Merge branch 'KEYCLOAK-1113' of https://github.com/velias/keycloak into velias-KEYCLOAK-1113

Conflicts:
	services/src/main/java/org/keycloak/services/resources/LoginActionsService.java

forms/account-api/src/main/java/org/keycloak/account/AccountProvider.java

@@ -1,52 +1,55 @@
 package org.keycloak.account;
 
-import org.apache.http.client.methods.HttpHead;
+import java.util.List;
-import org.keycloak.events.Event;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.provider.Provider;
 
 import javax.ws.rs.core.HttpHeaders;
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
-import java.util.List;
+
+import org.keycloak.events.Event;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.utils.FormMessage;
+import org.keycloak.provider.Provider;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 public interface AccountProvider extends Provider {
 
-    AccountProvider setUriInfo(UriInfo uriInfo);
+	AccountProvider setUriInfo(UriInfo uriInfo);
 
-    AccountProvider setHttpHeaders(HttpHeaders httpHeaders);
+	AccountProvider setHttpHeaders(HttpHeaders httpHeaders);
 
-    Response createResponse(AccountPages page);
+	Response createResponse(AccountPages page);
 
-    AccountProvider setError(String message, Object ... parameters);
+	AccountProvider setError(String message, Object... parameters);
 
-    AccountProvider setSuccess(String message, Object ... parameters);
+	AccountProvider setErrors(List<FormMessage> messages);
 
-    AccountProvider setWarning(String message, Object ... parameters);
+	AccountProvider setSuccess(String message, Object... parameters);
 
-    AccountProvider setUser(UserModel user);
+	AccountProvider setWarning(String message, Object... parameters);
 
-    AccountProvider setProfileFormData(MultivaluedMap<String, String> formData);
+	AccountProvider setUser(UserModel user);
 
-    AccountProvider setStatus(Response.Status status);
+	AccountProvider setProfileFormData(MultivaluedMap<String, String> formData);
 
-    AccountProvider setRealm(RealmModel realm);
+	AccountProvider setStatus(Response.Status status);
 
-    AccountProvider setReferrer(String[] referrer);
+	AccountProvider setRealm(RealmModel realm);
 
-    AccountProvider setEvents(List<Event> events);
+	AccountProvider setReferrer(String[] referrer);
 
-    AccountProvider setSessions(List<UserSessionModel> sessions);
+	AccountProvider setEvents(List<Event> events);
 
-    AccountProvider setPasswordSet(boolean passwordSet);
+	AccountProvider setSessions(List<UserSessionModel> sessions);
 
-    AccountProvider setStateChecker(String stateChecker);
+	AccountProvider setPasswordSet(boolean passwordSet);
 
-    AccountProvider setFeatures(boolean social, boolean events, boolean passwordUpdateSupported);
+	AccountProvider setStateChecker(String stateChecker);
+
+	AccountProvider setFeatures(boolean social, boolean events, boolean passwordUpdateSupported);
 }

forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccountProvider.java

@@ -1,25 +1,54 @@
 package org.keycloak.account.freemarker;
 
+import java.io.IOException;
+import java.net.URI;
+import java.text.MessageFormat;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+
 import org.jboss.logging.Logger;
 import org.keycloak.account.AccountPages;
 import org.keycloak.account.AccountProvider;
-import org.keycloak.account.freemarker.model.*;
+import org.keycloak.account.freemarker.model.AccountBean;
+import org.keycloak.account.freemarker.model.AccountFederatedIdentityBean;
+import org.keycloak.account.freemarker.model.FeaturesBean;
+import org.keycloak.account.freemarker.model.LogBean;
+import org.keycloak.account.freemarker.model.PasswordBean;
+import org.keycloak.account.freemarker.model.RealmBean;
+import org.keycloak.account.freemarker.model.ReferrerBean;
+import org.keycloak.account.freemarker.model.SessionsBean;
+import org.keycloak.account.freemarker.model.TotpBean;
+import org.keycloak.account.freemarker.model.UrlBean;
 import org.keycloak.events.Event;
-import org.keycloak.freemarker.*;
+import org.keycloak.freemarker.BrowserSecurityHeaderSetup;
+import org.keycloak.freemarker.FreeMarkerException;
+import org.keycloak.freemarker.FreeMarkerUtil;
+import org.keycloak.freemarker.LocaleHelper;
+import org.keycloak.freemarker.Theme;
+import org.keycloak.freemarker.ThemeProvider;
+import org.keycloak.freemarker.beans.LocaleBean;
+import org.keycloak.freemarker.beans.MessageBean;
 import org.keycloak.freemarker.beans.MessageFormatterMethod;
+import org.keycloak.freemarker.beans.MessageType;
+import org.keycloak.freemarker.beans.MessagesPerFieldBean;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.utils.FormMessage;
 import org.keycloak.services.resources.flows.Urls;
 
-import javax.ws.rs.core.*;
-import java.io.IOException;
-import java.net.URI;
-import java.text.MessageFormat;
-import java.util.*;
-import org.keycloak.freemarker.beans.LocaleBean;
-
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -43,13 +72,10 @@ public class FreeMarkerAccountProvider implements AccountProvider {
     private FreeMarkerUtil freeMarker;
     private HttpHeaders headers;
 
-    public static enum MessageType {SUCCESS, WARNING, ERROR}
-
     private UriInfo uriInfo;
 
-    private String message;
+    private List<FormMessage> messages = null;
-    private Object[] parameters;
+    private MessageType messageType = MessageType.ERROR;
-    private MessageType messageType;
 
     public FreeMarkerAccountProvider(KeycloakSession session, FreeMarkerUtil freeMarker) {
         this.session = session;
@@ -87,13 +113,13 @@ public class FreeMarkerAccountProvider implements AccountProvider {
         }
 
         Locale locale = LocaleHelper.getLocale(realm, user, uriInfo, headers);
-        Properties messages;
+        Properties messagesBundle;
         try {
-            messages = theme.getMessages(locale);
+        	messagesBundle = theme.getMessages(locale);
-            attributes.put("msg", new MessageFormatterMethod(locale, messages));
+            attributes.put("msg", new MessageFormatterMethod(locale, messagesBundle));
         } catch (IOException e) {
             logger.warn("Failed to load messages", e);
-            messages = new Properties();
+            messagesBundle = new Properties();
         }
 
         URI baseUri = uriInfo.getBaseUri();
@@ -107,15 +133,19 @@ public class FreeMarkerAccountProvider implements AccountProvider {
             attributes.put("stateChecker", stateChecker);
         }
 
-        if (message != null) {
+        MessagesPerFieldBean messagesPerField = new MessagesPerFieldBean();
-            String formattedMessage;
+        if (messages != null) {
-            if(messages.containsKey(message)){
+            MessageBean wholeMessage = new MessageBean(null, messageType);
-                formattedMessage = new MessageFormat(messages.getProperty(message),locale).format(parameters);
+            for (FormMessage message : this.messages) {
-            }else{
+                String formattedMessageText = formatMessage(message, messagesBundle, locale);
-                formattedMessage = message;
+                if (formattedMessageText != null) {
+                    wholeMessage.appendSummaryLine(formattedMessageText);
+                    messagesPerField.addMessage(message.getField(), formattedMessageText, messageType);
+                }
             }
-            attributes.put("message", new MessageBean(formattedMessage, messageType));
+            attributes.put("message", wholeMessage);
         }
+        attributes.put("messagesPerField", messagesPerField);
 
         if (referrer != null) {
             attributes.put("referrer", new ReferrerBean(referrer));
@@ -134,7 +164,7 @@ public class FreeMarkerAccountProvider implements AccountProvider {
                     b = UriBuilder.fromUri(baseQueryUri).path(uriInfo.getPath());
                     break;
             }
-            attributes.put("locale", new LocaleBean(realm, locale, b, messages));
+            attributes.put("locale", new LocaleBean(realm, locale, b, messagesBundle));
         }
 
         attributes.put("features", new FeaturesBean(identityProviderEnabled, eventsEnabled, passwordUpdateSupported));
@@ -173,28 +203,47 @@ public class FreeMarkerAccountProvider implements AccountProvider {
         this.passwordSet = passwordSet;
         return this;
     }
+    
+	protected void setMessage(MessageType type, String message, Object... parameters) {
+		messageType = type;
+		messages = new ArrayList<>();
+		messages.add(new FormMessage(null, message, parameters));
+	}
+
+	protected String formatMessage(FormMessage message, Properties messagesBundle, Locale locale) {
+		if (message == null)
+			return null;
+		if (messagesBundle.containsKey(message.getMessage())) {
+			return new MessageFormat(messagesBundle.getProperty(message.getMessage()), locale)
+					.format(message.getParameters());
+		} else {
+			return message.getMessage();
+		}
+	}
+  
+  @Override
+	public AccountProvider setErrors(List<FormMessage> messages) {
+		this.messageType = MessageType.ERROR;
+		this.messages = new ArrayList<>(messages);
+		return this;
+	}
+
 
     @Override
     public AccountProvider setError(String message, Object ... parameters) {
-        this.message = message;
+    	  setMessage(MessageType.ERROR, message, parameters);
-        this.parameters = parameters;
-        this.messageType = MessageType.ERROR;
         return this;
     }
 
     @Override
     public AccountProvider setSuccess(String message, Object ... parameters) {
-        this.message = message;
+    	  setMessage(MessageType.SUCCESS, message, parameters);
-        this.parameters = parameters;
-        this.messageType = MessageType.SUCCESS;
         return this;
     }
 
     @Override
     public AccountProvider setWarning(String message, Object ... parameters) {
-        this.message = message;
+    	  setMessage(MessageType.WARNING, message, parameters);
-        this.parameters = parameters;
-        this.messageType = MessageType.WARNING;
         return this;
     }
 

forms/common-freemarker/src/main/java/org/keycloak/freemarker/beans/MessageBean.java

@@ -19,9 +19,7 @@
  * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
-package org.keycloak.account.freemarker.model;
+package org.keycloak.freemarker.beans;
-
-import org.keycloak.account.freemarker.FreeMarkerAccountProvider;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -30,9 +28,9 @@ public class MessageBean {
 
     private String summary;
 
-    private FreeMarkerAccountProvider.MessageType type;
+    private MessageType type;
 
-    public MessageBean(String message, FreeMarkerAccountProvider.MessageType type) {
+    public MessageBean(String message, MessageType type) {
         this.summary = message;
         this.type = type;
     }
@@ -41,20 +39,29 @@ public class MessageBean {
         return summary;
     }
 
+    public void appendSummaryLine(String newLine) {
+        if (newLine == null)
+            return;
+        if (summary == null)
+            summary = newLine;
+        else
+            summary = summary + "<br>" + newLine;
+    }
+
     public String getType() {
         return this.type.toString().toLowerCase();
     }
 
     public boolean isSuccess() {
-        return FreeMarkerAccountProvider.MessageType.SUCCESS.equals(this.type);
+        return MessageType.SUCCESS.equals(this.type);
     }
 
     public boolean isWarning() {
-        return FreeMarkerAccountProvider.MessageType.WARNING.equals(this.type);
+        return MessageType.WARNING.equals(this.type);
     }
 
     public boolean isError() {
-        return FreeMarkerAccountProvider.MessageType.ERROR.equals(this.type);
+        return MessageType.ERROR.equals(this.type);
     }
 
 }

forms/common-freemarker/src/main/java/org/keycloak/freemarker/beans/MessageType.java

@@ -0,0 +1,17 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ */
+package org.keycloak.freemarker.beans;
+
+/**
+ * Enum with types of messages.
+ *
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public enum MessageType {
+	
+	SUCCESS, WARNING, ERROR
+
+}

forms/common-freemarker/src/main/java/org/keycloak/freemarker/beans/MessagesPerFieldBean.java

@@ -0,0 +1,73 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ */
+package org.keycloak.freemarker.beans;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Bean used to hold form messages per field. Stored under <code>messagesPerField</code> key in Freemarker context.
+ * 
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public class MessagesPerFieldBean {
+
+    private Map<String, MessageBean> messagesPerField = new HashMap<String, MessageBean>();
+
+    public void addMessage(String field, String messageText, MessageType messageType) {
+        if (messageText == null || messageText.trim().isEmpty())
+            return;
+        if (field == null)
+            field = "global";
+
+        MessageBean fm = messagesPerField.get(field);
+        if (fm == null) {
+            messagesPerField.put(field, new MessageBean(messageText, messageType));
+        } else {
+            fm.appendSummaryLine(messageText);
+        }
+    }
+
+    /**
+     * Check if message for given field exists
+     * 
+     * @param field
+     * @return
+     */
+    public boolean exists(String field) {
+        return messagesPerField.containsKey(field);
+    }
+
+    /**
+     * Get message for given field.
+     * 
+     * @param fieldName
+     * @return message text or empty string
+     */
+    public String get(String fieldName) {
+        MessageBean mb = messagesPerField.get(fieldName);
+        if (mb != null) {
+            return mb.getSummary();
+        } else {
+            return "";
+        }
+    }
+
+    /**
+     * Print text if message for given field exists. Useful eg. to add css styles for fields with message.
+     * 
+     * @param fieldName to check for
+     * @param text to print
+     * @return text if message exists for given field, else empty string
+     */
+    public String printIfExists(String fieldName, String text) {
+        if (exists(fieldName))
+            return text;
+        else
+            return "";
+    }
+
+}

forms/common-themes/src/main/resources/theme/base/account/account.ftl

@@ -14,7 +14,7 @@
 
         <input type="hidden" id="stateChecker" name="stateChecker" value="${stateChecker}">
 
-        <div class="form-group">
+        <div class="form-group ${messagesPerField.printIfExists('username','has-error')}">
             <div class="col-sm-2 col-md-2">
                 <label for="username" class="control-label">${msg("username")}</label>
             </div>
@@ -24,7 +24,7 @@
             </div>
         </div>
 
-        <div class="form-group">
+        <div class="form-group ${messagesPerField.printIfExists('email','has-error')}">
             <div class="col-sm-2 col-md-2">
             <label for="email" class="control-label">${msg("email")}</label> <span class="required">*</span>
             </div>
@@ -34,7 +34,7 @@
             </div>
         </div>
 
-        <div class="form-group">
+        <div class="form-group ${messagesPerField.printIfExists('firstName','has-error')}">
             <div class="col-sm-2 col-md-2">
                 <label for="firstName" class="control-label">${msg("firstName")}</label> <span class="required">*</span>
             </div>
@@ -44,7 +44,7 @@
             </div>
         </div>
 
-        <div class="form-group">
+        <div class="form-group ${messagesPerField.printIfExists('lastName','has-error')}">
             <div class="col-sm-2 col-md-2">
                 <label for="lastName" class="control-label">${msg("lastName")}</label> <span class="required">*</span>
             </div>

forms/common-themes/src/main/resources/theme/base/login/login-update-profile.ftl

@@ -6,7 +6,7 @@
         ${msg("loginProfileTitle")}
     <#elseif section = "form">
         <form id="kc-update-profile-form" class="${properties.kcFormClass!}" action="${url.loginUpdateProfileUrl}" method="post">
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('email',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="email" class="${properties.kcLabelClass!}">${msg("email")}</label>
                 </div>
@@ -15,7 +15,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('firstName',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="firstName" class="${properties.kcLabelClass!}">${msg("firstName")}</label>
                 </div>
@@ -24,7 +24,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('lastName',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="lastName" class="${properties.kcLabelClass!}">${msg("lastName")}</label>
                 </div>

forms/common-themes/src/main/resources/theme/base/login/register.ftl

@@ -7,7 +7,7 @@
     <#elseif section = "form">
         <form id="kc-register-form" class="${properties.kcFormClass!}" action="${url.registrationAction}" method="post">
           <#if !realm.registrationEmailAsUsername>
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('username',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="username" class="${properties.kcLabelClass!}">${msg("username")}</label>
                 </div>
@@ -16,7 +16,7 @@
                 </div>
             </div>
           </#if>
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('firstName',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="firstName" class="${properties.kcLabelClass!}">${msg("firstName")}</label>
                 </div>
@@ -25,7 +25,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('lastName',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="lastName" class="${properties.kcLabelClass!}">${msg("lastName")}</label>
                 </div>
@@ -34,7 +34,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('email',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="email" class="${properties.kcLabelClass!}">${msg("email")}</label>
                 </div>
@@ -43,7 +43,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('password',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="password" class="${properties.kcLabelClass!}">${msg("password")}</label>
                 </div>
@@ -52,7 +52,7 @@
                 </div>
             </div>
 
-            <div class="${properties.kcFormGroupClass!}">
+            <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('password-confirm',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="password-confirm" class="${properties.kcLabelClass!}">${msg("passwordConfirm")}</label>
                 </div>

forms/common-themes/src/main/resources/theme/patternfly/login/theme.properties

@@ -18,6 +18,7 @@ kcFormAreaClass=col-xs-12 col-sm-8 col-md-8 col-lg-6 login
 
 kcFormClass=form-horizontal
 kcFormGroupClass=form-group
+kcFormGroupErrorClass=has-error
 kcLabelClass=control-label
 kcLabelWrapperClass=col-xs-12 col-sm-12 col-md-4 col-lg-3
 kcInputClass=form-control

forms/login-api/src/main/java/org/keycloak/login/LoginFormsProvider.java

@@ -1,19 +1,21 @@
 package org.keycloak.login;
 
+import java.net.URI;
+import java.util.List;
+
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.ClientSessionModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.FormMessage;
 import org.keycloak.provider.Provider;
 
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
-import java.net.URI;
-import java.util.List;
-
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -48,7 +50,20 @@ public interface LoginFormsProvider extends Provider {
     public LoginFormsProvider setAccessRequest(List<RoleModel> realmRolesRequested, MultivaluedMap<String,RoleModel> resourceRolesRequested);
     public LoginFormsProvider setAccessRequest(String message);
 
+    /**
+     * Set one global error message.
+     * 
+     * @param message key of message
+     * @param parameters to be formatted into message
+     */
     public LoginFormsProvider setError(String message, Object ... parameters);
+    
+    /**
+     * Set multiple error messages.
+     * 
+     * @param messages to be set
+     */
+    public LoginFormsProvider setErrors(List<FormMessage> messages);
 
     public LoginFormsProvider setSuccess(String message, Object ... parameters);
 

forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/FreeMarkerLoginFormsProvider.java

@@ -1,25 +1,50 @@
 package org.keycloak.login.freemarker;
 
+import java.io.IOException;
+import java.net.URI;
+import java.text.MessageFormat;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.TimeUnit;
+
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriBuilder;
+import javax.ws.rs.core.UriInfo;
+
 import org.jboss.logging.Logger;
 import org.jboss.resteasy.specimpl.MultivaluedMapImpl;
 import org.keycloak.OAuth2Constants;
 import org.keycloak.email.EmailException;
 import org.keycloak.email.EmailProvider;
-import org.keycloak.freemarker.*;
+import org.keycloak.freemarker.BrowserSecurityHeaderSetup;
+import org.keycloak.freemarker.FreeMarkerException;
+import org.keycloak.freemarker.FreeMarkerUtil;
+import org.keycloak.freemarker.LocaleHelper;
+import org.keycloak.freemarker.Theme;
+import org.keycloak.freemarker.ThemeProvider;
 import org.keycloak.freemarker.beans.AdvancedMessageFormatterMethod;
+import org.keycloak.freemarker.beans.LocaleBean;
+import org.keycloak.freemarker.beans.MessageBean;
 import org.keycloak.freemarker.beans.MessageFormatterMethod;
+import org.keycloak.freemarker.beans.MessageType;
+import org.keycloak.freemarker.beans.MessagesPerFieldBean;
 import org.keycloak.login.LoginFormsPages;
 import org.keycloak.login.LoginFormsProvider;
 import org.keycloak.login.freemarker.model.ClientBean;
 import org.keycloak.login.freemarker.model.CodeBean;
-import org.keycloak.freemarker.beans.LocaleBean;
+import org.keycloak.login.freemarker.model.IdentityProviderBean;
 import org.keycloak.login.freemarker.model.LoginBean;
-import org.keycloak.login.freemarker.model.MessageBean;
 import org.keycloak.login.freemarker.model.OAuthGrantBean;
 import org.keycloak.login.freemarker.model.ProfileBean;
 import org.keycloak.login.freemarker.model.RealmBean;
 import org.keycloak.login.freemarker.model.RegisterBean;
-import org.keycloak.login.freemarker.model.IdentityProviderBean;
 import org.keycloak.login.freemarker.model.TotpBean;
 import org.keycloak.login.freemarker.model.UrlBean;
 import org.keycloak.models.ClientModel;
@@ -28,16 +53,10 @@ import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.FormMessage;
 import org.keycloak.services.messages.Messages;
 import org.keycloak.services.resources.flows.Urls;
 
-import javax.ws.rs.core.*;
-import java.io.IOException;
-import java.net.URI;
-import java.text.MessageFormat;
-import java.util.*;
-import java.util.concurrent.TimeUnit;
-
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
@@ -45,8 +64,6 @@ import java.util.concurrent.TimeUnit;
 
     private static final Logger logger = Logger.getLogger(FreeMarkerLoginFormsProvider.class);
 
-    public static enum MessageType {SUCCESS, WARNING, ERROR}
-
     private String accessCode;
     private Response.Status status;
     private List<RoleModel> realmRolesRequested;
@@ -55,9 +72,8 @@ import java.util.concurrent.TimeUnit;
     private Map<String, String> httpResponseHeaders = new HashMap<String, String>();
     private String accessRequestMessage;
     private URI actionUri;
-    private Object[] parameters;
 
-    private String message;
+    private List<FormMessage> messages = null;
     private MessageType messageType = MessageType.ERROR;
 
     private MultivaluedMap<String, String> formData;
@@ -134,7 +150,7 @@ import java.util.concurrent.TimeUnit;
                 return Response.serverError().build();
         }
 
-        if (message == null) {
+        if (messages == null) {
             setWarning(actionMessage);
         }
 
@@ -175,25 +191,30 @@ import java.util.concurrent.TimeUnit;
             logger.warn("Failed to load properties", e);
         }
 
-        Properties messages;
+        Properties messagesBundle;
         Locale locale = LocaleHelper.getLocale(realm, user, uriInfo, httpHeaders);
         try {
-            messages = theme.getMessages(locale);
+            messagesBundle = theme.getMessages(locale);
-            attributes.put("msg", new MessageFormatterMethod(locale, messages));
+            attributes.put("msg", new MessageFormatterMethod(locale, messagesBundle));
         } catch (IOException e) {
             logger.warn("Failed to load messages", e);
-            messages = new Properties();
+            messagesBundle = new Properties();
         }
 
-        if (message != null) {
+        MessagesPerFieldBean messagesPerField = new MessagesPerFieldBean();
-            String formattedMessage;
+        if (messages != null) {
-            if(messages.containsKey(message)){
+            MessageBean wholeMessage = new MessageBean(null, messageType);
-                formattedMessage = new MessageFormat(messages.getProperty(message),locale).format(parameters);
+            for (FormMessage message : this.messages) {
-            }else{
+                String formattedMessageText = formatMessage(message, messagesBundle, locale);
-                formattedMessage = message;
+                if (formattedMessageText != null) {
+                    wholeMessage.appendSummaryLine(formattedMessageText);
+                    messagesPerField.addMessage(message.getField(), formattedMessageText, messageType);
+                }
             }
-            attributes.put("message", new MessageBean(formattedMessage, messageType));
+            attributes.put("message", wholeMessage);
         }
+        attributes.put("messagesPerField", messagesPerField);
+
         if (page == LoginFormsPages.OAUTH_GRANT) {
             // for some reason Resteasy 2.3.7 doesn't like query params and form params with the same name and will null out the code form param
             uriBuilder.replaceQuery(null);
@@ -218,7 +239,7 @@ import java.util.concurrent.TimeUnit;
                         b = UriBuilder.fromUri(baseUri).path(uriInfo.getPath());
                         break;
                 }
-                attributes.put("locale", new LocaleBean(realm, locale, b, messages));
+                attributes.put("locale", new LocaleBean(realm, locale, b, messagesBundle));
             }
         }
 
@@ -240,10 +261,10 @@ import java.util.concurrent.TimeUnit;
                 break;
             case OAUTH_GRANT:
                 attributes.put("oauth", new OAuthGrantBean(accessCode, clientSession, client, realmRolesRequested, resourceRolesRequested, this.accessRequestMessage));
-                attributes.put("advancedMsg", new AdvancedMessageFormatterMethod(locale, messages));
+                attributes.put("advancedMsg", new AdvancedMessageFormatterMethod(locale, messagesBundle));
                 break;
             case CODE:
-                attributes.put(OAuth2Constants.CODE, new CodeBean(accessCode, messageType == MessageType.ERROR ? message : null));
+                attributes.put(OAuth2Constants.CODE, new CodeBean(accessCode, messageType == MessageType.ERROR ? getFirstMessageUnformatted() : null));
                 break;
         }
 
@@ -303,24 +324,51 @@ import java.util.concurrent.TimeUnit;
         return createResponse(LoginFormsPages.CODE);
     }
 
-    public FreeMarkerLoginFormsProvider setError(String message, Object ... parameters) {
+    protected void setMessage(MessageType type, String message, Object... parameters) {
-        this.message = message;
+        messageType = type;
+        messages = new ArrayList<>();
+        messages.add(new FormMessage(null, message, parameters));
+    }
+
+    protected String getFirstMessageUnformatted() {
+        if (messages != null && !messages.isEmpty()) {
+            return messages.get(0).getMessage();
+        }
+        return null;
+    }
+
+    protected String formatMessage(FormMessage message, Properties messagesBundle, Locale locale) {
+        if (message == null)
+            return null;
+        if (messagesBundle.containsKey(message.getMessage())) {
+            return new MessageFormat(messagesBundle.getProperty(message.getMessage()), locale).format(message.getParameters());
+        } else {
+            return message.getMessage();
+        }
+    }
+
+    @Override
+    public FreeMarkerLoginFormsProvider setError(String message, Object... parameters) {
+        setMessage(MessageType.ERROR, message, parameters);
+        return this;
+    }
+
+    @Override
+    public LoginFormsProvider setErrors(List<FormMessage> messages) {
         this.messageType = MessageType.ERROR;
-        this.parameters = parameters;
+        this.messages = new ArrayList<>(messages);
         return this;
     }
 
+    @Override
     public FreeMarkerLoginFormsProvider setSuccess(String message, Object ... parameters) {
-        this.message = message;
+        setMessage(MessageType.SUCCESS, message, parameters);
-        this.messageType = MessageType.SUCCESS;
-        this.parameters = parameters;
         return this;
     }
 
+    @Override
     public FreeMarkerLoginFormsProvider setWarning(String message, Object ... parameters) {
-        this.message = message;
+        setMessage(MessageType.WARNING, message, parameters);
-        this.messageType = MessageType.WARNING;
-        this.parameters = parameters;
         return this;
     }
 

forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/model/MessageBean.java

@@ -1,60 +0,0 @@
-/*
- * JBoss, Home of Professional Open Source.
- * Copyright 2012, Red Hat, Inc., and individual contributors
- * as indicated by the @author tags. See the copyright.txt file in the
- * distribution for a full listing of individual contributors.
- *
- * This is free software; you can redistribute it and/or modify it
- * under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This software is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this software; if not, write to the Free
- * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
- */
-package org.keycloak.login.freemarker.model;
-
-import org.keycloak.login.freemarker.FreeMarkerLoginFormsProvider;
-
-/**
- * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
- */
-public class MessageBean {
-
-    private String summary;
-
-    private FreeMarkerLoginFormsProvider.MessageType type;
-
-    public MessageBean(String message, FreeMarkerLoginFormsProvider.MessageType type) {
-        this.summary = message;
-        this.type = type;
-    }
-
-    public String getSummary() {
-        return summary;
-    }
-
-    public String getType() {
-        return this.type.toString().toLowerCase();
-    }
-
-    public boolean isSuccess() {
-        return FreeMarkerLoginFormsProvider.MessageType.SUCCESS.equals(this.type);
-    }
-
-    public boolean isWarning() {
-        return FreeMarkerLoginFormsProvider.MessageType.WARNING.equals(this.type);
-    }
-
-    public boolean isError() {
-        return FreeMarkerLoginFormsProvider.MessageType.ERROR.equals(this.type);
-    }
-
-}

model/api/src/main/java/org/keycloak/models/utils/FormMessage.java

@@ -0,0 +1,69 @@
+/*
+ * JBoss, Home of Professional Open Source
+ * Copyright 2015 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @authors tag. All rights reserved.
+ */
+package org.keycloak.models.utils;
+
+import java.util.Arrays;
+
+/**
+ * Message (eg. error) to be shown in form.
+ * 
+ * @author Vlastimil Elias (velias at redhat dot com)
+ */
+public class FormMessage {
+
+	/**
+	 * Value used for {@link #field} if message is global (not tied to any specific form field)
+	 */
+	public static final String GLOBAL = "global";
+
+	private String field;
+	private String message;
+	private Object[] parameters;
+
+	/**
+	 * Create message.
+	 * 
+	 * @param field this message is for. {@link #GLOBAL} is used if null
+	 * @param message key for the message
+	 * @param parameters to be formatted into message
+	 */
+	public FormMessage(String field, String message, Object... parameters) {
+		this(field, message);
+		this.parameters = parameters;
+	}
+	
+	/**
+     * Create message without parameters.
+     * 
+     * @param field this message is for. {@link #GLOBAL} is used if null
+     * @param message key for the message
+     */
+    public FormMessage(String field, String message) {
+        super();
+        if (field == null)
+            field = GLOBAL;
+        this.field = field;
+        this.message = message;
+    }
+
+	public String getField() {
+		return field;
+	}
+
+	public String getMessage() {
+		return message;
+	}
+
+	public Object[] getParameters() {
+		return parameters;
+	}
+
+	@Override
+	public String toString() {
+		return "FormMessage [field=" + field + ", message=" + message + ", parameters=" + Arrays.toString(parameters) + "]";
+	}
+
+}

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -33,6 +33,7 @@ import org.keycloak.events.EventBuilder;
 import org.keycloak.events.EventStoreProvider;
 import org.keycloak.events.EventType;
 import org.keycloak.models.*;
+import org.keycloak.models.utils.FormMessage;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.models.utils.TimeBasedOTP;
 import org.keycloak.protocol.oidc.OIDCLoginProtocol;
@@ -69,6 +70,7 @@ import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
 import javax.ws.rs.core.Variant;
+
 import java.lang.reflect.Method;
 import java.net.URI;
 import java.util.HashSet;
@@ -403,10 +405,10 @@ public class AccountService {
 
         UserModel user = auth.getUser();
 
-        String error = Validation.validateUpdateProfileForm(formData);
+        List<FormMessage> errors = Validation.validateUpdateProfileForm(formData);
-        if (error != null) {
+        if (errors != null && !errors.isEmpty()) {
             setReferrerOnPage();
-            return account.setError(error).setProfileFormData(formData).createResponse(AccountPages.ACCOUNT);
+            return account.setErrors(errors).setProfileFormData(formData).createResponse(AccountPages.ACCOUNT);
         }
 
         try {

services/src/main/java/org/keycloak/services/validation/Validation.java

@@ -1,75 +1,90 @@
 package org.keycloak.services.validation;
 
-import org.keycloak.models.PasswordPolicy;
+import java.util.ArrayList;
-import org.keycloak.models.RealmModel;
-import org.keycloak.representations.idm.CredentialRepresentation;
-import org.keycloak.services.messages.Messages;
-
-import javax.ws.rs.core.MultivaluedMap;
 import java.util.List;
 import java.util.regex.Pattern;
 
+import javax.ws.rs.core.MultivaluedMap;
+
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.utils.FormMessage;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.services.messages.Messages;
+
 public class Validation {
 
+    public static final String FIELD_PASSWORD_CONFIRM = "password-confirm";
+    public static final String FIELD_EMAIL = "email";
+    public static final String FIELD_LAST_NAME = "lastName";
+    public static final String FIELD_FIRST_NAME = "firstName";
+    public static final String FIELD_PASSWORD = "password";
+    public static final String FIELD_USERNAME = "username";
+    
     // Actually allow same emails like angular. See ValidationTest.testEmailValidation()
     private static final Pattern EMAIL_PATTERN = Pattern.compile("[a-zA-Z0-9!#$%&'*+/=?^_`{|}~.-]+@[a-zA-Z0-9-]+(\\.[a-zA-Z0-9-]+)*");
 
-    public static String validateRegistrationForm(RealmModel realm, MultivaluedMap<String, String> formData, List<String> requiredCredentialTypes) {
+    public static List<FormMessage> validateRegistrationForm(RealmModel realm, MultivaluedMap<String, String> formData, List<String> requiredCredentialTypes, PasswordPolicy policy) {
-        if (isEmpty(formData.getFirst("firstName"))) {
+        List<FormMessage> errors = new ArrayList<>();
-            return Messages.MISSING_FIRST_NAME;
+
+        if (!realm.isRegistrationEmailAsUsername() && isEmpty(formData.getFirst(FIELD_USERNAME))) {
+            addError(errors, FIELD_USERNAME, Messages.MISSING_USERNAME);
         }
 
-        if (isEmpty(formData.getFirst("lastName"))) {
+        if (isEmpty(formData.getFirst(FIELD_FIRST_NAME))) {
-            return Messages.MISSING_LAST_NAME;
+            addError(errors, FIELD_FIRST_NAME, Messages.MISSING_FIRST_NAME);
         }
 
-        if (isEmpty(formData.getFirst("email"))) {
+        if (isEmpty(formData.getFirst(FIELD_LAST_NAME))) {
-            return Messages.MISSING_EMAIL;
+            addError(errors, FIELD_LAST_NAME, Messages.MISSING_LAST_NAME);
         }
 
-        if (!isEmailValid(formData.getFirst("email"))) {
+        if (isEmpty(formData.getFirst(FIELD_EMAIL))) {
-            return Messages.INVALID_EMAIL;
+            addError(errors, FIELD_EMAIL, Messages.MISSING_EMAIL);
-        }
+        } else if (!isEmailValid(formData.getFirst(FIELD_EMAIL))) {
-
+            addError(errors, FIELD_EMAIL, Messages.INVALID_EMAIL);
-        if (!realm.isRegistrationEmailAsUsername() && isEmpty(formData.getFirst("username"))) {
-            return Messages.MISSING_USERNAME;
         }
 
         if (requiredCredentialTypes.contains(CredentialRepresentation.PASSWORD)) {
-            if (isEmpty(formData.getFirst(CredentialRepresentation.PASSWORD))) {
+            if (isEmpty(formData.getFirst(FIELD_PASSWORD))) {
-                return Messages.MISSING_PASSWORD;
+                addError(errors, FIELD_PASSWORD, Messages.MISSING_PASSWORD);
-            }
+            } else if (!formData.getFirst(FIELD_PASSWORD).equals(formData.getFirst(FIELD_PASSWORD_CONFIRM))) {
-
+                addError(errors, FIELD_PASSWORD_CONFIRM, Messages.INVALID_PASSWORD_CONFIRM);
-            if (!formData.getFirst("password").equals(formData.getFirst("password-confirm"))) {
-                return Messages.INVALID_PASSWORD_CONFIRM;
             }
         }
 
-        return null;
+        if (formData.getFirst(FIELD_PASSWORD) != null) {
+            PasswordPolicy.Error err = policy.validate(realm.isRegistrationEmailAsUsername()?formData.getFirst(FIELD_EMAIL):formData.getFirst(FIELD_USERNAME), formData.getFirst(FIELD_PASSWORD));
+            if (err != null)
+                errors.add(new FormMessage(FIELD_PASSWORD, err.getMessage(), err.getParameters()));
+        }
+        
+        return errors;
+    }
+    
+    private static void addError(List<FormMessage> errors, String field, String message){
+        errors.add(new FormMessage(field, message));
     }
 
-    public static PasswordPolicy.Error validatePassword(MultivaluedMap<String, String> formData, PasswordPolicy policy) {
-        return policy.validate(formData.getFirst("username"), formData.getFirst("password"));
-    }
 
-    public static String validateUpdateProfileForm(MultivaluedMap<String, String> formData) {
+    public static List<FormMessage> validateUpdateProfileForm(MultivaluedMap<String, String> formData) {
-        if (isEmpty(formData.getFirst("firstName"))) {
+        List<FormMessage> errors = new ArrayList<>();
-            return Messages.MISSING_FIRST_NAME;
+        
+        if (isEmpty(formData.getFirst(FIELD_FIRST_NAME))) {
+            addError(errors, FIELD_FIRST_NAME, Messages.MISSING_FIRST_NAME);
         }
 
-        if (isEmpty(formData.getFirst("lastName"))) {
+        if (isEmpty(formData.getFirst(FIELD_LAST_NAME))) {
-            return Messages.MISSING_LAST_NAME;
+            addError(errors, FIELD_LAST_NAME, Messages.MISSING_LAST_NAME);
         }
 
-        if (isEmpty(formData.getFirst("email"))) {
+        if (isEmpty(formData.getFirst(FIELD_EMAIL))) {
-            return Messages.MISSING_EMAIL;
+            addError(errors, FIELD_EMAIL, Messages.MISSING_EMAIL);
+        } else if (!isEmailValid(formData.getFirst(FIELD_EMAIL))) {
+            addError(errors, FIELD_EMAIL, Messages.INVALID_EMAIL);
         }
 
-        if (!isEmailValid(formData.getFirst("email"))) {
+        return errors;
-            return Messages.INVALID_EMAIL;
-        }
-
-        return null;
     }
 
     public static boolean isEmpty(String s) {