+import org.keycloak.services.models.ResourceModel;
 import org.picketlink.idm.model.User;
 
 import javax.ws.rs.ForbiddenException;

services/src/main/java/org/keycloak/services/model/data/RealmModel.java

@@ -1,194 +0,0 @@
-package org.keycloak.services.model.data;
-
-import org.bouncycastle.openssl.PEMWriter;
-import org.jboss.resteasy.security.PemUtils;
-
-import java.io.IOException;
-import java.io.Serializable;
-import java.io.StringWriter;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class RealmModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-
-   protected String id;
-   protected String name;
-   protected long tokenLifespan = 3600 * 24; // one day
-   protected long accessCodeLifespan = 300; // 5 minutes
-   protected boolean enabled;
-   protected boolean sslNotRequired;
-   protected boolean cookieLoginAllowed;
-   protected String publicKeyPem;
-   protected String privateKeyPem;
-   protected volatile transient PublicKey publicKey;
-   protected volatile transient PrivateKey privateKey;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getName()
-   {
-      return name;
-   }
-
-   public void setName(String name)
-   {
-      this.name = name;
-   }
-
-   public boolean isEnabled()
-   {
-      return enabled;
-   }
-
-   public void setEnabled(boolean enabled)
-   {
-      this.enabled = enabled;
-   }
-
-   public boolean isSslNotRequired()
-   {
-      return sslNotRequired;
-   }
-
-   public void setSslNotRequired(boolean sslNotRequired)
-   {
-      this.sslNotRequired = sslNotRequired;
-   }
-
-   public boolean isCookieLoginAllowed()
-   {
-      return cookieLoginAllowed;
-   }
-
-   public void setCookieLoginAllowed(boolean cookieLoginAllowed)
-   {
-      this.cookieLoginAllowed = cookieLoginAllowed;
-   }
-
-   public long getTokenLifespan()
-   {
-      return tokenLifespan;
-   }
-
-   public void setTokenLifespan(long tokenLifespan)
-   {
-      this.tokenLifespan = tokenLifespan;
-   }
-
-   public long getAccessCodeLifespan()
-   {
-      return accessCodeLifespan;
-   }
-
-   public void setAccessCodeLifespan(long accessCodeLifespan)
-   {
-      this.accessCodeLifespan = accessCodeLifespan;
-   }
-
-   public String getPublicKeyPem()
-   {
-      return publicKeyPem;
-   }
-
-   public void setPublicKeyPem(String publicKeyPem)
-   {
-      this.publicKeyPem = publicKeyPem;
-      this.publicKey = null;
-   }
-
-   public String getPrivateKeyPem()
-   {
-      return privateKeyPem;
-   }
-
-   public void setPrivateKeyPem(String privateKeyPem)
-   {
-      this.privateKeyPem = privateKeyPem;
-      this.privateKey = null;
-   }
-
-   public PublicKey getPublicKey()
-   {
-      if (publicKey != null) return publicKey;
-      if (publicKeyPem != null)
-      {
-         try
-         {
-            publicKey = PemUtils.decodePublicKey(publicKeyPem);
-         }
-         catch (Exception e)
-         {
-            throw new RuntimeException(e);
-         }
-      }
-      return publicKey;
-   }
-
-   public void setPublicKey(PublicKey publicKey)
-   {
-      this.publicKey = publicKey;
-      StringWriter writer = new StringWriter();
-      PEMWriter pemWriter = new PEMWriter(writer);
-      try
-      {
-         pemWriter.writeObject(publicKey);
-         pemWriter.flush();
-      }
-      catch (IOException e)
-      {
-         throw new RuntimeException(e);
-      }
-      String s = writer.toString();
-      this.publicKeyPem = PemUtils.removeBeginEnd(s);
-   }
-
-   public PrivateKey getPrivateKey()
-   {
-      if (privateKey != null) return privateKey;
-      if (privateKeyPem != null)
-      {
-         try
-         {
-            privateKey = PemUtils.decodePrivateKey(privateKeyPem);
-         }
-         catch (Exception e)
-         {
-            throw new RuntimeException(e);
-         }
-      }
-      return privateKey;
-   }
-
-   public void setPrivateKey(PrivateKey privateKey)
-   {
-      this.privateKey = privateKey;
-      StringWriter writer = new StringWriter();
-      PEMWriter pemWriter = new PEMWriter(writer);
-      try
-      {
-         pemWriter.writeObject(privateKey);
-         pemWriter.flush();
-      }
-      catch (IOException e)
-      {
-         throw new RuntimeException(e);
-      }
-      String s = writer.toString();
-      this.privateKeyPem = PemUtils.removeBeginEnd(s);
-   }
-}

services/src/main/java/org/keycloak/services/model/data/RequiredCredentialModel.java

@@ -1,58 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class RequiredCredentialModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-
-   protected String id;
-   protected String type;
-   protected boolean input;
-   protected boolean secret;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getType()
-   {
-      return type;
-   }
-
-   public void setType(String type)
-   {
-      this.type = type;
-   }
-
-   public boolean isInput()
-   {
-      return input;
-   }
-
-   public void setInput(boolean input)
-   {
-      this.input = input;
-   }
-
-   public boolean isSecret()
-   {
-      return secret;
-   }
-
-   public void setSecret(boolean secret)
-   {
-      this.secret = secret;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/ResourceModel.java

@@ -1,46 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class ResourceModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String name;
-   protected boolean surrogateAuthRequired;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getName()
-   {
-      return name;
-   }
-
-   public void setName(String name)
-   {
-      this.name = name;
-   }
-
-   public boolean isSurrogateAuthRequired()
-   {
-      return surrogateAuthRequired;
-   }
-
-   public void setSurrogateAuthRequired(boolean surrogateAuthRequired)
-   {
-      this.surrogateAuthRequired = surrogateAuthRequired;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/RoleMappingModel.java

@@ -1,59 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class RoleMappingModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String userid;
-   protected Set<String> roles = new HashSet<String>();
-   protected Set<String> surrogateIds = new HashSet<String>();
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getUserid()
-   {
-      return userid;
-   }
-
-   public void setUserid(String userid)
-   {
-      this.userid = userid;
-   }
-
-   public Set<String> getRoles()
-   {
-      return roles;
-   }
-
-   public void setRoles(Set<String> roles)
-   {
-      this.roles = roles;
-   }
-
-   public Set<String> getSurrogateIds()
-   {
-      return surrogateIds;
-   }
-
-   public void setSurrogateIds(Set<String> surrogateIds)
-   {
-      this.surrogateIds = surrogateIds;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/RoleModel.java

@@ -1,35 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class RoleModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String name;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getName()
-   {
-      return name;
-   }
-
-   public void setName(String name)
-   {
-      this.name = name;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/ScopeMappingModel.java

@@ -1,49 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class ScopeMappingModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String userid;
-   protected Set<String> roles = new HashSet<String>();
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getUserid()
-   {
-      return userid;
-   }
-
-   public void setUserid(String userid)
-   {
-      this.userid = userid;
-   }
-
-   public Set<String> getRoles()
-   {
-      return roles;
-   }
-
-   public void setRoles(Set<String> roles)
-   {
-      this.roles = roles;
-   }
-
-}

services/src/main/java/org/keycloak/services/model/data/UserAttributeModel.java

@@ -1,46 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class UserAttributeModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String name;
-   protected String value;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getName()
-   {
-      return name;
-   }
-
-   public void setName(String name)
-   {
-      this.name = name;
-   }
-
-   public String getValue()
-   {
-      return value;
-   }
-
-   public void setValue(String value)
-   {
-      this.value = value;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/UserCredentialModel.java

@@ -1,58 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class UserCredentialModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-
-   protected String id;
-   protected String type;
-   protected String value;
-   protected boolean hashed;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getType()
-   {
-      return type;
-   }
-
-   public void setType(String type)
-   {
-      this.type = type;
-   }
-
-   public String getValue()
-   {
-      return value;
-   }
-
-   public void setValue(String value)
-   {
-      this.value = value;
-   }
-
-   public boolean isHashed()
-   {
-      return hashed;
-   }
-
-   public void setHashed(boolean hashed)
-   {
-      this.hashed = hashed;
-   }
-}

services/src/main/java/org/keycloak/services/model/data/UserModel.java

@@ -1,46 +0,0 @@
-package org.keycloak.services.model.data;
-
-import java.io.Serializable;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Deprecated
-public class UserModel implements Serializable
-{
-   private static final long serialVersionUID = 1L;
-   protected String id;
-   protected String username;
-   protected boolean enabled;
-
-   public String getId()
-   {
-      return id;
-   }
-
-   public void setId(String id)
-   {
-      this.id = id;
-   }
-
-   public String getUsername()
-   {
-      return username;
-   }
-
-   public void setUsername(String username)
-   {
-      this.username = username;
-   }
-
-   public boolean isEnabled()
-   {
-      return enabled;
-   }
-
-   public void setEnabled(boolean enabled)
-   {
-      this.enabled = enabled;
-   }
-}

services/src/main/java/org/keycloak/services/models/RealmManager.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models;
 
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.internal.IdentityManagerFactory;

services/src/main/java/org/keycloak/services/models/RealmModel.java

@@ -1,8 +1,12 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models;
 
 import org.bouncycastle.openssl.PEMWriter;
 import org.jboss.resteasy.security.PemUtils;
 import org.keycloak.representations.idm.RequiredCredentialRepresentation;
+import org.keycloak.services.models.relationships.RealmAdminRelationship;
+import org.keycloak.services.models.relationships.RealmResourceRelationship;
+import org.keycloak.services.models.relationships.RequiredCredentialRelationship;
+import org.keycloak.services.models.relationships.ScopeRelationship;
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.credential.Password;
 import org.picketlink.idm.credential.TOTPCredential;
@@ -386,4 +390,23 @@ public class RealmModel
       }
       return set;
    }
+
+   public boolean isRealmAdmin(Agent agent)
+   {
+      IdentityManager idm = getIdm();
+      RelationshipQuery<RealmAdminRelationship> query = idm.createRelationshipQuery(RealmAdminRelationship.class);
+      query.setParameter(RealmAdminRelationship.REALM, realm);
+      query.setParameter(RealmAdminRelationship.ADMIN, agent);
+      List<RealmAdminRelationship> results = query.getResultList();
+      return results.size() > 0;
+   }
+
+   public void addRealmAdmin(Agent agent)
+   {
+      IdentityManager idm = getIdm();
+      RealmAdminRelationship relationship = new RealmAdminRelationship();
+      relationship.setAdmin(agent);
+      relationship.setRealm(realm);
+      idm.add(relationship);
+   }
 }

services/src/main/java/org/keycloak/services/models/RequiredCredentialModel.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

services/src/main/java/org/keycloak/services/models/ResourceModel.java

@@ -1,5 +1,6 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models;
 
+import org.keycloak.services.models.relationships.ScopeRelationship;
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.internal.IdentityManagerFactory;
 import org.picketlink.idm.model.Agent;
@@ -115,7 +116,6 @@ public class ResourceModel
 
    }
 
-
    public Set<String> getScope(Agent agent)
    {
       RelationshipQuery<ScopeRelationship> query = getIdm().createRelationshipQuery(ScopeRelationship.class);
@@ -128,7 +128,4 @@ public class ResourceModel
       }
       return set;
    }
-
-
-
 }

services/src/main/java/org/keycloak/services/models/UserCredentialModel.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

services/src/main/java/org/keycloak/services/models/relationships/RealmAdminRelationship.java

@@ -0,0 +1,58 @@
+package org.keycloak.services.models.relationships;
+
+import org.picketlink.idm.model.AbstractAttributedType;
+import org.picketlink.idm.model.Agent;
+import org.picketlink.idm.model.Realm;
+import org.picketlink.idm.model.Relationship;
+import org.picketlink.idm.model.annotation.IdentityProperty;
+import org.picketlink.idm.query.RelationshipQueryParameter;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class RealmAdminRelationship extends AbstractAttributedType implements Relationship
+{
+   private static final long serialVersionUID = 1L;
+
+   public static final RelationshipQueryParameter REALM = new RelationshipQueryParameter() {
+
+      @Override
+      public String getName() {
+         return "realm";
+      }
+   };
+
+   public static final RelationshipQueryParameter ADMIN = new RelationshipQueryParameter() {
+
+      @Override
+      public String getName() {
+         return "admin";
+      }
+   };
+
+   protected Realm realm;
+   protected Agent admin;
+
+   @IdentityProperty
+   public Realm getRealm()
+   {
+      return realm;
+   }
+
+   public void setRealm(Realm realm)
+   {
+      this.realm = realm;
+   }
+
+   @IdentityProperty
+   public Agent getAdmin()
+   {
+      return admin;
+   }
+
+   public void setAdmin(Agent admin)
+   {
+      this.admin = admin;
+   }
+}

services/src/main/java/org/keycloak/services/models/relationships/RealmResourceRelationship.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models.relationships;
 
 import org.picketlink.idm.model.AbstractAttributedType;
 import org.picketlink.idm.model.Agent;

services/src/main/java/org/keycloak/services/models/relationships/RequiredCredentialRelationship.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models.relationships;
 
 import org.picketlink.idm.model.AbstractAttributedType;
 import org.picketlink.idm.model.Agent;

services/src/main/java/org/keycloak/services/models/relationships/ScopeRelationship.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.model;
+package org.keycloak.services.models.relationships;
 
 import org.picketlink.idm.model.AbstractAttributedType;
 import org.picketlink.idm.model.Agent;

services/src/main/java/org/keycloak/services/resources/RealmFactory.java

@@ -0,0 +1,343 @@
+package org.keycloak.services.resources;
+
+import org.jboss.resteasy.logging.Logger;
+import org.keycloak.representations.idm.RequiredCredentialRepresentation;
+import org.keycloak.representations.idm.ResourceRepresentation;
+import org.keycloak.representations.idm.RoleMappingRepresentation;
+import org.keycloak.representations.idm.ScopeMappingRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.services.managers.AuthenticationManager;
+import org.keycloak.services.models.RealmManager;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.services.models.RealmModel;
+import org.keycloak.services.models.RequiredCredentialModel;
+import org.keycloak.services.models.ResourceModel;
+import org.keycloak.services.models.UserCredentialModel;
+import org.picketlink.idm.model.Attribute;
+import org.picketlink.idm.model.Realm;
+import org.picketlink.idm.model.Role;
+import org.picketlink.idm.model.SimpleRole;
+import org.picketlink.idm.model.SimpleUser;
+import org.picketlink.idm.model.User;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.NotAuthorizedException;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Path("/realmfactory")
+public class RealmFactory
+{
+   protected Logger logger = Logger.getLogger(RealmFactory.class);
+
+   protected RealmManager adapter;
+   protected AuthenticationManager authenticationManager;
+   protected RealmModel defaultRealm;
+
+
+   @Context
+   protected UriInfo uriInfo;
+
+   @Context
+   protected HttpHeaders headers;
+
+
+   public RealmFactory(RealmManager adapter)
+   {
+      this.adapter = adapter;
+      defaultRealm = adapter.getRealm(Realm.DEFAULT_REALM);
+   }
+
+   @POST
+   @Consumes("application/json")
+   public Response importDomain(RealmRepresentation rep)
+   {
+      RealmModel realm = createRealm(rep);
+      UriBuilder builder = uriInfo.getRequestUriBuilder().path(realm.getId());
+      return Response.created(builder.build())
+              .entity(RealmResource.realmRep(realm, uriInfo))
+              .type(MediaType.APPLICATION_JSON_TYPE).build();
+   }
+
+   protected RealmModel createRealm(RealmRepresentation rep)
+   {
+      User realmCreator = authenticationManager.authenticateToken(defaultRealm, headers);
+      Role creatorRole = defaultRealm.getIdm().getRole(RegistrationService.REALM_CREATOR_ROLE);
+      if (!defaultRealm.getIdm().hasRole(realmCreator, creatorRole))
+      {
+         logger.warn("not a realm creator");
+         throw new NotAuthorizedException("Bearer");
+      }
+      verifyRealmRepresentation(rep);
+
+      RealmModel realm = adapter.create(rep.getRealm());
+      realm.addRealmAdmin(realmCreator);
+      KeyPair keyPair = null;
+      try
+      {
+         keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
+      }
+      catch (NoSuchAlgorithmException e)
+      {
+         throw new RuntimeException(e);
+      }
+      realm.setPrivateKey(keyPair.getPrivate());
+      realm.setPublicKey(keyPair.getPublic());
+      realm.setName(rep.getRealm());
+      realm.setEnabled(rep.isEnabled());
+      realm.setTokenLifespan(rep.getTokenLifespan());
+      realm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
+      realm.setSslNotRequired(rep.isSslNotRequired());
+      realm.setCookieLoginAllowed(rep.isCookieLoginAllowed());
+      realm.updateRealm();
+
+
+      Map<String, User> userMap = new HashMap<String, User>();
+
+      for (RequiredCredentialRepresentation requiredCred : rep.getRequiredCredentials())
+      {
+         RequiredCredentialModel credential = new RequiredCredentialModel();
+         credential.setType(requiredCred.getType());
+         credential.setInput(requiredCred.isInput());
+         credential.setSecret(requiredCred.isSecret());
+         realm.addRequiredCredential(credential);
+      }
+
+      for (UserRepresentation userRep : rep.getUsers())
+      {
+         User user = new SimpleUser(userRep.getUsername());
+         user.setEnabled(userRep.isEnabled());
+         if (userRep.getAttributes() != null)
+         {
+            for (Map.Entry<String, String> entry : userRep.getAttributes().entrySet())
+            {
+               user.setAttribute(new Attribute<String>(entry.getKey(), entry.getValue()));
+            }
+         }
+         realm.getIdm().add(user);
+         if (userRep.getCredentials() != null)
+         {
+            for (UserRepresentation.Credential cred : userRep.getCredentials())
+            {
+               UserCredentialModel credential = new UserCredentialModel();
+               credential.setType(cred.getType());
+               credential.setValue(cred.getValue());
+               realm.updateCredential(user, credential);
+            }
+         }
+         userMap.put(user.getLoginName(), user);
+      }
+
+      Map<String, Role> roles = new HashMap<String, Role>();
+
+      if (rep.getRoles() != null)
+      {
+         for (String roleString : rep.getRoles())
+         {
+            SimpleRole role = new SimpleRole(roleString.trim());
+            realm.getIdm().add(role);
+            roles.put(role.getName(), role);
+         }
+      }
+
+      if (rep.getRoleMappings() != null)
+      {
+         for (RoleMappingRepresentation mapping : rep.getRoleMappings())
+         {
+            User user = userMap.get(mapping.getUsername());
+            for (String roleString : mapping.getRoles())
+            {
+               Role role = roles.get(roleString.trim());
+               if (role == null)
+               {
+                  role = new SimpleRole(roleString.trim());
+                  realm.getIdm().add(role);
+                  roles.put(role.getName(), role);
+               }
+               realm.getIdm().grantRole(user, role);
+            }
+         }
+      }
+
+      if (rep.getScopeMappings() != null)
+      {
+         for (ScopeMappingRepresentation scope : rep.getScopeMappings())
+         {
+            for (String roleString : scope.getRoles())
+            {
+               Role role = roles.get(roleString.trim());
+               if (role == null)
+               {
+                  role = new SimpleRole(roleString.trim());
+                  realm.getIdm().add(role);
+                  roles.put(role.getName(), role);
+               }
+               User user = userMap.get(scope.getUsername());
+               realm.addScope(user, role.getName());
+            }
+
+         }
+      }
+
+      if (!roles.containsKey("*"))
+      {
+         SimpleRole wildcard = new SimpleRole("*");
+         realm.getIdm().add(wildcard);
+         roles.put("*", wildcard);
+      }
+
+      if (rep.getResources() != null)
+      {
+         createResources(rep, realm, userMap);
+      }
+      return realm;
+   }
+
+   protected void createResources(RealmRepresentation rep, RealmModel realm, Map<String, User> userMap)
+   {
+      for (ResourceRepresentation resourceRep : rep.getResources())
+      {
+         ResourceModel resource = realm.addResource(resourceRep.getName());
+         resource.setSurrogateAuthRequired(resourceRep.isSurrogateAuthRequired());
+         resource.updateResource();
+         Map<String, Role> roles = new HashMap<String, Role>();
+         if (resourceRep.getRoles() != null)
+         {
+            for (String roleString : rep.getRoles())
+            {
+               SimpleRole role = new SimpleRole(roleString.trim());
+               resource.getIdm().add(role);
+               roles.put(role.getName(), role);
+            }
+         }
+         if (resourceRep.getRoleMappings() != null)
+         {
+            for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
+            {
+               User user = userMap.get(mapping.getUsername());
+               for (String roleString : mapping.getRoles())
+               {
+                  Role role = roles.get(roleString.trim());
+                  if (role == null)
+                  {
+                     role = new SimpleRole(roleString.trim());
+                     resource.getIdm().add(role);
+                     roles.put(role.getName(), role);
+                  }
+                  resource.getIdm().grantRole(user, role);
+               }
+            }
+         }
+         if (resourceRep.getScopeMappings() != null)
+         {
+            for (ScopeMappingRepresentation mapping : resourceRep.getScopeMappings())
+            {
+               User user = userMap.get(mapping.getUsername());
+               for (String roleString : mapping.getRoles())
+               {
+                  Role role = roles.get(roleString.trim());
+                  if (role == null)
+                  {
+                     role = new SimpleRole(roleString.trim());
+                     resource.getIdm().add(role);
+                     roles.put(role.getName(), role);
+                  }
+                  resource.addScope(user, role.getName());
+               }
+            }
+         }
+         if (!roles.containsKey("*"))
+         {
+            SimpleRole wildcard = new SimpleRole("*");
+            resource.getIdm().add(wildcard);
+            roles.put("*", wildcard);
+         }
+
+      }
+   }
+
+   protected void verifyRealmRepresentation(RealmRepresentation rep)
+   {
+      if (rep.getRequiredCredentials() == null)
+      {
+         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
+                 .entity("Realm credential requirements not defined").type("text/plain").build());
+
+      }
+
+      HashMap<String, UserRepresentation> userReps = new HashMap<String, UserRepresentation>();
+      for (UserRepresentation userRep : rep.getUsers()) userReps.put(userRep.getUsername(), userRep);
+
+       // override enabled to false if user does not have at least all of browser or client credentials
+      for (UserRepresentation userRep : rep.getUsers())
+      {
+         if (userRep.getCredentials() == null)
+         {
+            userRep.setEnabled(false);
+         }
+         else
+         {
+            boolean hasBrowserCredentials = true;
+            for (RequiredCredentialRepresentation credential : rep.getRequiredCredentials())
+            {
+               boolean hasCredential = false;
+               for (UserRepresentation.Credential cred : userRep.getCredentials())
+               {
+                  if (cred.getType().equals(credential.getType()))
+                  {
+                     hasCredential = true;
+                     break;
+                  }
+               }
+               if (!hasCredential)
+               {
+                  hasBrowserCredentials = false;
+                  break;
+               }
+            }
+            if (!hasBrowserCredentials)
+            {
+               userRep.setEnabled(false);
+            }
+
+         }
+      }
+
+      if (rep.getResources() != null)
+      {
+         // check mappings
+         for (ResourceRepresentation resourceRep : rep.getResources())
+         {
+            if (resourceRep.getRoleMappings() != null)
+            {
+               for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
+               {
+                  if (!userReps.containsKey(mapping.getUsername()))
+                  {
+                     throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
+                             .entity("No users declared for role mapping").type("text/plain").build());
+
+                  }
+               }
+            }
+         }
+      }
+   }
+
+}

services/src/main/java/org/keycloak/services/resources/RealmResource.java

@@ -1,48 +1,42 @@
-package org.keycloak.services.service;
+package org.keycloak.services.resources;
 
-import org.keycloak.services.IdentityManagerAdapter;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.data.RealmModel;
 import org.jboss.resteasy.logging.Logger;
 import org.keycloak.representations.idm.PublishedRealmRepresentation;
+import org.keycloak.services.models.RealmModel;
 
 import javax.ws.rs.GET;
 import javax.ws.rs.NotFoundException;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.Context;
-import javax.ws.rs.core.GenericEntity;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
-import java.util.ArrayList;
-import java.util.List;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-@Path("/")
+@Path("/realms")
 public class RealmResource
 {
    protected Logger logger = Logger.getLogger(RealmResource.class);
-   protected IdentityManagerAdapter identityManager;
+   protected RealmManager adapter;
    @Context
    protected UriInfo uriInfo;
 
-   public RealmResource(IdentityManagerAdapter identityManager)
+   public RealmResource(RealmManager adapter)
    {
-      this.identityManager = identityManager;
+      this.adapter = adapter;
    }
 
    @GET
-   @Path("realms/{realm}")
+   @Path("{realm}")
    @Produces("application/json")
    public PublishedRealmRepresentation getRealm(@PathParam("realm") String id)
    {
-      RealmModel realm = identityManager.getRealm(id);
+      RealmModel realm = adapter.getRealm(id);
       if (realm == null)
       {
          logger.debug("realm not found");
@@ -52,11 +46,11 @@ public class RealmResource
    }
 
    @GET
-   @Path("realms/{realm}.html")
+   @Path("{realm}.html")
    @Produces("text/html")
    public String getRealmHtml(@PathParam("realm") String id)
    {
-      RealmModel realm = identityManager.getRealm(id);
+      RealmModel realm = adapter.getRealm(id);
       if (realm == null)
       {
          logger.debug("realm not found");
@@ -82,10 +76,15 @@ public class RealmResource
       grant.path(TokenService.class).path(TokenService.class, "accessTokenGrant");
       String grantUrl = grant.build(realm.getId()).toString();
 
+      UriBuilder idGrant = uriInfo.getBaseUriBuilder();
+      grant.path(TokenService.class).path(TokenService.class, "identityTokenGrant");
+      String idGrantUrl = idGrant.build(realm.getId()).toString();
+
       html.append("<html><body><h1>Realm: ").append(realm.getName()).append("</h1>");
       html.append("<p>auth: ").append(authUri).append("</p>");
       html.append("<p>code: ").append(codeUri).append("</p>");
       html.append("<p>grant: ").append(grantUrl).append("</p>");
+      html.append("<p>identity grant: ").append(idGrantUrl).append("</p>");
       html.append("<p>public key: ").append(realm.getPublicKeyPem()).append("</p>");
       html.append("</body></html>");
 
@@ -93,46 +92,6 @@ public class RealmResource
    }
 
 
-   @GET
-   @Path("realms")
-   @Produces("application/json")
-   public Response getRealmsByName(@QueryParam("name") String name)
-   {
-      if (name == null) return Response.noContent().build();
-      List<RealmModel> realms = identityManager.getRealmsByName(name);
-      if (realms.size() == 0) return Response.noContent().build();
-
-      List<PublishedRealmRepresentation> list = new ArrayList<PublishedRealmRepresentation>();
-      for (RealmModel realm : realms)
-      {
-         list.add(realmRep(realm, uriInfo));
-      }
-      GenericEntity<List<PublishedRealmRepresentation>> entity = new GenericEntity<List<PublishedRealmRepresentation>>(list){};
-      return Response.ok(entity).type(MediaType.APPLICATION_JSON_TYPE).build();
-   }
-
-   @GET
-   @Path("realms.html")
-   @Produces("text/html")
-   public String getRealmsByNameHtml(@QueryParam("name") String name)
-   {
-      if (name == null) return "<html><body><h1>No realms with that name</h1></body></html>";
-      List<RealmModel> realms = identityManager.getRealmsByName(name);
-      if (realms.size() == 0) return "<html><body><h1>No realms with that name</h1></body></html>";
-      if (realms.size() == 1) return realmHtml(realms.get(0));
-
-      StringBuffer html = new StringBuffer();
-      html.append("<html><body><h1>Realms</h1>");
-      for (RealmModel realm : realms)
-      {
-         html.append("<p><a href=\"").append(uriInfo.getBaseUriBuilder().path("realms").path(realm.getId() + ".html"))
-                 .append("\">").append(realm.getId()).append("</a></p>");
-      }
-      html.append("</body></html>");
-      return html.toString();
-   }
-
-
    public static PublishedRealmRepresentation realmRep(RealmModel realm, UriInfo uriInfo)
    {
       PublishedRealmRepresentation rep = new PublishedRealmRepresentation();
@@ -153,6 +112,11 @@ public class RealmResource
       grant.path(TokenService.class).path(TokenService.class, "accessTokenGrant");
       String grantUrl = grant.build(realm.getId()).toString();
       rep.setGrantUrl(grantUrl);
+
+      UriBuilder idGrant = uriInfo.getBaseUriBuilder();
+      grant.path(TokenService.class).path(TokenService.class, "identityTokenGrant");
+      String idGrantUrl = idGrant.build(realm.getId()).toString();
+      rep.setIdentityGrantUrl(idGrantUrl);
       return rep;
    }
 }

services/src/main/java/org/keycloak/services/resources/RegistrationService.java

@@ -1,10 +1,11 @@
-package org.keycloak.services.service;
+package org.keycloak.services.resources;
 
 import org.keycloak.representations.idm.UserRepresentation;
-import org.keycloak.services.model.RealmManager;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.RealmModel;
+import org.keycloak.services.models.RealmModel;
-import org.keycloak.services.model.UserCredentialModel;
+import org.keycloak.services.models.UserCredentialModel;
 import org.picketlink.idm.model.Realm;
+import org.picketlink.idm.model.Role;
 import org.picketlink.idm.model.SimpleUser;
 import org.picketlink.idm.model.User;
 
@@ -24,6 +25,7 @@ import java.net.URI;
 @Path("/registrations")
 public class RegistrationService
 {
+   public static final String REALM_CREATOR_ROLE = "realm-creator";
    protected RealmManager adapter;
    protected RealmModel defaultRealm;
 
@@ -57,6 +59,8 @@ public class RegistrationService
          credModel.setValue(cred.getValue());
          defaultRealm.updateCredential(user, credModel);
       }
+      Role realmCreator = defaultRealm.getIdm().getRole(REALM_CREATOR_ROLE);
+      defaultRealm.getIdm().grantRole(user, realmCreator);
       URI uri = uriInfo.getBaseUriBuilder().path(RealmFactory.class).path(user.getLoginName()).build();
       return Response.created(uri).build();
    }

services/src/main/java/org/keycloak/services/resources/SkeletonKeyApplication.java

@@ -1,10 +1,9 @@
-package org.keycloak.services.service;
+package org.keycloak.services.resources;
 
 import org.infinispan.Cache;
 import org.infinispan.manager.DefaultCacheManager;
 import org.keycloak.SkeletonKeyContextResolver;
 
-import javax.ws.rs.ApplicationPath;
 import javax.ws.rs.core.Application;
 import java.io.IOException;
 import java.io.InputStream;
@@ -15,7 +14,6 @@ import java.util.Set;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
-@ApplicationPath("/")
 public class SkeletonKeyApplication extends Application
 {
    protected Set<Object> singletons = new HashSet<Object>();

services/src/main/java/org/keycloak/services/resources/TokenService.java

@@ -1,4 +1,4 @@
-package org.keycloak.services.service;
+package org.keycloak.services.resources;
 
 import org.jboss.resteasy.jose.Base64Url;
 import org.jboss.resteasy.jose.jws.JWSBuilder;
@@ -9,10 +9,12 @@ import org.jboss.resteasy.logging.Logger;
 import org.keycloak.representations.AccessTokenResponse;
 import org.keycloak.representations.SkeletonKeyScope;
 import org.keycloak.representations.SkeletonKeyToken;
-import org.keycloak.services.model.RealmManager;
+import org.keycloak.services.managers.AuthenticationManager;
-import org.keycloak.services.model.RealmModel;
+import org.keycloak.services.managers.TokenManager;
-import org.keycloak.services.model.RequiredCredentialModel;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.ResourceModel;
+import org.keycloak.services.models.RealmModel;
+import org.keycloak.services.models.RequiredCredentialModel;
+import org.keycloak.services.models.ResourceModel;
 import org.picketlink.idm.model.User;
 
 import javax.ws.rs.Consumes;
@@ -188,7 +190,7 @@ public class TokenService
       {
          throw new NotAuthorizedException("Disabled user.");
       }
-      if (authManager.authenticate(realm, user, form))
+      if (authManager.authenticateForm(realm, user, form))
       {
          throw new NotAuthorizedException("Auth failed");
       }
@@ -239,7 +241,7 @@ public class TokenService
          return Response.ok("Your account is not enabled").type("text/html").build();
 
       }
-      boolean authenticated = authManager.authenticate(realm, user, formData);
+      boolean authenticated = authManager.authenticateForm(realm, user, formData);
       if (!authenticated) return loginForm("Unable to authenticate, try again", redirect, clientId, scopeParam, state, realm, client);
 
       SkeletonKeyToken token = null;
@@ -322,7 +324,7 @@ public class TokenService
          return Response.status(Response.Status.BAD_REQUEST).entity(error).type("application/json").build();
       }
 
-      boolean authenticated = authManager.authenticate(realm, client, formData);
+      boolean authenticated = authManager.authenticateForm(realm, client, formData);
       if (!authenticated)
       {
          Map<String, String> error = new HashMap<String, String>();

services/src/main/java/org/keycloak/services/service/RealmFactory.java

@@ -1,354 +0,0 @@
-package org.keycloak.services.service;
-
-import org.keycloak.services.model.RealmManager;
-import org.keycloak.representations.idm.RealmRepresentation;
-import org.keycloak.services.model.RealmModel;
-import org.picketlink.idm.model.User;
-
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriBuilder;
-import javax.ws.rs.core.UriInfo;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.NoSuchAlgorithmException;
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
- * @version $Revision: 1 $
- */
-@Path("/realmfactory")
-public class RealmFactory
-{
-   protected RealmManager adapter;
-
-   @Context
-   protected UriInfo uriInfo;
-
-   public RealmFactory(RealmManager adapter)
-   {
-      this.adapter = adapter;
-   }
-
-
-   @POST
-   @Consumes("application/json")
-   public Response importDomain(RealmRepresentation rep)
-   {
-      RealmModel realm = createRealm(rep);
-      UriBuilder builder = uriInfo.getRequestUriBuilder().path(realm.getId());
-      return Response.created(builder.build())
-              //.entity(RealmResource.realmRep(realm, uriInfo))
-              .type(MediaType.APPLICATION_JSON_TYPE).build();
-   }
-
-   protected RealmModel createRealm(RealmRepresentation rep)
-   {
-      //verifyRealmRepresentation(rep);
-
-      RealmModel realm = adapter.create(rep.getRealm());
-      KeyPair keyPair = null;
-      try
-      {
-         keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
-      }
-      catch (NoSuchAlgorithmException e)
-      {
-         throw new RuntimeException(e);
-      }
-      realm.setPrivateKey(keyPair.getPrivate());
-      realm.setPublicKey(keyPair.getPublic());
-      realm.setName(rep.getRealm());
-      realm.setEnabled(rep.isEnabled());
-      realm.setTokenLifespan(rep.getTokenLifespan());
-      realm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
-      realm.setSslNotRequired(rep.isSslNotRequired());
-      realm.updateRealm();
-
-
-      Map<String, User> userMap = new HashMap<String, User>();
-      return null;
-   }/*
-      RoleModel adminRole = identityManager.create(realm, "admin");
-
-      for (RequiredCredentialRepresentation requiredCred : rep.getRequiredCredentials())
-      {
-         RequiredCredentialModel credential = new RequiredCredentialModel();
-         credential.setType(requiredCred.getType());
-         credential.setInput(requiredCred.isInput());
-         credential.setSecret(requiredCred.isSecret());
-         identityManager.create(realm, credential);
-      }
-
-      for (UserRepresentation userRep : rep.getUsers())
-      {
-         UserModel user = new UserModel();
-         user.setUsername(userRep.getUsername());
-         user.setEnabled(userRep.isEnabled());
-         user = identityManager.create(realm, user);
-         userMap.put(user.getUsername(), user);
-         if (userRep.getCredentials() != null)
-         {
-            for (UserRepresentation.Credential cred : userRep.getCredentials())
-            {
-               UserCredentialModel credential = new UserCredentialModel();
-               credential.setType(cred.getType());
-               credential.setValue(cred.getValue());
-               credential.setHashed(cred.isHashed());
-               identityManager.create(user, credential);
-            }
-         }
-
-         if (userRep.getAttributes() != null)
-         {
-            for (Map.Entry<String, String> entry : userRep.getAttributes().entrySet())
-            {
-               UserAttributeModel attribute = new UserAttributeModel();
-               attribute.setName(entry.getKey());
-               attribute.setValue(entry.getValue());
-               identityManager.create(user, attribute);
-            }
-         }
-      }
-
-      for (RoleMappingRepresentation mapping : rep.getRoleMappings())
-      {
-         RoleMappingModel roleMapping = createRoleMapping(userMap, mapping);
-         UserModel user = userMap.get(mapping.getUsername());
-         identityManager.create(realm, user, roleMapping);
-      }
-
-      if (rep.getScopeMappings() != null)
-      {
-         for (ScopeMappingRepresentation scope : rep.getScopeMappings())
-         {
-            ScopeMappingModel scopeMapping = createScopeMapping(userMap, scope);
-            UserModel user = userMap.get(scope.getUsername());
-            identityManager.create(realm, user, scopeMapping);
-
-         }
-      }
-
-      if (rep.getResources() != null)
-      {
-         for (ResourceRepresentation resourceRep : rep.getResources())
-         {
-            ResourceModel resource = new ResourceModel();
-            resource.setName(resourceRep.getName());
-            resource.setSurrogateAuthRequired(resourceRep.isSurrogateAuthRequired());
-            resource = identityManager.create(realm, resource);
-            if (resourceRep.getRoles() != null)
-            {
-               for (String role : resourceRep.getRoles())
-               {
-                  RoleModel r = identityManager.create(realm, resource, role);
-               }
-            }
-            if (resourceRep.getRoleMappings() != null)
-            {
-               for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
-               {
-                  RoleMappingModel roleMapping = createRoleMapping(userMap, mapping);
-                  UserModel user = userMap.get(mapping.getUsername());
-                  identityManager.create(realm, resource, user, roleMapping);
-               }
-            }
-            if (resourceRep.getScopeMappings() != null)
-            {
-               for (ScopeMappingRepresentation mapping : resourceRep.getScopeMappings())
-               {
-                  ScopeMappingModel scopeMapping = createScopeMapping(userMap, mapping);
-                  UserModel user = userMap.get(mapping.getUsername());
-                  identityManager.create(realm, resource, user, scopeMapping);
-               }
-            }
-
-         }
-      }
-      return realm;
-   }
-
-   protected RoleMappingModel createRoleMapping(Map<String, UserModel> userMap, RoleMappingRepresentation mapping)
-   {
-      RoleMappingModel roleMapping = new RoleMappingModel();
-      UserModel user = userMap.get(mapping.getUsername());
-      roleMapping.setUserid(user.getId());
-      if (mapping.getSurrogates() != null)
-      {
-         for (String s : mapping.getSurrogates())
-         {
-            UserModel surrogate = userMap.get(s);
-            roleMapping.getSurrogateIds().add(surrogate.getId());
-
-         }
-      }
-      for (String role : mapping.getRoles())
-      {
-         roleMapping.getRoles().add(role);
-      }
-      return roleMapping;
-   }
-
-   protected ScopeMappingModel createScopeMapping(Map<String, UserModel> userMap, ScopeMappingRepresentation mapping)
-   {
-      ScopeMappingModel scopeMapping = new ScopeMappingModel();
-      UserModel user = userMap.get(mapping.getUsername());
-      scopeMapping.setUserid(user.getId());
-      for (String role : mapping.getRoles())
-      {
-         scopeMapping.getRoles().add(role);
-      }
-      return scopeMapping;
-   }
-
-
-   protected void verifyRealmRepresentation(RealmRepresentation rep)
-   {
-      if (rep.getUsers() == null)
-      {
-         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                 .entity("No realm admin users defined for realm").type("text/plain").build());
-      }
-
-      if (rep.getRequiredCredentials() == null)
-      {
-         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                 .entity("Realm credential requirements not defined").type("text/plain").build());
-
-      }
-
-      if (rep.getRoleMappings() == null)
-      {
-         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                 .entity("No realm admin users defined for realm").type("text/plain").build());
-      }
-
-      HashMap<String, UserRepresentation> userReps = new HashMap<String, UserRepresentation>();
-      for (UserRepresentation userRep : rep.getUsers()) userReps.put(userRep.getUsername(), userRep);
-
-      // make sure there is a user that has admin privileges for the realm
-      Set<UserRepresentation> admins = new HashSet<UserRepresentation>();
-      for (RoleMappingRepresentation mapping : rep.getRoleMappings())
-      {
-         if (!userReps.containsKey(mapping.getUsername()))
-         {
-            throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                    .entity("No users declared for role mapping").type("text/plain").build());
-
-         }
-         for (String role : mapping.getRoles())
-         {
-            if (!role.equals("admin"))
-            {
-               throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                       .entity("There is only an 'admin' role for realms").type("text/plain").build());
-
-            }
-            else
-            {
-               admins.add(userReps.get(mapping.getUsername()));
-            }
-         }
-      }
-      if (admins.size() == 0)
-      {
-         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                 .entity("No realm admin users defined for realm").type("text/plain").build());
-      }
-
-      // override enabled to false if user does not have at least all of browser or client credentials
-      for (UserRepresentation userRep : rep.getUsers())
-      {
-         if (!userRep.isEnabled())
-         {
-            admins.remove(userRep);
-            continue;
-         }
-         if (userRep.getCredentials() == null)
-         {
-            admins.remove(userRep);
-            userRep.setEnabled(false);
-         }
-         else
-         {
-            boolean hasBrowserCredentials = true;
-            for (RequiredCredentialRepresentation credential : rep.getRequiredCredentials())
-            {
-               boolean hasCredential = false;
-               for (UserRepresentation.Credential cred : userRep.getCredentials())
-               {
-                  if (cred.getType().equals(credential.getType()))
-                  {
-                     hasCredential = true;
-                     break;
-                  }
-               }
-               if (!hasCredential)
-               {
-                  hasBrowserCredentials = false;
-                  break;
-               }
-            }
-            if (!hasBrowserCredentials)
-            {
-               userRep.setEnabled(false);
-               admins.remove(userRep);
-            }
-
-         }
-      }
-
-      if (admins.size() == 0)
-      {
-         throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                 .entity("No realm admin users are enabled or have appropriate credentials").type("text/plain").build());
-      }
-
-      if (rep.getResources() != null)
-      {
-         // check mappings
-         for (ResourceRepresentation resourceRep : rep.getResources())
-         {
-            if (resourceRep.getRoleMappings() != null)
-            {
-               for (RoleMappingRepresentation mapping : resourceRep.getRoleMappings())
-               {
-                  if (!userReps.containsKey(mapping.getUsername()))
-                  {
-                     throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                             .entity("No users declared for role mapping").type("text/plain").build());
-
-                  }
-                  if (mapping.getSurrogates() != null)
-                  {
-                     for (String surrogate : mapping.getSurrogates())
-                     {
-                        if (!userReps.containsKey(surrogate))
-                        {
-                           throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                                   .entity("No users declared for role mapping surrogate").type("text/plain").build());
-                        }
-                     }
-                  }
-                  for (String role : mapping.getRoles())
-                  {
-                     if (!resourceRep.getRoles().contains(role))
-                     {
-                        throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                                .entity("No resource role for role mapping").type("text/plain").build());
-                     }
-                  }
-               }
-            }
-         }
-      }
-   }
-   */
-
-}

services/src/test/java/org/keycloak/test/AdapterTest.java

@@ -7,13 +7,13 @@ import org.junit.FixMethodOrder;
 import org.junit.Test;
 import org.junit.runners.MethodSorters;
 import org.keycloak.representations.idm.RequiredCredentialRepresentation;
-import org.keycloak.services.model.RealmManager;
+import org.keycloak.services.models.RealmManager;
-import org.keycloak.services.model.RealmModel;
+import org.keycloak.services.models.RealmModel;
-import org.keycloak.services.model.RealmResourceRelationship;
+import org.keycloak.services.models.relationships.RealmResourceRelationship;
-import org.keycloak.services.model.RequiredCredentialModel;
+import org.keycloak.services.models.RequiredCredentialModel;
-import org.keycloak.services.model.RequiredCredentialRelationship;
+import org.keycloak.services.models.relationships.RequiredCredentialRelationship;
-import org.keycloak.services.model.ScopeRelationship;
+import org.keycloak.services.models.relationships.ScopeRelationship;
-import org.keycloak.services.model.UserCredentialModel;
+import org.keycloak.services.models.UserCredentialModel;
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.config.IdentityConfigurationBuilder;
 import org.picketlink.idm.credential.Credentials;