keycloak-memoizeit

diff --git a/audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListener.java b/audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListener.java
old mode 100644
new mode 100755
index 53a8fcd..6f50c4e
--- a/audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListener.java
+++ b/audit/email/src/main/java/org/keycloak/audit/email/EmailAuditListener.java
@@ -7,6 +7,7 @@ import org.keycloak.audit.EventType;
 import org.keycloak.email.EmailException;
 import org.keycloak.email.EmailProvider;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 
@@ -20,11 +21,13 @@ public class EmailAuditListener implements AuditListener {
     private static final Logger log = Logger.getLogger(EmailAuditListener.class);
 
     private KeycloakSession session;
+    private RealmProvider model;
     private EmailProvider emailProvider;
     private Set<EventType> includedEvents;
 
     public EmailAuditListener(KeycloakSession session, EmailProvider emailProvider, Set<EventType> includedEvents) {
         this.session = session;
+        this.model = session.realms();
         this.emailProvider = emailProvider;
         this.includedEvents = includedEvents;
     }
@@ -33,8 +36,8 @@ public class EmailAuditListener implements AuditListener {
     public void onEvent(Event event) {
         if (includedEvents.contains(event.getEvent())) {
             if (event.getRealmId() != null && event.getUserId() != null) {
-                RealmModel realm = session.getRealm(event.getRealmId());
-                UserModel user = realm.getUserById(event.getUserId());
+                RealmModel realm = model.getRealm(event.getRealmId());
+                UserModel user = session.users().getUserById(event.getUserId(), realm);
                 if (user != null && user.getEmail() != null && user.isEmailVerified()) {
                     try {
                         emailProvider.setRealm(realm).setUser(user).sendEvent(event);

diff --git a/audit/jpa/pom.xml b/audit/jpa/pom.xml
index db0a350..dd725b8 100755
--- a/audit/jpa/pom.xml
+++ b/audit/jpa/pom.xml
@@ -27,13 +27,13 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-api</artifactId>
+            <artifactId>keycloak-connections-jpa</artifactId>
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-tests</artifactId>
+            <artifactId>keycloak-audit-api</artifactId>
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
@@ -58,16 +58,5 @@
             <artifactId>jackson-core-asl</artifactId>
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>com.h2database</groupId>
-            <artifactId>h2</artifactId>
-            <scope>test</scope>
-        </dependency>
    </dependencies>
-
 </project>

diff --git a/audit/jpa/src/main/java/org/keycloak/audit/jpa/EventEntity.java b/audit/jpa/src/main/java/org/keycloak/audit/jpa/EventEntity.java
index f191813..b22b576 100644
--- a/audit/jpa/src/main/java/org/keycloak/audit/jpa/EventEntity.java
+++ b/audit/jpa/src/main/java/org/keycloak/audit/jpa/EventEntity.java
@@ -3,33 +3,44 @@ package org.keycloak.audit.jpa;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.Id;
+import javax.persistence.Table;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
  */
 @Entity
+@Table(name="EVENT_ENTITY")
 public class EventEntity {
 
     @Id
+    @Column(name="ID", length = 36)
     private String id;
 
+    @Column(name="TIME")
     private long time;
 
+    @Column(name="EVENT")
     private String event;
 
+    @Column(name="REALM_ID")
     private String realmId;
 
+    @Column(name="CLIENT_ID")
     private String clientId;
 
+    @Column(name="USER_ID")
     private String userId;
 
+    @Column(name="SESSION_ID")
     private String sessionId;
 
+    @Column(name="IP_ADDRESS")
     private String ipAddress;
 
+    @Column(name="ERROR")
     private String error;
 
-    @Column(length = 2550)
+    @Column(name="DETAILS_JSON", length = 2550)
     private String detailsJson;
 
     public String getId() {

diff --git a/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProvider.java b/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProvider.java
index d6366b3..ee2f7e9 100644
--- a/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProvider.java
+++ b/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProvider.java
@@ -41,44 +41,28 @@ public class JpaAuditProvider implements AuditProvider {
 
     @Override
     public void clear() {
-        beginTx();
         em.createQuery("delete from EventEntity").executeUpdate();
     }
 
     @Override
     public void clear(String realmId) {
-        beginTx();
         em.createQuery("delete from EventEntity where realmId = :realmId").setParameter("realmId", realmId).executeUpdate();
     }
 
     @Override
     public void clear(String realmId, long olderThan) {
-        beginTx();
         em.createQuery("delete from EventEntity where realmId = :realmId and time < :time").setParameter("realmId", realmId).setParameter("time", olderThan).executeUpdate();
     }
 
     @Override
     public void onEvent(Event event) {
         if (includedEvents.contains(event.getEvent())) {
-            beginTx();
             em.persist(convert(event));
         }
     }
 
     @Override
     public void close() {
-        if (tx != null) {
-            tx.commit();
-        }
-
-        em.close();
-    }
-
-    private void beginTx() {
-        if (tx == null) {
-            tx = em.getTransaction();
-            tx.begin();
-        }
     }
 
     static EventEntity convert(Event o) {

diff --git a/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java b/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java
index 2e01171..c471a7d 100644
--- a/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java
+++ b/audit/jpa/src/main/java/org/keycloak/audit/jpa/JpaAuditProviderFactory.java
@@ -4,11 +4,9 @@ import org.keycloak.Config;
 import org.keycloak.audit.AuditProvider;
 import org.keycloak.audit.AuditProviderFactory;
 import org.keycloak.audit.EventType;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.util.JpaUtils;
 
-import javax.persistence.EntityManagerFactory;
-import javax.persistence.Persistence;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -18,19 +16,17 @@ import java.util.Set;
 public class JpaAuditProviderFactory implements AuditProviderFactory {
 
     public static final String ID = "jpa";
-    private EntityManagerFactory emf;
 
     private Set<EventType> includedEvents = new HashSet<EventType>();
 
     @Override
     public AuditProvider create(KeycloakSession session) {
-        return new JpaAuditProvider(emf.createEntityManager(), includedEvents);
+        JpaConnectionProvider connection = session.getProvider(JpaConnectionProvider.class);
+        return new JpaAuditProvider(connection.getEntityManager(), includedEvents);
     }
 
     @Override
     public void init(Config.Scope config) {
-        emf = Persistence.createEntityManagerFactory("jpa-keycloak-audit-store", JpaUtils.getHibernateProperties());
-
         String[] include = config.getArray("include-events");
         if (include != null) {
             for (String i : include) {
@@ -52,7 +48,6 @@ public class JpaAuditProviderFactory implements AuditProviderFactory {
 
     @Override
     public void close() {
-        emf.close();
     }
 
     @Override

diff --git a/audit/mongo/pom.xml b/audit/mongo/pom.xml
index db80dda..e928784 100755
--- a/audit/mongo/pom.xml
+++ b/audit/mongo/pom.xml
@@ -27,15 +27,15 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-api</artifactId>
+            <artifactId>keycloak-connections-mongo</artifactId>
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-audit-tests</artifactId>
+            <artifactId>keycloak-audit-api</artifactId>
             <version>${project.version}</version>
-            <scope>test</scope>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
@@ -47,90 +47,5 @@
             <artifactId>mongo-java-driver</artifactId>
             <scope>provided</scope>
         </dependency>
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
    </dependencies>
-
-    <properties>
-        <keycloak.audit.mongo.host>localhost</keycloak.audit.mongo.host>
-        <keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
-        <keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
-        <keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
-        <keycloak.audit.mongo.bindIp>127.0.0.1</keycloak.audit.mongo.bindIp>
-    </properties>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>1.6</source>
-                    <target>1.6</target>
-                </configuration>
-            </plugin>
-
-            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>test</id>
-                        <phase>integration-test</phase>
-                        <goals>
-                            <goal>test</goal>
-                        </goals>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <keycloak.audit.mongo.host>${keycloak.audit.mongo.host}</keycloak.audit.mongo.host>
-                                <keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
-                                <keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
-                                <keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
-                                <keycloak.audit.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.audit.mongo.bindIp>
-                            </systemPropertyVariables>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>default-test</id>
-                        <configuration>
-                            <skip>true</skip>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
-            <!-- Embedded mongo -->
-            <plugin>
-                <groupId>com.github.joelittlejohn.embedmongo</groupId>
-                <artifactId>embedmongo-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>start-mongodb</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>start</goal>
-                        </goals>
-                        <configuration>
-                            <port>${keycloak.audit.mongo.port}</port>
-                            <logging>file</logging>
-                            <logFile>${project.build.directory}/mongodb.log</logFile>
-                            <bindIp>${keycloak.audit.mongo.bindIp}</bindIp>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>stop-mongodb</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>stop</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-        </plugins>
-    </build>
 </project>

diff --git a/audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java b/audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java
index d27c40e..79f4f5d 100644
--- a/audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java
+++ b/audit/mongo/src/main/java/org/keycloak/audit/mongo/MongoAuditProviderFactory.java
@@ -1,19 +1,15 @@
 package org.keycloak.audit.mongo;
 
-import com.mongodb.DB;
-import com.mongodb.MongoClient;
-import com.mongodb.MongoCredential;
-import com.mongodb.ServerAddress;
+import com.mongodb.DBCollection;
 import com.mongodb.WriteConcern;
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
 import org.keycloak.audit.AuditProvider;
 import org.keycloak.audit.AuditProviderFactory;
 import org.keycloak.audit.EventType;
+import org.keycloak.connections.mongo.MongoConnectionProvider;
 import org.keycloak.models.KeycloakSession;
 
-import java.net.UnknownHostException;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -25,45 +21,21 @@ public class MongoAuditProviderFactory implements AuditProviderFactory {
     protected static final Logger logger = Logger.getLogger(MongoAuditProviderFactory.class);
 
     public static final String ID = "mongo";
-    private MongoClient client;
-    private DB db;
 
     private Set<EventType> includedEvents = new HashSet<EventType>();
 
     @Override
     public AuditProvider create(KeycloakSession session) {
-        return new MongoAuditProvider(db.getCollection("audit"), includedEvents);
+        MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
+
+        DBCollection collection = connection.getDB().getCollection("audit");
+        collection.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
+
+        return new MongoAuditProvider(collection, includedEvents);
     }
 
     @Override
     public void init(Config.Scope config) {
-        try {
-            String host = config.get("host", ServerAddress.defaultHost());
-            int port = config.getInt("port", ServerAddress.defaultPort());
-            String dbName = config.get("db", "keycloak-audit");
-            boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
-
-            String user = config.get("user");
-            String password = config.get("password");
-            if (user != null && password != null) {
-                MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
-                client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
-            } else {
-                client = new MongoClient(host, port);
-            }
-
-            client.setWriteConcern(WriteConcern.UNACKNOWLEDGED);
-            db = client.getDB(dbName);
-
-            if (clearOnStartup) {
-                db.getCollection("audit").drop();
-            }
-
-            logger.infof("Initialized mongo audit. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
-        } catch (UnknownHostException e) {
-            throw new RuntimeException(e);
-        }
-
         String[] include = config.getArray("include-events");
         if (include != null) {
             for (String i : include) {
@@ -85,7 +57,6 @@ public class MongoAuditProviderFactory implements AuditProviderFactory {
 
     @Override
     public void close() {
-        client.close();
     }
 
     @Override

diff --git a/audit/pom.xml b/audit/pom.xml
index b6ae9e3..0f210d3 100755
--- a/audit/pom.xml
+++ b/audit/pom.xml
@@ -21,6 +21,5 @@
         <module>jpa</module>
         <module>jboss-logging</module>
         <module>mongo</module>
-        <module>tests</module>
     </modules>
 </project>

diff --git a/authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java b/authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java
index 20d08bb..9c81665 100755
--- a/authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java
+++ b/authentication/authentication-api/src/main/java/org/keycloak/authentication/AuthenticationProviderManager.java
@@ -70,7 +70,7 @@ public class AuthenticationProviderManager {
         AuthenticationLinkModel authLink = user.getAuthenticationLink();
         if (authLink == null) {
             // User not yet linked with any authenticationProvider. Find provider with biggest priority where he is and link
-            AuthUser authUser = getUser(user.getLoginName());
+            AuthUser authUser = getUser(user.getUsername());
             authLink = new AuthenticationLinkModel(authUser.getProviderName(), authUser.getId());
             user.setAuthenticationLink(authLink);
             logger.infof("User '%s' linked with provider '%s'", authUser.getUsername(), authUser.getProviderName());
@@ -85,10 +85,10 @@ public class AuthenticationProviderManager {
         }
 
         try {
-            checkCorrectAuthLink(delegate, providerModel, authLink, user.getLoginName());
+            checkCorrectAuthLink(delegate, providerModel, authLink, user.getUsername());
 
-            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getLoginName(), password);
-            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getLoginName());
+            AuthProviderStatus currentResult = delegate.validatePassword(realm, providerModel.getConfig(), user.getUsername(), password);
+            logger.debugf("Authentication provider '%s' finished with '%s' for authentication of '%s'", delegate.getName(), currentResult.toString(), user.getUsername());
             return currentResult;
         } catch (AuthenticationProviderException ape) {
             logger.warn(ape.getMessage(), ape);
@@ -105,7 +105,7 @@ public class AuthenticationProviderManager {
                 if (providerModel.isPasswordUpdateSupported()) {
                     AuthenticationProvider delegate = getProvider(providerModel.getProviderName());
                     if (delegate != null) {
-                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getLoginName());
+                        AuthUser authUser = delegate.getUser(realm, providerModel.getConfig(), user.getUsername());
                         if (authUser != null) {
                             // Linking existing user supported just for "model" provider. In other cases throw exception
                             if (providerModel.getProviderName().equals(AuthenticationProviderModel.DEFAULT_PROVIDER.getProviderName())) {
@@ -120,7 +120,7 @@ public class AuthenticationProviderManager {
                             String userIdInProvider = delegate.registerUser(realm, providerModel.getConfig(), user);
                             authLink = new AuthenticationLinkModel(providerModel.getProviderName(), userIdInProvider);
                             user.setAuthenticationLink(authLink);
-                            logger.infof("User '%s' registered in provider '%s' and linked", user.getLoginName(), providerModel.getProviderName());
+                            logger.infof("User '%s' registered in provider '%s' and linked", user.getUsername(), providerModel.getProviderName());
                         }
                         break;
                     }
@@ -128,7 +128,7 @@ public class AuthenticationProviderManager {
             }
 
             if (authLink == null) {
-                logger.warnf("No providers found where password update is supported for user '%s'", user.getLoginName());
+                logger.warnf("No providers found where password update is supported for user '%s'", user.getUsername());
                 return false;
             }
         }
@@ -140,7 +140,7 @@ public class AuthenticationProviderManager {
             return false;
         }
 
-        String username = user.getLoginName();
+        String username = user.getUsername();
 
         // Update just if password update is supported
         if (providerModel.isPasswordUpdateSupported()) {
@@ -152,7 +152,7 @@ public class AuthenticationProviderManager {
 
                 checkCorrectAuthLink(delegate, providerModel, authLink, username);
 
-                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getLoginName(), password)) {
+                if (delegate.updateCredential(realm,providerModel.getConfig(), user.getUsername(), password)) {
                     logger.debugf("Updated password in authentication provider '%s' for user '%s'", providerName, username);
                     return true;
                 } else {

diff --git a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java
index ea20abc..63c0ec5 100755
--- a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java
+++ b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/AbstractModelAuthenticationProvider.java
@@ -3,6 +3,7 @@ package org.keycloak.authentication.model;
 import java.util.Map;
 
 import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserModel;
@@ -22,17 +23,23 @@ public abstract class AbstractModelAuthenticationProvider implements Authenticat
 
     private static final Logger logger = Logger.getLogger(AbstractModelAuthenticationProvider.class);
 
+    protected KeycloakSession keycloakSession;
+
+    protected AbstractModelAuthenticationProvider(KeycloakSession keycloakSession) {
+        this.keycloakSession = keycloakSession;
+    }
+
     @Override
     public AuthUser getUser(RealmModel currentRealm, Map<String, String> config, String username) throws AuthenticationProviderException {
         RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(keycloakSession, realm, username);
         return user == null ? null : createAuthenticatedUserInstance(user);
     }
 
     @Override
     public String registerUser(RealmModel currentRealm, Map<String, String> config, UserModel user) throws AuthenticationProviderException {
         RealmModel realm = getRealm(currentRealm, config);
-        UserModel newUser = realm.addUser(user.getLoginName());
+        UserModel newUser = keycloakSession.users().addUser(realm, user.getUsername());
         newUser.setFirstName(user.getFirstName());
         newUser.setLastName(user.getLastName());
         newUser.setEmail(user.getEmail());
@@ -43,9 +50,9 @@ public abstract class AbstractModelAuthenticationProvider implements Authenticat
     @Override
     public AuthProviderStatus validatePassword(RealmModel currentRealm, Map<String, String> config, String username, String password) throws AuthenticationProviderException {
         RealmModel realm = getRealm(currentRealm, config);
-        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(realm, username);
+        UserModel user = KeycloakModelUtils.findUserByNameOrEmail(keycloakSession, realm, username);
 
-        boolean result = realm.validatePassword(user, password);
+        boolean result = keycloakSession.users().validCredentials(realm, user, UserCredentialModel.password(password));
         return result ? AuthProviderStatus.SUCCESS : AuthProviderStatus.INVALID_CREDENTIALS;
     }
 
@@ -59,7 +66,7 @@ public abstract class AbstractModelAuthenticationProvider implements Authenticat
             throw new AuthenticationProviderException(error);
         }
 
-        UserModel user = realm.getUser(username);
+        UserModel user = keycloakSession.users().getUserByUsername(username, realm);
         if (user == null) {
             logger.warnf("User '%s' doesn't exists. Skip password update", username);
             return false;
@@ -80,7 +87,7 @@ public abstract class AbstractModelAuthenticationProvider implements Authenticat
     protected abstract RealmModel getRealm(RealmModel currentRealm, Map<String, String> config) throws AuthenticationProviderException;
 
     protected AuthUser createAuthenticatedUserInstance(UserModel user) {
-        return new AuthUser(user.getId(), user.getLoginName(), getName())
+        return new AuthUser(user.getId(), user.getUsername(), getName())
                 .setName(user.getFirstName(), user.getLastName())
                 .setEmail(user.getEmail());
     }

diff --git a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java
old mode 100644
new mode 100755
index 9381bb9..e109360
--- a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java
+++ b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProvider.java
@@ -1,6 +1,5 @@
 package org.keycloak.authentication.model;
 
-import org.jboss.resteasy.spi.ResteasyProviderFactory;
 import org.keycloak.authentication.AuthProviderConstants;
 import org.keycloak.authentication.AuthenticationProviderException;
 import org.keycloak.models.KeycloakSession;
@@ -17,7 +16,9 @@ import java.util.Map;
  */
 public class ExternalModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
 
-    public ExternalModelAuthenticationProvider() {
+
+    public ExternalModelAuthenticationProvider(KeycloakSession session) {
+        super(session);
     }
 
     @Override
@@ -37,13 +38,7 @@ public class ExternalModelAuthenticationProvider extends AbstractModelAuthentica
             throw new AuthenticationProviderException("Option '" + AuthProviderConstants.EXTERNAL_REALM_ID + "' not specified in configuration");
         }
 
-        // TODO: This won't be needed when KeycloakSession is available from ProviderSession
-        KeycloakSession session = ResteasyProviderFactory.getContextData(KeycloakSession.class);
-        if (session == null) {
-            throw new AuthenticationProviderException("KeycloakSession not available");
-        }
-
-        RealmModel realm = session.getRealm(realmId);
+        RealmModel realm = keycloakSession.realms().getRealm(realmId);
         if (realm == null) {
             throw new AuthenticationProviderException("Realm with id '" + realmId + "' doesn't exists");
         }

diff --git a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java
index 7f19623..7ef0a5d 100644
--- a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java
+++ b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ExternalModelAuthenticationProviderFactory.java
@@ -13,7 +13,7 @@ public class ExternalModelAuthenticationProviderFactory implements Authenticatio
 
     @Override
     public AuthenticationProvider create(KeycloakSession session) {
-        return new ExternalModelAuthenticationProvider();
+        return new ExternalModelAuthenticationProvider(session);
     }
 
     @Override

diff --git a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java
old mode 100644
new mode 100755
index e46514d..210d56d
--- a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java
+++ b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProvider.java
@@ -4,6 +4,7 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.authentication.AuthProviderConstants;
 
@@ -14,6 +15,10 @@ import org.keycloak.authentication.AuthProviderConstants;
  */
 public class ModelAuthenticationProvider extends AbstractModelAuthenticationProvider {
 
+    public ModelAuthenticationProvider(KeycloakSession keycloakSession) {
+        super(keycloakSession);
+    }
+
     @Override
     public String getName() {
         return AuthProviderConstants.PROVIDER_NAME_MODEL;

diff --git a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java
old mode 100644
new mode 100755
index ac8c393..bf699e3
--- a/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java
+++ b/authentication/authentication-model/src/main/java/org/keycloak/authentication/model/ModelAuthenticationProviderFactory.java
@@ -13,7 +13,7 @@ public class ModelAuthenticationProviderFactory implements AuthenticationProvide
 
     @Override
     public AuthenticationProvider create(KeycloakSession session) {
-        return new ModelAuthenticationProvider();
+        return new ModelAuthenticationProvider(session);
     }
 
     @Override

diff --git a/authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java b/authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java
index 772f6da..6cbcaad 100755
--- a/authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java
+++ b/authentication/authentication-picketlink/src/main/java/org/keycloak/authentication/picketlink/PicketlinkAuthenticationProvider.java
@@ -72,7 +72,7 @@ public class PicketlinkAuthenticationProvider implements AuthenticationProvider 
         IdentityManager identityManager = getIdentityManager(realm);
 
         try {
-            User picketlinkUser = new User(user.getLoginName());
+            User picketlinkUser = new User(user.getUsername());
             picketlinkUser.setFirstName(user.getFirstName());
             picketlinkUser.setLastName(user.getLastName());
             picketlinkUser.setEmail(user.getEmail());

diff --git a/connections/jpa/pom.xml b/connections/jpa/pom.xml
new file mode 100755
index 0000000..7301e3b
--- /dev/null
+++ b/connections/jpa/pom.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-jpa</artifactId>
+    <name>Keycloak Connections JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProvider.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProvider.java
new file mode 100644
index 0000000..793e60e
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProvider.java
@@ -0,0 +1,26 @@
+package org.keycloak.connections.jpa;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProvider implements JpaConnectionProvider {
+
+    private final EntityManager em;
+
+    public DefaultJpaConnectionProvider(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public EntityManager getEntityManager() {
+        return em;
+    }
+
+    @Override
+    public void close() {
+        em.close();
+    }
+
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java
new file mode 100644
index 0000000..e39877b
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/DefaultJpaConnectionProviderFactory.java
@@ -0,0 +1,102 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.ejb.AvailableSettings;
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+import javax.persistence.EntityManager;
+import javax.persistence.EntityManagerFactory;
+import javax.persistence.Persistence;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultJpaConnectionProviderFactory implements JpaConnectionProviderFactory {
+
+    private volatile EntityManagerFactory emf;
+
+    private Config.Scope config;
+
+    @Override
+    public JpaConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        EntityManager em = emf.createEntityManager();
+        em = PersistenceExceptionConverter.create(em);
+        session.getTransaction().enlist(new JpaKeycloakTransaction(em));
+        return new DefaultJpaConnectionProvider(em);
+    }
+
+    @Override
+    public void close() {
+        if (emf != null) {
+            emf.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (emf == null) {
+            synchronized (this) {
+                if (emf == null) {
+                    String unitName = config.get("unitName");
+                    Map<String, Object> properties = new HashMap<String, Object>();
+
+                    // Only load config from keycloak-server.json if unitName is not specified
+                    if (unitName == null) {
+                        unitName = "keycloak-default";
+
+                        String dataSource = config.get("dataSource");
+                        if (dataSource != null) {
+                            if (config.getBoolean("jta", false)) {
+                                properties.put(AvailableSettings.JTA_DATASOURCE, dataSource);
+                            } else {
+                                properties.put(AvailableSettings.NON_JTA_DATASOURCE, dataSource);
+                            }
+                        } else {
+                            properties.put(AvailableSettings.JDBC_URL, config.get("url"));
+                            properties.put(AvailableSettings.JDBC_DRIVER, config.get("driver"));
+
+                            String driverDialect = config.get("driverDialect");
+                            if (driverDialect != null && driverDialect.length() > 0) {
+                                properties.put("hibernate.dialect", driverDialect);
+                            }
+
+                            String user = config.get("user");
+                            if (user != null) {
+                                properties.put(AvailableSettings.JDBC_USER, user);
+                            }
+                            String password = config.get("password");
+                            if (password != null) {
+                                properties.put(AvailableSettings.JDBC_PASSWORD, password);
+                            }
+                        }
+
+                        String databaseSchema = config.get("databaseSchema", "validate");
+                        if (databaseSchema != null) {
+                            properties.put("hibernate.hbm2ddl.auto", databaseSchema);
+                        }
+
+                        properties.put("hibernate.show_sql", config.getBoolean("showSql", false));
+                        properties.put("hibernate.format_sql", config.getBoolean("formatSql", true));
+                    }
+
+                    emf = Persistence.createEntityManagerFactory(unitName, properties);
+                }
+            }
+        }
+    }
+
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProvider.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProvider.java
new file mode 100644
index 0000000..7c4ced4
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProvider.java
@@ -0,0 +1,14 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProvider extends Provider {
+
+    EntityManager getEntityManager();
+
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProviderFactory.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProviderFactory.java
new file mode 100644
index 0000000..1cf4a5f
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionProviderFactory.java
@@ -0,0 +1,9 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface JpaConnectionProviderFactory extends ProviderFactory<JpaConnectionProvider> {
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionSpi.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionSpi.java
new file mode 100644
index 0000000..83859ab
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaConnectionSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsJpa";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return JpaConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return JpaConnectionProviderFactory.class;
+    }
+
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaKeycloakTransaction.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaKeycloakTransaction.java
new file mode 100755
index 0000000..4f42fe7
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/JpaKeycloakTransaction.java
@@ -0,0 +1,53 @@
+package org.keycloak.connections.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

diff --git a/connections/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java b/connections/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java
new file mode 100644
index 0000000..443d7bf
--- /dev/null
+++ b/connections/jpa/src/main/java/org/keycloak/connections/jpa/PersistenceExceptionConverter.java
@@ -0,0 +1,48 @@
+package org.keycloak.connections.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}

diff --git a/connections/jpa/src/main/resources/META-INF/services/org.keycloak.connections.jpa.JpaConnectionProviderFactory b/connections/jpa/src/main/resources/META-INF/services/org.keycloak.connections.jpa.JpaConnectionProviderFactory
new file mode 100644
index 0000000..68bc9ae
--- /dev/null
+++ b/connections/jpa/src/main/resources/META-INF/services/org.keycloak.connections.jpa.JpaConnectionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory
\ No newline at end of file

diff --git a/connections/jpa/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/connections/jpa/src/main/resources/META-INF/services/org.keycloak.provider.Spi
new file mode 100644
index 0000000..d7b47a8
--- /dev/null
+++ b/connections/jpa/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -0,0 +1 @@
+org.keycloak.connections.jpa.JpaConnectionSpi
\ No newline at end of file

diff --git a/connections/mongo/pom.xml b/connections/mongo/pom.xml
new file mode 100755
index 0000000..59643ab
--- /dev/null
+++ b/connections/mongo/pom.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-mongo</artifactId>
+    <name>Keycloak Connections Mongo</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+        </dependency>
+    </dependencies>
+</project>

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionFactoryProvider.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionFactoryProvider.java
new file mode 100644
index 0000000..cea49ff
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionFactoryProvider.java
@@ -0,0 +1,112 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import com.mongodb.MongoClient;
+import com.mongodb.MongoCredential;
+import com.mongodb.ServerAddress;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.impl.MongoStoreImpl;
+import org.keycloak.connections.mongo.impl.context.TransactionMongoStoreInvocationContext;
+import org.keycloak.models.KeycloakSession;
+
+import java.util.Collections;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionFactoryProvider implements MongoConnectionProviderFactory {
+
+    // TODO Make configurable
+    private String[] entities = new String[]{
+            "org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoUserEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity",
+            "org.keycloak.models.entities.RequiredCredentialEntity",
+            "org.keycloak.models.entities.AuthenticationProviderEntity",
+            "org.keycloak.models.entities.CredentialEntity",
+            "org.keycloak.models.entities.SocialLinkEntity",
+            "org.keycloak.models.entities.AuthenticationLinkEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity",
+            "org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUsernameLoginFailureEntity",
+            "org.keycloak.models.sessions.mongo.entities.MongoUserSessionEntity",
+            "org.keycloak.models.entities.FederationProviderEntity"
+    };
+
+    private static final Logger logger = Logger.getLogger(DefaultMongoConnectionFactoryProvider.class);
+
+    private volatile MongoClient client;
+
+    private MongoStore mongoStore;
+    private DB db;
+    private Config.Scope config;
+
+    @Override
+    public MongoConnectionProvider create(KeycloakSession session) {
+        lazyInit();
+
+        TransactionMongoStoreInvocationContext invocationContext = new TransactionMongoStoreInvocationContext(mongoStore);
+        session.getTransaction().enlist(new MongoKeycloakTransaction(invocationContext));
+        return new DefaultMongoConnectionProvider(db, mongoStore, invocationContext);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        this.config = config;
+    }
+
+    private void lazyInit() {
+        if (client == null) {
+            synchronized (this) {
+                if (client == null) {
+                    try {
+                        String host = config.get("host", ServerAddress.defaultHost());
+                        int port = config.getInt("port", ServerAddress.defaultPort());
+                        String dbName = config.get("db", "keycloak");
+                        boolean clearOnStartup = config.getBoolean("clearOnStartup", false);
+
+                        String user = config.get("user");
+                        String password = config.get("password");
+                        if (user != null && password != null) {
+                            MongoCredential credential = MongoCredential.createMongoCRCredential(user, dbName, password.toCharArray());
+                            client = new MongoClient(new ServerAddress(host, port), Collections.singletonList(credential));
+                        } else {
+                            client = new MongoClient(host, port);
+                        }
+
+                        this.db = client.getDB(dbName);
+
+                        this.mongoStore = new MongoStoreImpl(db, clearOnStartup, getManagedEntities());
+
+                        logger.infof("Initialized mongo model. host: %s, port: %d, db: %s, clearOnStartup: %b", host, port, dbName, clearOnStartup);
+                    } catch (Exception e) {
+                        throw new RuntimeException(e);
+                    }
+                }
+            }
+        }
+    }
+
+    private Class[] getManagedEntities() throws ClassNotFoundException {
+       Class[] entityClasses = new Class[entities.length];
+        for (int i = 0; i < entities.length; i++) {
+            entityClasses[i] = Thread.currentThread().getContextClassLoader().loadClass(entities[i]);
+        }
+        return entityClasses;
+    }
+
+    @Override
+    public void close() {
+        if (client != null) {
+            client.close();
+        }
+    }
+
+    @Override
+    public String getId() {
+        return "default";
+    }
+
+}

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionProvider.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionProvider.java
new file mode 100644
index 0000000..4b08686
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/DefaultMongoConnectionProvider.java
@@ -0,0 +1,41 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class DefaultMongoConnectionProvider implements MongoConnectionProvider {
+
+    private DB db;
+    private MongoStore mongoStore;
+    private MongoStoreInvocationContext invocationContext;
+
+    public DefaultMongoConnectionProvider(DB db, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.db = db;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public DB getDB() {
+        return db;
+    }
+
+    @Override
+    public MongoStore getMongoStore() {
+        return mongoStore;
+    }
+
+    @Override
+    public MongoStoreInvocationContext getInvocationContext() {
+        return invocationContext;
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProvider.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProvider.java
new file mode 100644
index 0000000..976c9c8
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProvider.java
@@ -0,0 +1,19 @@
+package org.keycloak.connections.mongo;
+
+import com.mongodb.DB;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProvider extends Provider {
+
+    DB getDB();
+
+    MongoStore getMongoStore();
+
+    MongoStoreInvocationContext getInvocationContext();
+
+}

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProviderFactory.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProviderFactory.java
new file mode 100644
index 0000000..e787ce6
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionProviderFactory.java
@@ -0,0 +1,9 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface MongoConnectionProviderFactory extends ProviderFactory<MongoConnectionProvider> {
+}

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionSpi.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionSpi.java
new file mode 100644
index 0000000..031076d
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/MongoConnectionSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.connections.mongo;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoConnectionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "connectionsMongo";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return MongoConnectionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return MongoConnectionProviderFactory.class;
+    }
+
+}

diff --git a/connections/mongo/src/main/resources/META-INF/services/org.keycloak.connections.mongo.MongoConnectionProviderFactory b/connections/mongo/src/main/resources/META-INF/services/org.keycloak.connections.mongo.MongoConnectionProviderFactory
new file mode 100644
index 0000000..d9927c1
--- /dev/null
+++ b/connections/mongo/src/main/resources/META-INF/services/org.keycloak.connections.mongo.MongoConnectionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.connections.mongo.DefaultMongoConnectionFactoryProvider
\ No newline at end of file

diff --git a/connections/mongo/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/connections/mongo/src/main/resources/META-INF/services/org.keycloak.provider.Spi
new file mode 100644
index 0000000..90eedc3
--- /dev/null
+++ b/connections/mongo/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -0,0 +1 @@
+org.keycloak.connections.mongo.MongoConnectionSpi
\ No newline at end of file

diff --git a/connections/pom.xml b/connections/pom.xml
new file mode 100755
index 0000000..9887b35
--- /dev/null
+++ b/connections/pom.xml
@@ -0,0 +1,31 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+    </parent>
+    <name>Connections Parent</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-connections-pom</artifactId>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>jpa</module>
+        <module>mongo</module>
+    </modules>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

diff --git a/core/src/main/java/org/keycloak/representations/AccessCode.java b/core/src/main/java/org/keycloak/representations/AccessCode.java
index 1ecebb2..ef61202 100755
--- a/core/src/main/java/org/keycloak/representations/AccessCode.java
+++ b/core/src/main/java/org/keycloak/representations/AccessCode.java
@@ -1,6 +1,5 @@
 package org.keycloak.representations;
 
-import java.util.HashSet;
 import java.util.Set;
 
 /**
@@ -10,15 +9,14 @@ import java.util.Set;
  */
 public class AccessCode {
     protected String id;
-    protected String usernameUsed;
+    protected String clientId;
+    protected String userId;
     protected String state;
+    protected String sessionState;
     protected String redirectUri;
-    protected boolean rememberMe;
-    protected String authMethod;
     protected int timestamp;
-    protected int expiration;
-    protected AccessToken accessToken;
-    protected Set<String> requiredActions;
+    protected Action action;
+    protected Set<String> requestedRoles;
 
     public String getId() {
         return id;
@@ -28,52 +26,44 @@ public class AccessCode {
         this.id = id;
     }
 
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
+    public String getClientId() {
+        return clientId;
     }
 
-    public String getRedirectUri() {
-        return redirectUri;
-    }
-
-    public void setRedirectUri(String redirectUri) {
-        this.redirectUri = redirectUri;
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
     }
 
-    public boolean isRememberMe() {
-        return rememberMe;
+    public String getUserId() {
+        return userId;
     }
 
-    public void setRememberMe(boolean rememberMe) {
-        this.rememberMe = rememberMe;
+    public void setUserId(String userId) {
+        this.userId = userId;
     }
 
-    public String getAuthMethod() {
-        return authMethod;
+    public String getState() {
+        return state;
     }
 
-    public void setAuthMethod(String authMethod) {
-        this.authMethod = authMethod;
+    public void setState(String state) {
+        this.state = state;
     }
 
-    public int getExpiration() {
-        return expiration;
+    public String getSessionState() {
+        return sessionState;
     }
 
-    public void setExpiration(int expiration) {
-        this.expiration = expiration;
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
     }
 
-    public AccessToken getAccessToken() {
-        return accessToken;
+    public String getRedirectUri() {
+        return redirectUri;
     }
 
-    public void setAccessToken(AccessToken accessToken) {
-        this.accessToken = accessToken;
+    public void setRedirectUri(String redirectUri) {
+        this.redirectUri = redirectUri;
     }
 
     public int getTimestamp() {
@@ -84,19 +74,28 @@ public class AccessCode {
         this.timestamp = timestamp;
     }
 
-    public Set<String> getRequiredActions() {
-        return requiredActions;
+    public Action getAction() {
+        return action;
     }
 
-    public void setRequiredActions(Set<String> requiredActions) {
-        this.requiredActions = requiredActions;
+    public void setAction(Action action) {
+        this.action = action;
     }
 
-    public String getUsernameUsed() {
-        return usernameUsed;
+    public Set<String> getRequestedRoles() {
+        return requestedRoles;
     }
 
-    public void setUsernameUsed(String usernameUsed) {
-        this.usernameUsed = usernameUsed;
+    public void setRequestedRoles(Set<String> requestedRoles) {
+        this.requestedRoles = requestedRoles;
     }
+
+    public static enum Action {
+        OAUTH_GRANT,
+        VERIFY_EMAIL,
+        UPDATE_PROFILE,
+        CONFIGURE_TOTP,
+        UPDATE_PASSWORD
+    }
+
 }

diff --git a/core/src/main/java/org/keycloak/representations/idm/AuthenticationProviderRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/AuthenticationProviderRepresentation.java
old mode 100644
new mode 100755
index eeb71a0..f3a0ed2
--- a/core/src/main/java/org/keycloak/representations/idm/AuthenticationProviderRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/AuthenticationProviderRepresentation.java
@@ -34,4 +34,23 @@ public class AuthenticationProviderRepresentation {
     public void setConfig(Map<String, String> config) {
         this.config = config;
     }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        AuthenticationProviderRepresentation that = (AuthenticationProviderRepresentation) o;
+
+        if (passwordUpdateSupported != that.passwordUpdateSupported) return false;
+        if (config != null ? !config.equals(that.config) : that.config != null) return false;
+        if (!providerName.equals(that.providerName)) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        return providerName.hashCode();
+    }
 }

diff --git a/core/src/main/java/org/keycloak/representations/idm/ClaimRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/ClaimRepresentation.java
index 1783d89..9d3aed1 100755
--- a/core/src/main/java/org/keycloak/representations/idm/ClaimRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/ClaimRepresentation.java
@@ -95,4 +95,40 @@ public class ClaimRepresentation {
     public void setPhone(boolean phone) {
         this.phone = phone;
     }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        ClaimRepresentation that = (ClaimRepresentation) o;
+
+        if (address != that.address) return false;
+        if (email != that.email) return false;
+        if (gender != that.gender) return false;
+        if (locale != that.locale) return false;
+        if (name != that.name) return false;
+        if (phone != that.phone) return false;
+        if (picture != that.picture) return false;
+        if (profile != that.profile) return false;
+        if (username != that.username) return false;
+        if (website != that.website) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = (name ? 1 : 0);
+        result = 31 * result + (username ? 1 : 0);
+        result = 31 * result + (profile ? 1 : 0);
+        result = 31 * result + (picture ? 1 : 0);
+        result = 31 * result + (website ? 1 : 0);
+        result = 31 * result + (email ? 1 : 0);
+        result = 31 * result + (gender ? 1 : 0);
+        result = 31 * result + (locale ? 1 : 0);
+        result = 31 * result + (address ? 1 : 0);
+        result = 31 * result + (phone ? 1 : 0);
+        return result;
+    }
 }

diff --git a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
index b0c37ac..99237ee 100755
--- a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
@@ -11,9 +11,16 @@ public class CredentialRepresentation {
     public static final String CLIENT_CERT = "cert";
 
     protected String type;
-    protected String value;
     protected String device;
 
+    // Plain-text value of credential (used for example during import from manually created JSON file)
+    protected String value;
+
+    // Value stored in DB (used for example during export/import)
+    protected String hashedSaltedValue;
+    protected String salt;
+    protected Integer hashIterations;
+
     public String getType() {
         return type;
     }
@@ -37,4 +44,28 @@ public class CredentialRepresentation {
     public void setDevice(String device) {
         this.device = device;
     }
+
+    public String getHashedSaltedValue() {
+        return hashedSaltedValue;
+    }
+
+    public void setHashedSaltedValue(String hashedSaltedValue) {
+        this.hashedSaltedValue = hashedSaltedValue;
+    }
+
+    public String getSalt() {
+        return salt;
+    }
+
+    public void setSalt(String salt) {
+        this.salt = salt;
+    }
+
+    public Integer getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(Integer hashIterations) {
+        this.hashIterations = hashIterations;
+    }
 }

diff --git a/core/src/main/java/org/keycloak/representations/idm/OAuthClientRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/OAuthClientRepresentation.java
index 8751a38..7511de6 100755
--- a/core/src/main/java/org/keycloak/representations/idm/OAuthClientRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/OAuthClientRepresentation.java
@@ -9,7 +9,6 @@ import java.util.List;
 public class OAuthClientRepresentation {
     protected String id;
     protected String name;
-    protected String baseUrl;
     protected List<String> redirectUris;
     protected List<String> webOrigins;
     protected Boolean enabled;
@@ -44,14 +43,6 @@ public class OAuthClientRepresentation {
         this.enabled = enabled;
     }
 
-    public String getBaseUrl() {
-        return baseUrl;
-    }
-
-    public void setBaseUrl(String baseUrl) {
-        this.baseUrl = baseUrl;
-    }
-
     public List<String> getRedirectUris() {
         return redirectUris;
     }

diff --git a/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
index 68ba134..5f87fee 100755
--- a/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/RealmRepresentation.java
@@ -27,6 +27,10 @@ public class RealmRepresentation {
     protected Boolean resetPasswordAllowed;
     protected Boolean social;
     protected Boolean updateProfileOnInitialSocialLogin;
+
+    protected Boolean userCacheEnabled;
+    protected Boolean realmCacheEnabled;
+
     //--- brute force settings
     protected Boolean bruteForceProtected;
     protected Integer maxFailureWaitSeconds;
@@ -44,17 +48,15 @@ public class RealmRepresentation {
     protected Set<String> requiredCredentials;
     protected String passwordPolicy;
     protected List<UserRepresentation> users;
-    protected List<UserRoleMappingRepresentation> roleMappings;
     protected List<ScopeMappingRepresentation> scopeMappings;
-    protected Map<String, List<UserRoleMappingRepresentation>> applicationRoleMappings;
     protected Map<String, List<ScopeMappingRepresentation>> applicationScopeMappings;
-    protected List<SocialMappingRepresentation> socialMappings;
     protected List<ApplicationRepresentation> applications;
     protected List<OAuthClientRepresentation> oauthClients;
     protected Map<String, String> socialProviders;
     protected Map<String, String> smtpServer;
     protected Map<String, String> ldapServer;
     protected List<AuthenticationProviderRepresentation> authenticationProviders;
+    protected List<UserFederationProviderRepresentation> userFederationProviders;
     protected String loginTheme;
     protected String accountTheme;
     protected String adminTheme;
@@ -151,18 +153,6 @@ public class RealmRepresentation {
         this.ssoSessionMaxLifespan = ssoSessionMaxLifespan;
     }
 
-    public List<UserRoleMappingRepresentation> getRoleMappings() {
-        return roleMappings;
-    }
-
-    public UserRoleMappingRepresentation roleMapping(String username) {
-        UserRoleMappingRepresentation mapping = new UserRoleMappingRepresentation();
-        mapping.setUsername(username);
-        if (roleMappings == null) roleMappings = new ArrayList<UserRoleMappingRepresentation>();
-        roleMappings.add(mapping);
-        return mapping;
-    }
-
     public List<ScopeMappingRepresentation> getScopeMappings() {
         return scopeMappings;
     }
@@ -175,18 +165,6 @@ public class RealmRepresentation {
         return mapping;
     }
 
-    public List<SocialMappingRepresentation> getSocialMappings() {
-        return socialMappings;
-    }
-
-    public SocialMappingRepresentation socialMapping(String username) {
-        SocialMappingRepresentation mapping = new SocialMappingRepresentation();
-        mapping.setUsername(username);
-        if (socialMappings == null) socialMappings = new ArrayList<SocialMappingRepresentation>();
-        socialMappings.add(mapping);
-        return mapping;
-    }
-
     public Set<String> getRequiredCredentials() {
         return requiredCredentials;
     }
@@ -267,6 +245,22 @@ public class RealmRepresentation {
         this.rememberMe = rememberMe;
     }
 
+    public Boolean isRealmCacheEnabled() {
+        return realmCacheEnabled;
+    }
+
+    public void setRealmCacheEnabled(Boolean realmCacheEnabled) {
+        this.realmCacheEnabled = realmCacheEnabled;
+    }
+
+    public Boolean isUserCacheEnabled() {
+        return userCacheEnabled;
+    }
+
+    public void setUserCacheEnabled(Boolean userCacheEnabled) {
+        this.userCacheEnabled = userCacheEnabled;
+    }
+
     public Boolean isVerifyEmail() {
         return verifyEmail;
     }
@@ -339,14 +333,6 @@ public class RealmRepresentation {
         this.oauthClients = oauthClients;
     }
 
-    public Map<String, List<UserRoleMappingRepresentation>> getApplicationRoleMappings() {
-        return applicationRoleMappings;
-    }
-
-    public void setApplicationRoleMappings(Map<String, List<UserRoleMappingRepresentation>> applicationRoleMappings) {
-        this.applicationRoleMappings = applicationRoleMappings;
-    }
-
     public Map<String, List<ScopeMappingRepresentation>> getApplicationScopeMappings() {
         return applicationScopeMappings;
     }
@@ -458,4 +444,36 @@ public class RealmRepresentation {
     public void setFailureFactor(Integer failureFactor) {
         this.failureFactor = failureFactor;
     }
+
+    public boolean isAuditEnabled() {
+        return auditEnabled;
+    }
+
+    public void setAuditEnabled(boolean auditEnabled) {
+        this.auditEnabled = auditEnabled;
+    }
+
+    public long getAuditExpiration() {
+        return auditExpiration;
+    }
+
+    public void setAuditExpiration(long auditExpiration) {
+        this.auditExpiration = auditExpiration;
+    }
+
+    public List<String> getAuditListeners() {
+        return auditListeners;
+    }
+
+    public void setAuditListeners(List<String> auditListeners) {
+        this.auditListeners = auditListeners;
+    }
+
+    public List<UserFederationProviderRepresentation> getUserFederationProviders() {
+        return userFederationProviders;
+    }
+
+    public void setUserFederationProviders(List<UserFederationProviderRepresentation> userFederationProviders) {
+        this.userFederationProviders = userFederationProviders;
+    }
 }

diff --git a/core/src/main/java/org/keycloak/representations/idm/UserFederationProviderRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/UserFederationProviderRepresentation.java
new file mode 100755
index 0000000..90efd17
--- /dev/null
+++ b/core/src/main/java/org/keycloak/representations/idm/UserFederationProviderRepresentation.java
@@ -0,0 +1,55 @@
+package org.keycloak.representations.idm;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class UserFederationProviderRepresentation {
+
+    private String id;
+    private String providerName;
+    private Map<String, String> config;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public void setProviderName(String providerName) {
+        this.providerName = providerName;
+    }
+
+
+    public Map<String, String> getConfig() {
+        return config;
+    }
+
+    public void setConfig(Map<String, String> config) {
+        this.config = config;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        UserFederationProviderRepresentation that = (UserFederationProviderRepresentation) o;
+
+        if (!id.equals(that.id)) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        return id.hashCode();
+    }
+}

diff --git a/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
index 43aa368..2578983 100755
--- a/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/UserRepresentation.java
@@ -21,9 +21,13 @@ public class UserRepresentation {
     protected String lastName;
     protected String email;
     protected AuthenticationLinkRepresentation authenticationLink;
+    protected String federationLink;
     protected Map<String, String> attributes;
     protected List<CredentialRepresentation> credentials;
     protected List<String> requiredActions;
+    protected List<SocialLinkRepresentation> socialLinks;
+    protected List<String> realmRoles;
+    protected Map<String, List<String>> applicationRoles;
 
     public String getSelf() {
         return self;
@@ -143,4 +147,36 @@ public class UserRepresentation {
     public void setRequiredActions(List<String> requiredActions) {
         this.requiredActions = requiredActions;
     }
+
+    public List<SocialLinkRepresentation> getSocialLinks() {
+        return socialLinks;
+    }
+
+    public void setSocialLinks(List<SocialLinkRepresentation> socialLinks) {
+        this.socialLinks = socialLinks;
+    }
+
+    public List<String> getRealmRoles() {
+        return realmRoles;
+    }
+
+    public void setRealmRoles(List<String> realmRoles) {
+        this.realmRoles = realmRoles;
+    }
+
+    public Map<String, List<String>> getApplicationRoles() {
+        return applicationRoles;
+    }
+
+    public void setApplicationRoles(Map<String, List<String>> applicationRoles) {
+        this.applicationRoles = applicationRoles;
+    }
+
+    public String getFederationLink() {
+        return federationLink;
+    }
+
+    public void setFederationLink(String federationLink) {
+        this.federationLink = federationLink;
+    }
 }

diff --git a/dependencies/pom.xml b/dependencies/pom.xml
new file mode 100755
index 0000000..896eaa4
--- /dev/null
+++ b/dependencies/pom.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+    </parent>
+
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>keycloak-dependencies-parent</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak Dependencies Parent</name>
+    <description/>
+
+    <modules>
+        <module>server-min</module>
+        <module>server-all</module>
+    </modules>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

diff --git a/dependencies/server-all/pom.xml b/dependencies/server-all/pom.xml
new file mode 100755
index 0000000..6316ed9
--- /dev/null
+++ b/dependencies/server-all/pom.xml
@@ -0,0 +1,159 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+	<parent>
+		<artifactId>keycloak-parent</artifactId>
+		<groupId>org.keycloak</groupId>
+		<version>1.0-beta-4-SNAPSHOT</version>
+		<relativePath>../../pom.xml</relativePath>
+	</parent>
+	<modelVersion>4.0.0</modelVersion>
+
+	<artifactId>keycloak-dependencies-server-all</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak Dependencies Server All</name>
+	<description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-dependencies-server-min</artifactId>
+            <version>${project.version}</version>
+            <type>pom</type>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-connections-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-sessions-mem</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-sessions-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-sessions-mongo</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-jboss-logging</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-email</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- social -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-social-github</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-social-google</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-social-twitter</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.twitter4j</groupId>
+            <artifactId>twitter4j-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-social-facebook</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- authentication api -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-picketlink</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-common</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-simple-schema</artifactId>
+        </dependency>
+
+        <!-- picketlink -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-picketlink-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-picketlink-realm</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- mongo -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-connections-mongo</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-mongo</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-mongo</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.mongodb</groupId>
+            <artifactId>mongo-java-driver</artifactId>
+        </dependency>
+
+        <!-- export/import -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-zip</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>de.idyl</groupId>
+            <artifactId>winzipaes</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file

diff --git a/dependencies/server-min/pom.xml b/dependencies/server-min/pom.xml
new file mode 100755
index 0000000..5ae92c6
--- /dev/null
+++ b/dependencies/server-min/pom.xml
@@ -0,0 +1,157 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+	<parent>
+		<artifactId>keycloak-parent</artifactId>
+		<groupId>org.keycloak</groupId>
+		<version>1.0-beta-4-SNAPSHOT</version>
+		<relativePath>../../pom.xml</relativePath>
+	</parent>
+	<modelVersion>4.0.0</modelVersion>
+
+	<artifactId>keycloak-dependencies-server-min</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak Dependencies Server Min</name>
+	<description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>net.iharder</groupId>
+            <artifactId>base64</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core-jaxrs</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.zxing</groupId>
+            <artifactId>javase</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-invalidation-cache-model</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-audit-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-js-adapter</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- social -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-social-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- forms -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-forms-common-freemarker</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.freemarker</groupId>
+            <artifactId>freemarker</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-forms-common-themes</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-account-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-account-freemarker</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-email-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-email-freemarker</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-login-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-login-freemarker</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- authentication api -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-authentication-model</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- timer -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-timer-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-timer-basic</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+        <!-- export/import -->
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-dir</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-single-file</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+    </dependencies>
+
+</project>

diff --git a/distribution/war-zip/pom.xml b/distribution/war-zip/pom.xml
index d0ddb28..86f55c6 100755
--- a/distribution/war-zip/pom.xml
+++ b/distribution/war-zip/pom.xml
@@ -62,7 +62,7 @@
                     </execution>
                 </executions>
                 <configuration>
-                    <file>${project.build.directory}/unpacked/deployments/auth-server.war/WEB-INF/classes/META-INF/persistence.xml</file>
+                    <file>${project.build.directory}/unpacked/deployments/auth-server.war/WEB-INF/classes/META-INF/keycloak-server.json</file>
                     <replacements>
                         <replacement>
                             <token>java:jboss/datasources/ExampleDS</token>

diff --git a/docbook/reference/en/en-US/master.xml b/docbook/reference/en/en-US/master.xml
index 0fe428f..b8785df 100755
--- a/docbook/reference/en/en-US/master.xml
+++ b/docbook/reference/en/en-US/master.xml
@@ -30,6 +30,7 @@
                 <!ENTITY Authentication SYSTEM "modules/authentication-spi.xml">
                 <!ENTITY Ldap SYSTEM "modules/ldap.xml">
                 <!ENTITY ExportImport SYSTEM "modules/export-import.xml">
+                <!ENTITY ServerCache SYSTEM "modules/cache.xml">
                 ]>
 
 <book>
@@ -117,6 +118,7 @@ This one is short
     &Authentication;
     &Ldap;
     &ExportImport;
+    &ServerCache;
     &Migration;
 
 </book>

diff --git a/docbook/reference/en/en-US/modules/cache.xml b/docbook/reference/en/en-US/modules/cache.xml
new file mode 100755
index 0000000..6632e3a
--- /dev/null
+++ b/docbook/reference/en/en-US/modules/cache.xml
@@ -0,0 +1,68 @@
+<chapter id="server_cache">
+    <title>Server Cache</title>
+    <para>
+        By default, Keycloak caches realm metadata and users.  There are two separate caches, one for realm metadata
+        (realm, application, client, roles, etc...) and one for users.  These caches greatly improves the performance of the server.
+    </para>
+
+    <section>
+        <title>Disabling Caches</title>
+        <para>
+            The realm and user caches can be disabled through configuration or through the management console.  To
+            manally disable the realm or user cache, you must edit the <literal>keycloak-server.json</literal> file
+            in your distribution.  Here's what the config looks like initially.
+        </para>
+        <para>
+            <programlisting><![CDATA[
+    "realmCache": {
+        "provider": "${keycloak.realm.cache.provider:mem}"
+    },
+
+    "userCache": {
+        "provider": "${keycloak.user.cache.provider:mem}",
+        "mem": {
+            "maxSize": 20000
+        }
+    },
+]]></programlisting>
+        </para>
+        <para>You must then change it to:
+            <programlisting><![CDATA[
+    "realmCache": {
+        "provider": "${keycloak.realm.cache.provider:none}"
+    },
+
+    "userCache": {
+        "provider": "${keycloak.user.cache.provider:none}"
+    },
+]]></programlisting>
+        </para>
+        <para>
+           You can also disable either of the caches at runtime through the Keycloak admin console Realm Settings page.
+           This will not permanently disable the cache.  If you reboot the server, the cache will be re-enabled unless
+            you manualy disable the cache in the <literal>keycloak-server.json</literal> file.
+        </para>
+    </section>
+    <section>
+        <title>Clear Caches</title>
+        <para>
+            To clear the realm or user cache, go to the Keycloak admin console Realm Settings page.  Disable the cache
+            you want.  Save the settings.  Then re-enable the cache.  This will cause the cache to be cleared.
+        </para>
+    </section>
+    <section>
+        <title>Cache Config</title>
+        <para>
+            Cache configuration is done within <literal>keycloak-server.json</literal>.  Changes to this file will not
+            be seen by the server until you reboot.  Currently you can only configure the max size of the user cache.
+            <programlisting><![CDATA[
+    "userCache": {
+        "provider": "${keycloak.user.cache.provider:mem}",
+        "mem": {
+            "maxSize": 20000
+        }
+    },
+]]></programlisting>
+        </para>
+    </section>
+</chapter>
\ No newline at end of file

diff --git a/docbook/reference/en/en-US/modules/MigrationFromOlderVersions.xml b/docbook/reference/en/en-US/modules/MigrationFromOlderVersions.xml
index cc713f5..c881b61 100755
--- a/docbook/reference/en/en-US/modules/MigrationFromOlderVersions.xml
+++ b/docbook/reference/en/en-US/modules/MigrationFromOlderVersions.xml
@@ -1,6 +1,14 @@
 <chapter id="Migration_from_older_versions">
     <title>Migration from older versions</title>
     <sect1>
+        <title>Migrating from 1.0 Beta 1 to Beta 4</title>
+        <itemizedlist>
+            <listitem>
+                DB Schema has changed again.
+            </listitem>
+        </itemizedlist>
+    </sect1>
+    <sect1>
         <title>Migrating from 1.0 Alpha 4 to Beta 1</title>
         <itemizedlist>
             <listitem>

diff --git a/examples/cordova/example-realm.json b/examples/cordova/example-realm.json
index 37e899e..05ad905 100755
--- a/examples/cordova/example-realm.json
+++ b/examples/cordova/example-realm.json
@@ -15,8 +15,12 @@
             "lastName": "User",
             "credentials" : [
                 { "type" : "password",
-                    "value" : "password" }
-            ]
+                  "value" : "password" }
+            ],
+            "realmRoles": [ "user" ],
+            "applicationRoles": {
+                "account": ["view-profile", "manage-account"]
+            }
         }
     ],
     "roles" : {

diff --git a/examples/cors/cors-realm.json b/examples/cors/cors-realm.json
index 9b3da42..1dd5503 100755
--- a/examples/cors/cors-realm.json
+++ b/examples/cors/cors-realm.json
@@ -20,8 +20,12 @@
             "lastName": "Burke",
             "credentials" : [
                 { "type" : "password",
-                    "value" : "password" }
-            ]
+                  "value" : "password" }
+            ],
+            "realmRoles": [ "user" ],
+            "applicationRoles": {
+                "realm-management": [ "realm-admin" ]
+            }
         }
     ],
     "roles" : {
@@ -32,12 +36,6 @@
             }
         ]
     },
-    "roleMappings": [
-        {
-            "username": "bburke@redhat.com",
-            "roles": ["user"]
-        }
-    ],
     "scopeMappings": [
         {
             "client": "angular-product",
@@ -58,14 +56,6 @@
             ]
         }
     ],
-    "applicationRoleMappings": {
-        "realm-management": [
-            {
-                "username": "bburke@redhat.com",
-                "roles": ["realm-admin"]
-            }
-        ]
-    },
     "applicationScopeMappings": {
         "realm-management": [
             {

diff --git a/examples/demo-template/testrealm.json b/examples/demo-template/testrealm.json
index f4ff956..f321333 100755
--- a/examples/demo-template/testrealm.json
+++ b/examples/demo-template/testrealm.json
@@ -24,7 +24,11 @@
             "credentials" : [
                 { "type" : "password",
                     "value" : "password" }
-            ]
+            ],
+            "realmRoles": [ "user" ],
+            "applicationRoles": {
+                "account": [ "manage-account" ]
+            }
         },
         {
             "username" : "admin",
@@ -35,7 +39,11 @@
             "credentials" : [
                 { "type" : "password",
                     "value" : "password" }
-            ]
+            ],
+            "realmRoles": [ "user","admin" ],
+            "applicationRoles": {
+                "realm-management": [ "realm-admin" ]
+            }
         }
     ],
     "roles" : {
@@ -50,16 +58,6 @@
             }
         ]
     },
-    "roleMappings": [
-        {
-            "username": "bburke@redhat.com",
-            "roles": ["user"]
-        },
-        {
-            "username": "admin",
-            "roles": ["user","admin"]
-        }
-    ],
     "scopeMappings": [
         {
             "client": "third-party",
@@ -154,20 +152,6 @@
 
         }
     ],
-    "applicationRoleMappings": {
-        "account": [
-            {
-                "username": "bburke@redhat.com",
-                "roles": ["manage-account"]
-            }
-        ],
-        "realm-management": [
-            {
-                "username": "admin",
-                "roles": ["realm-admin"]
-            }
-        ]
-    },
     "applicationScopeMappings": {
         "realm-management": [
             {

diff --git a/examples/js-console/example-realm.json b/examples/js-console/example-realm.json
index 42d291e..ab43028 100755
--- a/examples/js-console/example-realm.json
+++ b/examples/js-console/example-realm.json
@@ -15,8 +15,12 @@
             "lastName": "User",
             "credentials" : [
                 { "type" : "password",
-                    "value" : "password" }
-            ]
+                  "value" : "password" }
+            ],
+            "realmRoles": [ "user" ],
+            "applicationRoles": {
+                "account": ["view-profile", "manage-account"]
+            }
         }
     ],
     "roles" : {
@@ -31,12 +35,6 @@
             }
         ]
     },
-    "roleMappings": [
-        {
-            "username": "user",
-            "roles": ["user"]
-        }
-    ],
     "scopeMappings": [
         {
             "client": "js-console",
@@ -57,14 +55,6 @@
             ]
         }
     ],
-    "applicationRoleMappings": {
-        "account": [
-            {
-                "username": "user",
-                "roles": ["view-profile", "manage-account"]
-            }
-        ]
-    },
     "applicationScopeMappings": {
         "account": [
             {

diff --git a/examples/providers/authentication-properties/src/main/java/org/keycloak/examples/providers/authentication/PropertiesAuthenticationProvider.java b/examples/providers/authentication-properties/src/main/java/org/keycloak/examples/providers/authentication/PropertiesAuthenticationProvider.java
index 9b83ec0..8c5ff1a 100644
--- a/examples/providers/authentication-properties/src/main/java/org/keycloak/examples/providers/authentication/PropertiesAuthenticationProvider.java
+++ b/examples/providers/authentication-properties/src/main/java/org/keycloak/examples/providers/authentication/PropertiesAuthenticationProvider.java
@@ -48,7 +48,7 @@ public class PropertiesAuthenticationProvider implements AuthenticationProvider 
     @Override
     public String registerUser(RealmModel realm, Map<String, String> configuration, UserModel user) throws AuthenticationProviderException {
         // Registration ignored
-        return user.getLoginName();
+        return user.getUsername();
     }
 
     @Override

diff --git a/export-import/export-import-api/pom.xml b/export-import/export-import-api/pom.xml
index 19db6e5..1b4dc0a 100755
--- a/export-import/export-import-api/pom.xml
+++ b/export-import/export-import-api/pom.xml
@@ -26,6 +26,32 @@
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-invalidation-cache-model</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>net.iharder</groupId>
+            <artifactId>base64</artifactId>
+            <scope>provided</scope>
+        </dependency>
     </dependencies>
 
     <build>

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportConfig.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportConfig.java
new file mode 100644
index 0000000..3ce6336
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportConfig.java
@@ -0,0 +1,121 @@
+package org.keycloak.exportimport;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class ExportImportConfig {
+
+    public static final String PREFIX = "keycloak.migration.";
+    public static final String ACTION = PREFIX + "action";
+    public static final String ACTION_EXPORT = "export";
+    public static final String ACTION_IMPORT = "import";
+
+    public static final String PROVIDER = PREFIX + "provider";
+    public static final String PROVIDER_DEFAULT = "zip";
+
+    // Name of the realm to export. If null, then full export will be triggered
+    public static final String REALM_NAME = PREFIX + "realmName";
+
+    // used for "dir" provider
+    public static final String DIR = PREFIX + "dir";
+    // used for "zip" provider
+    public static final String ZIP_FILE = PREFIX + "zipFile";
+    public static final String ZIP_PASSWORD = PREFIX + "zipPassword";
+    // used for "singleFile" provider
+    public static final String FILE = PREFIX + "file";
+
+    // How to export users when realm export is requested for "dir" and "zip" provider
+    public static final String USERS_EXPORT_STRATEGY = PREFIX + "usersExportStrategy";
+    public static final UsersExportStrategy DEFAULT_USERS_EXPORT_STRATEGY = UsersExportStrategy.DIFFERENT_FILES;
+
+    // Number of users per file used in "dir" and "zip" providers. Used if usersExportStrategy is DIFFERENT_FILES
+    public static final String USERS_PER_FILE = PREFIX + "usersPerFile";
+    public static final Integer DEFAULT_USERS_PER_FILE = 5000;
+
+    // Strategy used during import data
+    public static final String STRATEGY = PREFIX + "strategy";
+    public static final Strategy DEFAULT_STRATEGY = Strategy.OVERWRITE_EXISTING;
+
+    public static String getAction() {
+        return System.getProperty(ACTION);
+    }
+
+    public static void setAction(String exportImportAction) {
+        System.setProperty(ACTION, exportImportAction);
+    }
+
+    public static String getProvider() {
+        return System.getProperty(PROVIDER, PROVIDER_DEFAULT);
+    }
+
+    public static void setProvider(String exportImportProvider) {
+        System.setProperty(PROVIDER, exportImportProvider);
+    }
+
+    public static String getRealmName() {
+        return System.getProperty(REALM_NAME);
+    }
+
+    public static void setRealmName(String realmName) {
+        if (realmName != null) {
+            System.setProperty(REALM_NAME, realmName);
+        } else {
+            System.getProperties().remove(REALM_NAME);
+        }
+    }
+
+    public static String getDir() {
+        return System.getProperty(DIR);
+    }
+
+    public static String setDir(String dir) {
+        return System.setProperty(DIR, dir);
+    }
+
+    public static String getZipFile() {
+        return System.getProperty(ZIP_FILE);
+    }
+
+    public static void setZipFile(String exportImportZipFile) {
+        System.setProperty(ZIP_FILE, exportImportZipFile);
+    }
+
+    public static String getZipPassword() {
+        return System.getProperty(ZIP_PASSWORD);
+    }
+
+    public static void setZipPassword(String exportImportZipPassword) {
+        System.setProperty(ZIP_PASSWORD, exportImportZipPassword);
+    }
+
+    public static String getFile() {
+        return System.getProperty(FILE);
+    }
+
+    public static void setFile(String file) {
+        System.setProperty(FILE, file);
+    }
+
+    public static UsersExportStrategy getUsersExportStrategy() {
+        String usersExportStrategy = System.getProperty(USERS_EXPORT_STRATEGY, DEFAULT_USERS_EXPORT_STRATEGY.toString());
+        return Enum.valueOf(UsersExportStrategy.class, usersExportStrategy);
+    }
+
+    public static void setUsersExportStrategy(UsersExportStrategy usersExportStrategy) {
+        System.setProperty(USERS_EXPORT_STRATEGY, usersExportStrategy.toString());
+    }
+
+    public static Integer getUsersPerFile() {
+        String usersPerFile = System.getProperty(USERS_PER_FILE, String.valueOf(DEFAULT_USERS_PER_FILE));
+        return Integer.parseInt(usersPerFile.trim());
+    }
+
+    public static void setUsersPerFile(Integer usersPerFile) {
+        System.setProperty(USERS_PER_FILE, String.valueOf(usersPerFile));
+    }
+
+    public static Strategy getStrategy() {
+        String strategy = System.getProperty(STRATEGY, DEFAULT_STRATEGY.toString());
+        return Enum.valueOf(Strategy.class, strategy);
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportManager.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportManager.java
new file mode 100644
index 0000000..caedb36
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportImportManager.java
@@ -0,0 +1,63 @@
+package org.keycloak.exportimport;
+
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExportImportManager {
+
+    private static final Logger logger = Logger.getLogger(ExportImportManager.class);
+
+    public void checkExportImport(KeycloakSessionFactory sessionFactory) {
+        String exportImportAction = ExportImportConfig.getAction();
+        String realmName = ExportImportConfig.getRealmName();
+
+        boolean export = false;
+        boolean importt = false;
+        if (ExportImportConfig.ACTION_EXPORT.equals(exportImportAction)) {
+            export = true;
+        } else if (ExportImportConfig.ACTION_IMPORT.equals(exportImportAction)) {
+            importt = true;
+        }
+
+        if (export || importt) {
+            String exportImportProviderId = ExportImportConfig.getProvider();
+            logger.debug("Will use provider: " + exportImportProviderId);
+            KeycloakSession session = sessionFactory.create();
+
+            try {
+                if (export) {
+                    ExportProvider exportProvider = session.getProvider(ExportProvider.class, exportImportProviderId);
+
+                    if (realmName == null) {
+                        logger.info("Full model export requested");
+                        exportProvider.exportModel(sessionFactory);
+                    } else {
+                        logger.infof("Export of realm '%s' requested", realmName);
+                        exportProvider.exportRealm(sessionFactory, realmName);
+                    }
+                    logger.info("Export finished successfully");
+                } else {
+                    ImportProvider importProvider = session.getProvider(ImportProvider.class, exportImportProviderId);
+                    Strategy strategy = ExportImportConfig.getStrategy();
+                    if (realmName == null) {
+                        logger.infof("Full model import requested. Strategy: %s", strategy.toString());
+                        importProvider.importModel(sessionFactory, strategy);
+                    } else {
+                        logger.infof("Import of realm '%s' requested. Strategy: %s", realmName, strategy.toString());
+                        importProvider.importRealm(sessionFactory, realmName, strategy);
+                    }
+                    logger.info("Import finished successfully");
+                }
+            } catch (Throwable ioe) {
+                logger.error("Error during export/import", ioe);
+            } finally {
+                session.close();
+            }
+        }
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportProvider.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportProvider.java
new file mode 100644
index 0000000..1a0d6a0
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportProvider.java
@@ -0,0 +1,18 @@
+package org.keycloak.exportimport;
+
+import java.io.IOException;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface ExportProvider extends Provider {
+
+    void exportModel(KeycloakSessionFactory factory) throws IOException;
+
+    void exportRealm(KeycloakSessionFactory factory, String realmName) throws IOException;
+
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportSpi.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportSpi.java
new file mode 100644
index 0000000..6ec2960
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ExportSpi.java
@@ -0,0 +1,26 @@
+package org.keycloak.exportimport;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExportSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "export";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return ExportProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return ExportProviderFactory.class;
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportProvider.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportProvider.java
new file mode 100644
index 0000000..9134516
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportProvider.java
@@ -0,0 +1,17 @@
+package org.keycloak.exportimport;
+
+import java.io.IOException;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.Provider;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface ImportProvider extends Provider {
+
+    void importModel(KeycloakSessionFactory factory, Strategy strategy) throws IOException;
+
+    void importRealm(KeycloakSessionFactory factory, String realmName, Strategy strategy) throws IOException;
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportSpi.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportSpi.java
new file mode 100644
index 0000000..b562f3f
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/ImportSpi.java
@@ -0,0 +1,26 @@
+package org.keycloak.exportimport;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ImportSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "import";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return ImportProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return ImportProviderFactory.class;
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/Strategy.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/Strategy.java
new file mode 100644
index 0000000..6bbd70d
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/Strategy.java
@@ -0,0 +1,10 @@
+package org.keycloak.exportimport;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public enum Strategy {
+
+    IGNORE_EXISTING,         // Ignore existing user entries
+    OVERWRITE_EXISTING       // Overwrite existing user entries
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java
new file mode 100644
index 0000000..c1df989
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/UsersExportStrategy.java
@@ -0,0 +1,11 @@
+package org.keycloak.exportimport;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public enum UsersExportStrategy {
+    SKIP,            // Exporting of users will be skipped completely
+    REALM_FILE,      // All users will be exported to same file with realm (So file like "foo-realm.json" with both realm data and users)
+    SAME_FILE,       // All users will be exported to same file but different than realm (So file like "foo-realm.json" with realm data and "foo-users.json" with users)
+    DIFFERENT_FILES  // Users will be exported into more different files according to maximum number of users per file
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportJob.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportJob.java
new file mode 100644
index 0000000..748fe1f
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportJob.java
@@ -0,0 +1,15 @@
+package org.keycloak.exportimport.util;
+
+import java.io.IOException;
+
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * Task to be executed inside transaction
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface ExportImportJob {
+
+    public void run(KeycloakSession session) throws IOException;
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportUtils.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportUtils.java
new file mode 100644
index 0000000..b73a4c0
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportImportUtils.java
@@ -0,0 +1,47 @@
+package org.keycloak.exportimport.util;
+
+import java.io.IOException;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.models.RealmModel;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExportImportUtils {
+
+    /**
+     * Wrap given runnable job into KeycloakTransaction.
+     *
+     * @param factory
+     * @param job
+     */
+    public static void runJobInTransaction(KeycloakSessionFactory factory, ExportImportJob job) throws IOException {
+        KeycloakSession session = factory.create();
+        KeycloakTransaction tx = session.getTransaction();
+        try {
+            tx.begin();
+            job.run(session);
+
+            if (tx.isActive()) {
+                if (tx.getRollbackOnly()) {
+                    tx.rollback();
+                } else {
+                    tx.commit();
+                }
+            }
+        } finally {
+            if (tx.isActive()) {
+                tx.rollback();
+            }
+            session.close();
+        }
+    }
+
+    public static String getMasterRealmAdminApplicationName(RealmModel realm) {
+        return realm.getName() + "-realm";
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
new file mode 100755
index 0000000..4c1cc5b
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ExportUtils.java
@@ -0,0 +1,367 @@
+package org.keycloak.exportimport.util;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import net.iharder.Base64;
+import org.codehaus.jackson.JsonEncoding;
+import org.codehaus.jackson.JsonFactory;
+import org.codehaus.jackson.JsonGenerator;
+import org.codehaus.jackson.map.ObjectMapper;
+import org.codehaus.jackson.map.SerializationConfig;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.ModelToRepresentation;
+import org.keycloak.representations.idm.ApplicationRepresentation;
+import org.keycloak.representations.idm.AuthenticationLinkRepresentation;
+import org.keycloak.representations.idm.ClaimRepresentation;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.OAuthClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.RolesRepresentation;
+import org.keycloak.representations.idm.ScopeMappingRepresentation;
+import org.keycloak.representations.idm.SocialLinkRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ExportUtils {
+
+    public static RealmRepresentation exportRealm(KeycloakSession session, RealmModel realm, boolean includeUsers) {
+        RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm);
+
+        // Audit
+        rep.setAuditEnabled(realm.isAuditEnabled());
+        if (realm.getAuditExpiration() != 0) {
+            rep.setAuditExpiration(realm.getAuditExpiration());
+        }
+
+        if (realm.getAuditListeners() != null) {
+            rep.setAuditListeners(new LinkedList<String>(realm.getAuditListeners()));
+        }
+
+        // Applications
+        List<ApplicationModel> applications = realm.getApplications();
+        List<ApplicationRepresentation> appReps = new ArrayList<ApplicationRepresentation>();
+        for (ApplicationModel app : applications) {
+            ApplicationRepresentation appRep = exportApplication(app);
+            appReps.add(appRep);
+        }
+        rep.setApplications(appReps);
+
+        // OAuth clients
+        List<OAuthClientModel> oauthClients = realm.getOAuthClients();
+        List<OAuthClientRepresentation> oauthClientReps = new ArrayList<OAuthClientRepresentation>();
+        for (OAuthClientModel oauthClient : oauthClients) {
+            OAuthClientRepresentation clientRep = ModelToRepresentation.toRepresentation(oauthClient);
+            oauthClientReps.add(clientRep);
+        }
+        rep.setOauthClients(oauthClientReps);
+
+        // Roles
+        List<RoleRepresentation> realmRoleReps = null;
+        Map<String, List<RoleRepresentation>> appRolesReps = new HashMap<String, List<RoleRepresentation>>();
+
+        Set<RoleModel> realmRoles = realm.getRoles();
+        if (realmRoles != null && realmRoles.size() > 0) {
+            realmRoleReps = exportRoles(realmRoles);
+        }
+        for (ApplicationModel app : applications) {
+            Set<RoleModel> currentAppRoles = app.getRoles();
+            List<RoleRepresentation> currentAppRoleReps = exportRoles(currentAppRoles);
+            appRolesReps.put(app.getName(), currentAppRoleReps);
+        }
+
+        RolesRepresentation rolesRep = new RolesRepresentation();
+        if (realmRoleReps != null) {
+            rolesRep.setRealm(realmRoleReps);
+        }
+        if (appRolesReps.size() > 0) {
+            rolesRep.setApplication(appRolesReps);
+        }
+        rep.setRoles(rolesRep);
+
+        // Scopes
+        List<ClientModel> allClients = new ArrayList<ClientModel>(applications);
+        allClients.addAll(realm.getOAuthClients());
+        Map<String, List<ScopeMappingRepresentation>> appScopeReps = new HashMap<String, List<ScopeMappingRepresentation>>();
+
+        for (ClientModel client : allClients) {
+            Set<RoleModel> clientScopes = client.getScopeMappings();
+            ScopeMappingRepresentation scopeMappingRep = null;
+            for (RoleModel scope : clientScopes) {
+                if (scope.getContainer() instanceof RealmModel) {
+                    if (scopeMappingRep == null) {
+                        scopeMappingRep = rep.scopeMapping(client.getClientId());
+                    }
+                    scopeMappingRep.role(scope.getName());
+                } else {
+                    ApplicationModel app = (ApplicationModel)scope.getContainer();
+                    String appName = app.getName();
+                    List<ScopeMappingRepresentation> currentAppScopes = appScopeReps.get(appName);
+                    if (currentAppScopes == null) {
+                        currentAppScopes = new ArrayList<ScopeMappingRepresentation>();
+                        appScopeReps.put(appName, currentAppScopes);
+                    }
+
+                    ScopeMappingRepresentation currentClientScope = null;
+                    for (ScopeMappingRepresentation scopeMapping : currentAppScopes) {
+                        if (scopeMapping.getClient().equals(client.getClientId())) {
+                            currentClientScope = scopeMapping;
+                            break;
+                        }
+                    }
+                    if (currentClientScope == null) {
+                        currentClientScope = new ScopeMappingRepresentation();
+                        currentClientScope.setClient(client.getClientId());
+                        currentAppScopes.add(currentClientScope);
+                    }
+                    currentClientScope.role(scope.getName());
+                }
+            }
+        }
+
+        if (appScopeReps.size() > 0) {
+            rep.setApplicationScopeMappings(appScopeReps);
+        }
+
+        // Finally users if needed
+        if (includeUsers) {
+            List<UserModel> allUsers = session.users().getUsers(realm);
+            List<UserRepresentation> users = new ArrayList<UserRepresentation>();
+            for (UserModel user : allUsers) {
+                UserRepresentation userRep = exportUser(session, realm, user);
+                users.add(userRep);
+            }
+
+            if (users.size() > 0) {
+                rep.setUsers(users);
+            }
+        }
+
+        return rep;
+    }
+
+    /**
+     * Full export of application including claims and secret
+     * @param app
+     * @return full ApplicationRepresentation
+     */
+    public static ApplicationRepresentation exportApplication(ApplicationModel app) {
+        ApplicationRepresentation appRep = ModelToRepresentation.toRepresentation(app);
+
+        appRep.setSecret(app.getSecret());
+        ClaimRepresentation claimRep = ModelToRepresentation.toRepresentation((ClientModel)app);
+        appRep.setClaims(claimRep);
+        return appRep;
+    }
+
+    public static List<RoleRepresentation> exportRoles(Collection<RoleModel> roles) {
+        List<RoleRepresentation> roleReps = new ArrayList<RoleRepresentation>();
+
+        for (RoleModel role : roles) {
+            RoleRepresentation roleRep = exportRole(role);
+            roleReps.add(roleRep);
+        }
+        return roleReps;
+    }
+
+    public static List<String> getRoleNames(Collection<RoleModel> roles) {
+        List<String> roleNames = new ArrayList<String>();
+        for (RoleModel role : roles) {
+            roleNames.add(role.getName());
+        }
+        return roleNames;
+    }
+
+    /**
+     * Full export of role including composite roles
+     * @param role
+     * @return RoleRepresentation with all stuff filled (including composite roles)
+     */
+    public static RoleRepresentation exportRole(RoleModel role) {
+        RoleRepresentation roleRep = ModelToRepresentation.toRepresentation(role);
+
+        Set<RoleModel> composites = role.getComposites();
+        if (composites != null && composites.size() > 0) {
+            Set<String> compositeRealmRoles = null;
+            Map<String, List<String>> compositeAppRoles = null;
+
+            for (RoleModel composite : composites) {
+                RoleContainerModel crContainer = composite.getContainer();
+                if (crContainer instanceof RealmModel) {
+
+                    if (compositeRealmRoles == null) {
+                        compositeRealmRoles = new HashSet<String>();
+                    }
+                    compositeRealmRoles.add(composite.getName());
+                } else {
+                    if (compositeAppRoles == null) {
+                        compositeAppRoles = new HashMap<String, List<String>>();
+                    }
+
+                    ApplicationModel app = (ApplicationModel)crContainer;
+                    String appName = app.getName();
+                    List<String> currentAppComposites = compositeAppRoles.get(appName);
+                    if (currentAppComposites == null) {
+                        currentAppComposites = new ArrayList<String>();
+                        compositeAppRoles.put(appName, currentAppComposites);
+                    }
+                    currentAppComposites.add(composite.getName());
+                }
+            }
+
+            RoleRepresentation.Composites compRep = new RoleRepresentation.Composites();
+            if (compositeRealmRoles != null) {
+                compRep.setRealm(compositeRealmRoles);
+            }
+            if (compositeAppRoles != null) {
+                compRep.setApplication(compositeAppRoles);
+            }
+
+            roleRep.setComposites(compRep);
+        }
+
+        return roleRep;
+    }
+
+    /**
+     * Full export of user (including role mappings and credentials)
+     *
+     * @param user
+     * @return fully exported user representation
+     */
+    public static UserRepresentation exportUser(KeycloakSession session, RealmModel realm, UserModel user) {
+        UserRepresentation userRep = ModelToRepresentation.toRepresentation(user);
+
+        // AuthenticationLink
+        AuthenticationLinkModel authLink = user.getAuthenticationLink();
+        if (authLink != null) {
+            AuthenticationLinkRepresentation authLinkRepresentation = exportAuthLink(authLink);
+            userRep.setAuthenticationLink(authLinkRepresentation);
+        }
+
+        // Social links
+        Set<SocialLinkModel> socialLinks = session.users().getSocialLinks(user, realm);
+        List<SocialLinkRepresentation> socialLinkReps = new ArrayList<SocialLinkRepresentation>();
+        for (SocialLinkModel socialLink : socialLinks) {
+            SocialLinkRepresentation socialLinkRep = exportSocialLink(socialLink);
+            socialLinkReps.add(socialLinkRep);
+        }
+        if (socialLinkReps.size() > 0) {
+            userRep.setSocialLinks(socialLinkReps);
+        }
+
+        // Role mappings
+        Set<RoleModel> roles = user.getRoleMappings();
+        List<String> realmRoleNames = new ArrayList<String>();
+        Map<String, List<String>> appRoleNames = new HashMap<String, List<String>>();
+        for (RoleModel role : roles) {
+            if (role.getContainer() instanceof RealmModel) {
+                realmRoleNames.add(role.getName());
+            } else {
+                ApplicationModel app = (ApplicationModel)role.getContainer();
+                String appName = app.getName();
+                List<String> currentAppRoles = appRoleNames.get(appName);
+                if (currentAppRoles == null) {
+                    currentAppRoles = new ArrayList<String>();
+                    appRoleNames.put(appName, currentAppRoles);
+                }
+
+                currentAppRoles.add(role.getName());
+            }
+        }
+
+        if (realmRoleNames.size() > 0) {
+            userRep.setRealmRoles(realmRoleNames);
+        }
+        if (appRoleNames.size() > 0) {
+            userRep.setApplicationRoles(appRoleNames);
+        }
+
+        // Credentials
+        List<UserCredentialValueModel> creds = user.getCredentialsDirectly();
+        List<CredentialRepresentation> credReps = new ArrayList<CredentialRepresentation>();
+        for (UserCredentialValueModel cred : creds) {
+            CredentialRepresentation credRep = exportCredential(cred);
+            credReps.add(credRep);
+        }
+        userRep.setCredentials(credReps);
+        userRep.setFederationLink(user.getFederationLink());
+
+        return userRep;
+    }
+
+    public static AuthenticationLinkRepresentation exportAuthLink(AuthenticationLinkModel authLinkModel) {
+        AuthenticationLinkRepresentation authLinkRep = new AuthenticationLinkRepresentation();
+        authLinkRep.setAuthProvider(authLinkModel.getAuthProvider());
+        authLinkRep.setAuthUserId(authLinkModel.getAuthUserId());
+        return authLinkRep;
+    }
+
+    public static SocialLinkRepresentation exportSocialLink(SocialLinkModel socialLink) {
+        SocialLinkRepresentation socialLinkRep = new SocialLinkRepresentation();
+        socialLinkRep.setSocialProvider(socialLink.getSocialProvider());
+        socialLinkRep.setSocialUserId(socialLink.getSocialUserId());
+        socialLinkRep.setSocialUsername(socialLink.getSocialUsername());
+        return socialLinkRep;
+    }
+
+    public static CredentialRepresentation exportCredential(UserCredentialValueModel userCred) {
+        CredentialRepresentation credRep = new CredentialRepresentation();
+        credRep.setType(userCred.getType());
+        credRep.setDevice(userCred.getDevice());
+        credRep.setHashedSaltedValue(userCred.getValue());
+        credRep.setSalt(Base64.encodeBytes(userCred.getSalt()));
+        credRep.setHashIterations(userCred.getHashIterations());
+        return credRep;
+    }
+
+    // Streaming API
+
+    public static void exportUsersToStream(KeycloakSession session, RealmModel realm, List<UserModel> usersToExport, ObjectMapper mapper, OutputStream os) throws IOException {
+        JsonFactory factory = mapper.getJsonFactory();
+        JsonGenerator generator = factory.createJsonGenerator(os, JsonEncoding.UTF8);
+        try {
+            if (mapper.isEnabled(SerializationConfig.Feature.INDENT_OUTPUT)) {
+                generator.useDefaultPrettyPrinter();
+            }
+            generator.writeStartObject();
+            generator.writeStringField("realm", realm.getName());
+            // generator.writeStringField("strategy", strategy.toString());
+            generator.writeFieldName("users");
+            generator.writeStartArray();
+
+            for (UserModel user : usersToExport) {
+                UserRepresentation userRep = ExportUtils.exportUser(session, realm, user);
+                generator.writeObject(userRep);
+            }
+
+            generator.writeEndArray();
+            generator.writeEndObject();
+        } finally {
+            generator.close();
+        }
+    }
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ImportUtils.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
new file mode 100755
index 0000000..1425b36
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/ImportUtils.java
@@ -0,0 +1,222 @@
+package org.keycloak.exportimport.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.codehaus.jackson.JsonFactory;
+import org.codehaus.jackson.JsonParser;
+import org.codehaus.jackson.JsonToken;
+import org.codehaus.jackson.map.ObjectMapper;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.models.AdminRoles;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.RepresentationToModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ImportUtils {
+
+    private static final Logger logger = Logger.getLogger(ImportUtils.class);
+
+    /**
+     * Fully import realm from representation, save it to model and return model of newly created realm
+     *
+     * @param session
+     * @param rep
+     * @param strategy specifies whether to overwrite or ignore existing realm or user entries
+     * @return newly imported realm (or existing realm if ignoreExisting is true and realm of this name already exists)
+     */
+    public static RealmModel importRealm(KeycloakSession session, RealmRepresentation rep, Strategy strategy) {
+        String realmName = rep.getRealm();
+        RealmProvider model = session.realms();
+        RealmModel realm = model.getRealmByName(realmName);
+
+        if (realm != null) {
+            if (strategy == Strategy.IGNORE_EXISTING) {
+                logger.infof("Realm '%s' already exists. Import skipped", realmName);
+                return realm;
+            } else {
+                logger.infof("Realm '%s' already exists. Removing it before import", realmName);
+                if (Config.getAdminRealm().equals(realm.getId())) {
+                    // Delete all masterAdmin apps due to foreign key constraints
+                    for (RealmModel currRealm : model.getRealms()) {
+                        currRealm.setMasterAdminApp(null);
+                    }
+                }
+                // TODO: For migration between versions, it should be possible to delete just realm but keep it's users
+                model.removeRealm(realm.getId());
+            }
+        }
+
+        realm = rep.getId() != null ? model.createRealm(rep.getId(), realmName) : model.createRealm(realmName);
+
+        RepresentationToModel.importRealm(session, rep, realm);
+
+        refreshMasterAdminApps(model, realm);
+
+        logger.infof("Realm '%s' imported", realmName);
+        return realm;
+    }
+
+    private static void refreshMasterAdminApps(RealmProvider model, RealmModel realm) {
+        String adminRealmId = Config.getAdminRealm();
+        if (adminRealmId.equals(realm.getId())) {
+            // We just imported master realm. All 'masterAdminApps' need to be refreshed
+            RealmModel adminRealm = realm;
+            for (RealmModel currentRealm : model.getRealms()) {
+                ApplicationModel masterApp = adminRealm.getApplicationByName(ExportImportUtils.getMasterRealmAdminApplicationName(currentRealm));
+                if (masterApp != null) {
+                    currentRealm.setMasterAdminApp(masterApp);
+                }  else {
+                    setupMasterAdminManagement(model, currentRealm);
+                }
+            }
+        } else {
+            // Need to refresh masterApp for current realm
+            RealmModel adminRealm = model.getRealm(adminRealmId);
+            ApplicationModel masterApp = adminRealm.getApplicationByName(ExportImportUtils.getMasterRealmAdminApplicationName(realm));
+            if (masterApp != null) {
+                realm.setMasterAdminApp(masterApp);
+            }  else {
+                setupMasterAdminManagement(model, realm);
+            }
+        }
+    }
+
+    // TODO: We need method here, so we are able to refresh masterAdmin applications after import. Should be RealmManager moved to model/api instead?
+    public static void setupMasterAdminManagement(RealmProvider model, RealmModel realm) {
+        RealmModel adminRealm;
+        RoleModel adminRole;
+
+        if (realm.getName().equals(Config.getAdminRealm())) {
+            adminRealm = realm;
+
+            adminRole = realm.addRole(AdminRoles.ADMIN);
+
+            RoleModel createRealmRole = realm.addRole(AdminRoles.CREATE_REALM);
+            adminRole.addCompositeRole(createRealmRole);
+        } else {
+            adminRealm = model.getRealmByName(Config.getAdminRealm());
+            adminRole = adminRealm.getRole(AdminRoles.ADMIN);
+        }
+
+        ApplicationModel realmAdminApp = KeycloakModelUtils.createApplication(adminRealm, ExportImportUtils.getMasterRealmAdminApplicationName(realm));
+        realmAdminApp.setBearerOnly(true);
+        realm.setMasterAdminApp(realmAdminApp);
+
+        for (String r : AdminRoles.ALL_REALM_ROLES) {
+            RoleModel role = realmAdminApp.addRole(r);
+            adminRole.addCompositeRole(role);
+        }
+    }
+
+
+    /**
+     * Fully import realm (or more realms from particular stream)
+     *
+     * @param session
+     * @param mapper
+     * @param is
+     * @param strategy
+     * @throws IOException
+     */
+    public static void importFromStream(KeycloakSession session, ObjectMapper mapper, InputStream is, Strategy strategy) throws IOException {
+        JsonFactory factory = mapper.getJsonFactory();
+        JsonParser parser = factory.createJsonParser(is);
+        try {
+            parser.nextToken();
+
+            if (parser.getCurrentToken() == JsonToken.START_ARRAY) {
+                // Case with more realms in stream
+                parser.nextToken();
+
+                List<RealmRepresentation> realmReps = new ArrayList<RealmRepresentation>();
+                while (parser.getCurrentToken() == JsonToken.START_OBJECT) {
+                    RealmRepresentation realmRep = parser.readValueAs(RealmRepresentation.class);
+                    parser.nextToken();
+
+                    // Ensure that master realm is imported first
+                    if (Config.getAdminRealm().equals(realmRep.getRealm())) {
+                        realmReps.add(0, realmRep);
+                    } else {
+                        realmReps.add(realmRep);
+                    }
+                }
+
+                for (RealmRepresentation realmRep : realmReps) {
+                    importRealm(session, realmRep, strategy);
+                }
+            } else if (parser.getCurrentToken() == JsonToken.START_OBJECT) {
+                // Case with single realm in stream
+                RealmRepresentation realmRep = parser.readValueAs(RealmRepresentation.class);
+                importRealm(session, realmRep, strategy);
+            }
+        } finally {
+            parser.close();
+        }
+    }
+
+    // Assuming that it's invoked inside transaction
+    public static void importUsersFromStream(KeycloakSession session, String realmName, ObjectMapper mapper, InputStream is) throws IOException {
+        RealmProvider model = session.realms();
+        JsonFactory factory = mapper.getJsonFactory();
+        JsonParser parser = factory.createJsonParser(is);
+        try {
+            parser.nextToken();
+
+            while (parser.nextToken() == JsonToken.FIELD_NAME) {
+                if ("realm".equals(parser.getText())) {
+                    parser.nextToken();
+                    String currRealmName = parser.getText();
+                    if (!currRealmName.equals(realmName)) {
+                        throw new IllegalStateException("Trying to import users into invalid realm. Realm name: " + realmName + ", Expected realm name: " + realmName);
+                    }
+                } else if ("users".equals(parser.getText())) {
+                    parser.nextToken();
+
+                    if (parser.getCurrentToken() == JsonToken.START_ARRAY) {
+                        parser.nextToken();
+                    }
+
+                    // TODO: support for more transactions per single users file (if needed)
+                    List<UserRepresentation> userReps = new ArrayList<UserRepresentation>();
+                    while (parser.getCurrentToken() == JsonToken.START_OBJECT) {
+                        UserRepresentation user = parser.readValueAs(UserRepresentation.class);
+                        userReps.add(user);
+                        parser.nextToken();
+                    }
+
+                    importUsers(session, model, realmName, userReps);
+
+                    if (parser.getCurrentToken() == JsonToken.END_ARRAY) {
+                        parser.nextToken();
+                    }
+                }
+            }
+        } finally {
+            parser.close();
+        }
+    }
+
+    private static void importUsers(KeycloakSession session, RealmProvider model, String realmName, List<UserRepresentation> userReps) {
+        RealmModel realm = model.getRealmByName(realmName);
+        Map<String, ApplicationModel> apps = realm.getApplicationNameMap();
+        for (UserRepresentation user : userReps) {
+            RepresentationToModel.createUser(session, realm, user, apps);
+        }
+    }
+
+}

diff --git a/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java
new file mode 100755
index 0000000..9395ceb
--- /dev/null
+++ b/export-import/export-import-api/src/main/java/org/keycloak/exportimport/util/MultipleStepsExportProvider.java
@@ -0,0 +1,114 @@
+package org.keycloak.exportimport.util;
+
+import java.io.IOException;
+import java.util.List;
+
+import org.jboss.logging.Logger;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ExportProvider;
+import org.keycloak.exportimport.UsersExportStrategy;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public abstract class MultipleStepsExportProvider implements ExportProvider {
+
+    protected final Logger logger = Logger.getLogger(getClass());
+
+    @Override
+    public void exportModel(KeycloakSessionFactory factory) throws IOException {
+        final RealmsHolder holder = new RealmsHolder();
+
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) {
+                List<RealmModel> realms = session.realms().getRealms();
+                holder.realms = realms;
+            }
+
+        });
+
+        for (RealmModel realm : holder.realms) {
+            exportRealm(factory, realm.getName());
+        }
+    }
+
+    @Override
+    public void exportRealm(KeycloakSessionFactory factory, final String realmName) throws IOException {
+        final UsersExportStrategy usersExportStrategy = ExportImportConfig.getUsersExportStrategy();
+        final int usersPerFile = ExportImportConfig.getUsersPerFile();
+        final UsersHolder usersHolder = new UsersHolder();
+        final boolean exportUsersIntoRealmFile = usersExportStrategy == UsersExportStrategy.REALM_FILE;
+
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) throws IOException {
+                RealmModel realm = session.realms().getRealmByName(realmName);
+                RealmRepresentation rep = ExportUtils.exportRealm(session, realm, exportUsersIntoRealmFile);
+                writeRealm(realmName + "-realm.json", rep);
+                logger.info("Realm '" + realmName + "' - data exported");
+
+                // Count total number of users
+                if (!exportUsersIntoRealmFile) {
+                    usersHolder.totalCount = session.users().getUsersCount(realm);
+                }
+            }
+
+        });
+
+        if (usersExportStrategy != UsersExportStrategy.SKIP && !exportUsersIntoRealmFile) {
+            // We need to export users now
+            usersHolder.currentPageStart = 0;
+
+            // usersExportStrategy==SAME_FILE  means exporting all users into single file (but separate to realm)
+            final int countPerPage = (usersExportStrategy == UsersExportStrategy.SAME_FILE) ? usersHolder.totalCount : usersPerFile;
+
+            while (usersHolder.currentPageStart < usersHolder.totalCount) {
+                if (usersHolder.currentPageStart + countPerPage < usersHolder.totalCount) {
+                    usersHolder.currentPageEnd = usersHolder.currentPageStart + countPerPage;
+                } else {
+                    usersHolder.currentPageEnd = usersHolder.totalCount;
+                }
+
+                ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+                    @Override
+                    public void run(KeycloakSession session) throws IOException {
+                        RealmModel realm = session.realms().getRealmByName(realmName);
+                        usersHolder.users = session.users().getUsers(realm, usersHolder.currentPageStart, usersHolder.currentPageEnd - usersHolder.currentPageStart);
+
+                        writeUsers(realmName + "-users-" + (usersHolder.currentPageStart / countPerPage) + ".json", session, realm, usersHolder.users);
+
+                        logger.info("Users " + usersHolder.currentPageStart + "-" + (usersHolder.currentPageEnd -1) + " exported");
+                    }
+
+                });
+
+                usersHolder.currentPageStart = usersHolder.currentPageEnd;
+            }
+        }
+    }
+
+    protected abstract void writeRealm(String fileName, RealmRepresentation rep) throws IOException;
+
+    protected abstract void writeUsers(String fileName, KeycloakSession session, RealmModel realm, List<UserModel> users) throws IOException;
+
+    public static class RealmsHolder {
+        List<RealmModel> realms;
+
+    }
+
+    public static class UsersHolder {
+        List<UserModel> users;
+        int totalCount;
+        int currentPageStart;
+        int currentPageEnd;
+    }
+}

diff --git a/export-import/export-import-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/export-import/export-import-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi
new file mode 100644
index 0000000..9302943
--- /dev/null
+++ b/export-import/export-import-api/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -0,0 +1,2 @@
+org.keycloak.exportimport.ExportSpi
+org.keycloak.exportimport.ImportSpi
\ No newline at end of file

diff --git a/export-import/export-import-dir/pom.xml b/export-import/export-import-dir/pom.xml
new file mode 100644
index 0000000..4cd8dc1
--- /dev/null
+++ b/export-import/export-import-dir/pom.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-export-import-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-export-import-dir</artifactId>
+    <name>Keycloak Export Import To Directory</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

diff --git a/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java b/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java
new file mode 100644
index 0000000..512004d
--- /dev/null
+++ b/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProvider.java
@@ -0,0 +1,123 @@
+package org.keycloak.exportimport.dir;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FilenameFilter;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.exportimport.util.ExportImportJob;
+import org.keycloak.exportimport.util.ExportImportUtils;
+import org.keycloak.exportimport.util.ImportUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DirImportProvider implements ImportProvider {
+
+    private static final Logger logger = Logger.getLogger(DirImportProvider.class);
+
+    private final File rootDirectory;
+
+    public DirImportProvider() {
+        // Determine system tmp directory
+        String tempDir = System.getProperty("java.io.tmpdir");
+
+        // Delete and recreate directory inside tmp
+        this.rootDirectory = new File(tempDir + "/keycloak-export");
+        if (!this.rootDirectory .exists()) {
+            throw new IllegalStateException("Directory " + this.rootDirectory + " doesn't exists");
+        }
+
+        logger.infof("Importing from directory %s", this.rootDirectory.getAbsolutePath());
+    }
+
+    public DirImportProvider(File rootDirectory) {
+        this.rootDirectory = rootDirectory;
+
+        logger.infof("Importing from directory %s", this.rootDirectory.getAbsolutePath());
+    }
+
+    @Override
+    public void importModel(KeycloakSessionFactory factory, Strategy strategy) throws IOException {
+        File[] realmFiles = this.rootDirectory.listFiles(new FilenameFilter() {
+
+            @Override
+            public boolean accept(File dir, String name) {
+                return (name.endsWith("-realm.json"));
+            }
+        });
+
+        List<String> realmNames = new ArrayList<String>();
+        for (File file : realmFiles) {
+            String fileName = file.getName();
+            // Parse "foo" from "foo-realm.json"
+            String realmName = fileName.substring(0, fileName.length() - 11);
+
+            // Ensure that master realm is imported first
+            if (Config.getAdminRealm().equals(realmName)) {
+                realmNames.add(0, realmName);
+            } else {
+                realmNames.add(realmName);
+            }
+        }
+
+        for (String realmName : realmNames) {
+            importRealm(factory, realmName, strategy);
+        }
+    }
+
+    @Override
+    public void importRealm(KeycloakSessionFactory factory, final String realmName, final Strategy strategy) throws IOException {
+        File realmFile = new File(this.rootDirectory + File.separator + realmName + "-realm.json");
+        File[] userFiles = this.rootDirectory.listFiles(new FilenameFilter() {
+
+            @Override
+            public boolean accept(File dir, String name) {
+                return (name.startsWith(realmName)) && (name.endsWith(".json")) && (name.substring(realmName.length()).contains("-users-") );
+            }
+        });
+
+        // Import realm first
+        FileInputStream is = new FileInputStream(realmFile);
+        final RealmRepresentation realmRep = JsonSerialization.readValue(is, RealmRepresentation.class);
+
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) throws IOException {
+                ImportUtils.importRealm(session, realmRep, strategy);
+            }
+
+        });
+
+        // Import users
+        for (File userFile : userFiles) {
+            final FileInputStream fis = new FileInputStream(userFile);
+            ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+                @Override
+                public void run(KeycloakSession session) throws IOException {
+                    ImportUtils.importUsersFromStream(session, realmName, JsonSerialization.mapper, fis);
+                }
+            });
+        }
+    }
+
+    @Override
+    public void close() {
+
+    }
+}

diff --git a/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java b/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java
new file mode 100644
index 0000000..3e39a77
--- /dev/null
+++ b/export-import/export-import-dir/src/main/java/org/keycloak/exportimport/dir/DirImportProviderFactory.java
@@ -0,0 +1,34 @@
+package org.keycloak.exportimport.dir;
+
+import java.io.File;
+
+import org.keycloak.Config;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.ImportProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class DirImportProviderFactory implements ImportProviderFactory {
+
+    @Override
+    public ImportProvider create(KeycloakSession session) {
+        String dir = ExportImportConfig.getDir();
+        return dir!=null ? new DirImportProvider(new File(dir)) : new DirImportProvider();
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return DirExportProviderFactory.PROVIDER_ID;
+    }
+}

diff --git a/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory b/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
new file mode 100644
index 0000000..8a8fea4
--- /dev/null
+++ b/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.dir.DirExportProviderFactory
\ No newline at end of file

diff --git a/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory b/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
new file mode 100644
index 0000000..ba9874e
--- /dev/null
+++ b/export-import/export-import-dir/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.dir.DirImportProviderFactory
\ No newline at end of file

diff --git a/export-import/export-import-single-file/pom.xml b/export-import/export-import-single-file/pom.xml
new file mode 100644
index 0000000..25d65c0
--- /dev/null
+++ b/export-import/export-import-single-file/pom.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-export-import-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-export-import-single-file</artifactId>
+    <name>Keycloak Export Import To Single File</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

diff --git a/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java
new file mode 100755
index 0000000..a27f086
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProvider.java
@@ -0,0 +1,85 @@
+package org.keycloak.exportimport.singlefile;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.codehaus.jackson.map.ObjectMapper;
+import org.jboss.logging.Logger;
+import org.keycloak.exportimport.ExportProvider;
+import org.keycloak.exportimport.util.ExportImportJob;
+import org.keycloak.exportimport.util.ExportImportUtils;
+import org.keycloak.exportimport.util.ExportUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class SingleFileExportProvider implements ExportProvider {
+
+    private static final Logger logger = Logger.getLogger(SingleFileExportProvider.class);
+
+    private File file;
+
+    public SingleFileExportProvider(File file) {
+        this.file = file;
+    }
+
+    public void setFile(File file) {
+        this.file = file;
+    }
+
+    @Override
+    public void exportModel(KeycloakSessionFactory factory) throws IOException {
+        logger.infof("Exporting model into file %s", this.file.getAbsolutePath());
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) throws IOException {
+                List<RealmModel> realms = session.realms().getRealms();
+                List<RealmRepresentation> reps = new ArrayList<RealmRepresentation>();
+                for (RealmModel realm : realms) {
+                    reps.add(ExportUtils.exportRealm(session, realm, true));
+                }
+
+                writeToFile(reps);
+            }
+
+        });
+
+    }
+
+    @Override
+    public void exportRealm(KeycloakSessionFactory factory, final String realmName) throws IOException {
+        logger.infof("Exporting realm '%s' into file %s", realmName, this.file.getAbsolutePath());
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) throws IOException {
+                RealmModel realm = session.realms().getRealmByName(realmName);
+                RealmRepresentation realmRep = ExportUtils.exportRealm(session, realm, true);
+                writeToFile(realmRep);
+            }
+
+        });
+    }
+
+    @Override
+    public void close() {
+    }
+
+    private ObjectMapper getObjectMapper() {
+        return JsonSerialization.prettyMapper;
+    }
+
+    private void writeToFile(Object reps) throws IOException {
+        FileOutputStream stream = new FileOutputStream(this.file);
+        getObjectMapper().writeValue(stream, reps);
+    }
+}

diff --git a/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProviderFactory.java b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProviderFactory.java
new file mode 100644
index 0000000..614c3ba
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileExportProviderFactory.java
@@ -0,0 +1,36 @@
+package org.keycloak.exportimport.singlefile;
+
+import java.io.File;
+
+import org.keycloak.Config;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ExportProvider;
+import org.keycloak.exportimport.ExportProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class SingleFileExportProviderFactory implements ExportProviderFactory {
+
+    public static final String PROVIDER_ID = "singleFile";
+
+    @Override
+    public ExportProvider create(KeycloakSession session) {
+        String fileName = ExportImportConfig.getFile();
+        return new SingleFileExportProvider(new File(fileName));
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}

diff --git a/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java
new file mode 100644
index 0000000..07e8cb2
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProvider.java
@@ -0,0 +1,59 @@
+package org.keycloak.exportimport.singlefile;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.jboss.logging.Logger;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.exportimport.util.ExportImportJob;
+import org.keycloak.exportimport.util.ExportImportUtils;
+import org.keycloak.exportimport.util.ExportUtils;
+import org.keycloak.exportimport.util.ImportUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.RealmModel;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class SingleFileImportProvider implements ImportProvider {
+
+    private static final Logger logger = Logger.getLogger(SingleFileImportProvider.class);
+
+    private File file;
+
+    public SingleFileImportProvider(File file) {
+        this.file = file;
+    }
+
+    @Override
+    public void importModel(KeycloakSessionFactory factory, final Strategy strategy) throws IOException {
+        logger.infof("Full importing from file %s", this.file.getAbsolutePath());
+        ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+            @Override
+            public void run(KeycloakSession session) throws IOException {
+                FileInputStream is = new FileInputStream(file);
+                ImportUtils.importFromStream(session, JsonSerialization.mapper, is, strategy);
+            }
+
+        });
+    }
+
+    @Override
+    public void importRealm(KeycloakSessionFactory factory, String realmName, Strategy strategy) throws IOException {
+        // TODO: import just that single realm in case that file contains many realms?
+        importModel(factory, strategy);
+    }
+
+    @Override
+    public void close() {
+
+    }
+}

diff --git a/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java
new file mode 100644
index 0000000..6e3e732
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/java/org/keycloak/exportimport/singlefile/SingleFileImportProviderFactory.java
@@ -0,0 +1,34 @@
+package org.keycloak.exportimport.singlefile;
+
+import java.io.File;
+
+import org.keycloak.Config;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.ImportProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class SingleFileImportProviderFactory implements ImportProviderFactory {
+
+    @Override
+    public ImportProvider create(KeycloakSession session) {
+        String fileName = ExportImportConfig.getFile();
+        return new SingleFileImportProvider(new File(fileName));
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return SingleFileExportProviderFactory.PROVIDER_ID;
+    }
+}

diff --git a/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory b/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
new file mode 100644
index 0000000..82a1faf
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.singlefile.SingleFileExportProviderFactory
\ No newline at end of file

diff --git a/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory b/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
new file mode 100644
index 0000000..d2192b6
--- /dev/null
+++ b/export-import/export-import-single-file/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.singlefile.SingleFileImportProviderFactory
\ No newline at end of file

diff --git a/export-import/export-import-zip/pom.xml b/export-import/export-import-zip/pom.xml
new file mode 100644
index 0000000..7738f85
--- /dev/null
+++ b/export-import/export-import-zip/pom.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-export-import-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-export-import-zip</artifactId>
+    <name>Keycloak Export Import To Encrypted ZIP</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-export-import-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-core-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.codehaus.jackson</groupId>
+            <artifactId>jackson-mapper-asl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>de.idyl</groupId>
+            <artifactId>winzipaes</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

diff --git a/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipExportProviderFactory.java b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipExportProviderFactory.java
new file mode 100644
index 0000000..03f0147
--- /dev/null
+++ b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipExportProviderFactory.java
@@ -0,0 +1,44 @@
+package org.keycloak.exportimport.zip;
+
+import java.io.File;
+
+import org.keycloak.Config;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ExportProvider;
+import org.keycloak.exportimport.ExportProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ZipExportProviderFactory implements ExportProviderFactory {
+
+
+    public static final String PROVIDER_ID = "zip";
+
+    @Override
+    public ExportProvider create(KeycloakSession session) {
+        String fileName = ExportImportConfig.getZipFile();
+        String password = ExportImportConfig.getZipPassword();
+        if (fileName == null) {
+            throw new IllegalArgumentException("ZIP file for export not provided");
+        }
+        if (password == null) {
+            throw new IllegalArgumentException("Password for encrypting ZIP not provided");
+        }
+        return new ZipExportProvider(new File(fileName), password);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+}

diff --git a/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProvider.java b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProvider.java
new file mode 100644
index 0000000..6970e87
--- /dev/null
+++ b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProvider.java
@@ -0,0 +1,124 @@
+package org.keycloak.exportimport.zip;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.zip.DataFormatException;
+
+import de.idyl.winzipaes.AesZipFileDecrypter;
+import de.idyl.winzipaes.impl.AESDecrypter;
+import de.idyl.winzipaes.impl.AESDecrypterBC;
+import de.idyl.winzipaes.impl.ExtZipEntry;
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.Strategy;
+import org.keycloak.exportimport.util.ExportImportJob;
+import org.keycloak.exportimport.util.ExportImportUtils;
+import org.keycloak.exportimport.util.ImportUtils;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.util.JsonSerialization;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ZipImportProvider implements ImportProvider {
+
+    private static final Logger logger = Logger.getLogger(ZipImportProvider.class);
+
+    private final AesZipFileDecrypter decrypter;
+    private final String password;
+
+    public ZipImportProvider(File zipFile, String password) {
+        try {
+            if (!zipFile.exists()) {
+                throw new IllegalStateException("File " + zipFile.getAbsolutePath() + " doesn't exists");
+            }
+
+            AESDecrypter decrypter = new AESDecrypterBC();
+            this.decrypter = new AesZipFileDecrypter(zipFile, decrypter);
+            this.password = password;
+        } catch (IOException ioe) {
+            throw new RuntimeException(ioe);
+        }
+        logger.infof("Importing from ZIP file %s", zipFile.getAbsolutePath());
+    }
+
+    @Override
+    public void importModel(KeycloakSessionFactory factory, Strategy strategy) throws IOException {
+        List<String> realmNames = new ArrayList<String>();
+        for (ExtZipEntry entry : this.decrypter.getEntryList()) {
+            String entryName = entry.getName();
+            if (entryName.endsWith("-realm.json")) {
+                // Parse "foo" from "foo-realm.json"
+                String realmName = entryName.substring(0, entryName.length() - 11);
+
+                // Ensure that master realm is imported first
+                if (Config.getAdminRealm().equals(realmName)) {
+                    realmNames.add(0, realmName);
+                } else {
+                    realmNames.add(realmName);
+                }
+            }
+        }
+
+        for (String realmName : realmNames) {
+            importRealm(factory, realmName, strategy);
+        }
+    }
+
+    @Override
+    public void importRealm(KeycloakSessionFactory factory, final String realmName, final Strategy strategy) throws IOException {
+        try {
+            // Import realm first
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            this.decrypter.extractEntry(this.decrypter.getEntry(realmName + "-realm.json"), bos, this.password);
+            ByteArrayInputStream bis = new ByteArrayInputStream(bos.toByteArray());
+            final RealmRepresentation realmRep = JsonSerialization.mapper.readValue(bis, RealmRepresentation.class);
+
+            ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+                @Override
+                public void run(KeycloakSession session) throws IOException {
+                    ImportUtils.importRealm(session, realmRep, strategy);
+                }
+
+            });
+
+
+            // Import users
+            for (ExtZipEntry entry : this.decrypter.getEntryList()) {
+                String name = entry.getName();
+                if ( (name.startsWith(realmName)) && (name.endsWith(".json")) && (name.substring(realmName.length()).contains("-users-")) ) {
+                    bos = new ByteArrayOutputStream();
+                    this.decrypter.extractEntry(entry, bos, this.password);
+                    final ByteArrayInputStream bis2 = new ByteArrayInputStream(bos.toByteArray());
+
+                    ExportImportUtils.runJobInTransaction(factory, new ExportImportJob() {
+
+                        @Override
+                        public void run(KeycloakSession session) throws IOException {
+                            ImportUtils.importUsersFromStream(session, realmName, JsonSerialization.mapper, bis2);
+                        }
+                    });
+                }
+            }
+        } catch (DataFormatException dfe) {
+            throw new RuntimeException(dfe);
+        }
+    }
+
+    @Override
+    public void close() {
+        try {
+            this.decrypter.close();
+        } catch (IOException ioe) {
+            throw new RuntimeException(ioe);
+        }
+    }
+}

diff --git a/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProviderFactory.java b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProviderFactory.java
new file mode 100644
index 0000000..9127a8b
--- /dev/null
+++ b/export-import/export-import-zip/src/main/java/org/keycloak/exportimport/zip/ZipImportProviderFactory.java
@@ -0,0 +1,41 @@
+package org.keycloak.exportimport.zip;
+
+import java.io.File;
+
+import org.keycloak.Config;
+import org.keycloak.exportimport.ExportImportConfig;
+import org.keycloak.exportimport.ImportProvider;
+import org.keycloak.exportimport.ImportProviderFactory;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ZipImportProviderFactory implements ImportProviderFactory {
+
+    @Override
+    public ImportProvider create(KeycloakSession session) {
+        String fileName = ExportImportConfig.getZipFile();
+        String password = ExportImportConfig.getZipPassword();
+        if (fileName == null) {
+            throw new IllegalArgumentException("ZIP file for import not provided");
+        }
+        if (password == null) {
+            throw new IllegalArgumentException("Password for decrypting ZIP not provided");
+        }
+        return new ZipImportProvider(new File(fileName), password);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return ZipExportProviderFactory.PROVIDER_ID;
+    }
+}

diff --git a/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory b/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
new file mode 100644
index 0000000..dce02f1
--- /dev/null
+++ b/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ExportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.zip.ZipExportProviderFactory
\ No newline at end of file

diff --git a/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory b/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
new file mode 100644
index 0000000..b88f372
--- /dev/null
+++ b/export-import/export-import-zip/src/main/resources/META-INF/services/org.keycloak.exportimport.ImportProviderFactory
@@ -0,0 +1 @@
+org.keycloak.exportimport.zip.ZipImportProviderFactory
\ No newline at end of file

diff --git a/export-import/pom.xml b/export-import/pom.xml
index b9a5a4d..72468fa 100755
--- a/export-import/pom.xml
+++ b/export-import/pom.xml
@@ -16,7 +16,9 @@
 
     <modules>
         <module>export-import-api</module>
-        <module>export-import-impl</module>
+        <module>export-import-dir</module>
+        <module>export-import-single-file</module>
+        <module>export-import-zip</module>
     </modules>
 
 </project>

diff --git a/federation/ldap/pom.xml b/federation/ldap/pom.xml
new file mode 100755
index 0000000..0ce4c2e
--- /dev/null
+++ b/federation/ldap/pom.xml
@@ -0,0 +1,88 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-ldap-federation</artifactId>
+    <name>Keycloak LDAP Federation</name>
+    <description />
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.resteasy</groupId>
+            <artifactId>resteasy-jaxrs</artifactId>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-simple</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-common</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-impl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-simple-schema</artifactId>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>${maven.compiler.source}</source>
+                    <target>${maven.compiler.target}</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/KeycloakLDAPIdentityStore.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/KeycloakLDAPIdentityStore.java
new file mode 100755
index 0000000..1ff6c11
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/KeycloakLDAPIdentityStore.java
@@ -0,0 +1,89 @@
+package org.keycloak.federation.ldap;
+
+import org.keycloak.models.utils.reflection.Reflections;
+import org.picketlink.idm.config.LDAPMappingConfiguration;
+import org.picketlink.idm.ldap.internal.LDAPIdentityStore;
+import org.picketlink.idm.ldap.internal.LDAPOperationManager;
+import org.picketlink.idm.model.AttributedType;
+import org.picketlink.idm.model.basic.User;
+import org.picketlink.idm.query.IdentityQuery;
+import org.picketlink.idm.spi.IdentityContext;
+
+import javax.naming.directory.BasicAttributes;
+import java.lang.reflect.Method;
+
+import static org.picketlink.common.constants.LDAPConstants.*;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KeycloakLDAPIdentityStore extends LDAPIdentityStore {
+
+    public static Method GET_OPERATION_MANAGER_METHOD;
+    public static Method CREATE_SEARCH_FILTER_METHOD;
+    public static Method EXTRACT_ATTRIBUTES_METHOD;
+    public static Method GET_ENTRY_IDENTIFIER_METHOD;
+
+    public static final String SAM_ACCOUNT_NAME = "sAMAccountName";
+
+    static {
+        GET_OPERATION_MANAGER_METHOD = getMethodOnLDAPStore("getOperationManager");
+        CREATE_SEARCH_FILTER_METHOD = getMethodOnLDAPStore("createIdentityTypeSearchFilter", IdentityQuery.class, LDAPMappingConfiguration.class);
+        EXTRACT_ATTRIBUTES_METHOD = getMethodOnLDAPStore("extractAttributes", AttributedType.class, boolean.class);
+        GET_ENTRY_IDENTIFIER_METHOD = getMethodOnLDAPStore("getEntryIdentifier", AttributedType.class);
+    }
+
+    @Override
+    public void addAttributedType(IdentityContext context, AttributedType attributedType) {
+        LDAPMappingConfiguration userMappingConfig = getConfig().getMappingConfig(attributedType.getClass());
+        String ldapUsernameAttrName = userMappingConfig.getMappedProperties().get(userMappingConfig.getIdProperty().getName());
+
+        if (getConfig().isActiveDirectory() && SAM_ACCOUNT_NAME.equals(ldapUsernameAttrName)) {
+            // TODO: pain, but everything in picketlink is private... Improve if possible...
+            LDAPOperationManager operationManager = Reflections.invokeMethod(false, GET_OPERATION_MANAGER_METHOD, LDAPOperationManager.class, this);
+
+            String cn = getCommonName(attributedType);
+            String bindingDN = CN + EQUAL + cn + COMMA + userMappingConfig.getBaseDN();
+
+            BasicAttributes ldapAttributes = Reflections.invokeMethod(false, EXTRACT_ATTRIBUTES_METHOD, BasicAttributes.class, this, attributedType, true);
+            ldapAttributes.put(CN, cn);
+
+            operationManager.createSubContext(bindingDN, ldapAttributes);
+
+            String ldapId = Reflections.invokeMethod(false, GET_ENTRY_IDENTIFIER_METHOD, String.class, this, attributedType);
+            attributedType.setId(ldapId);
+        } else {
+            super.addAttributedType(context, attributedType);
+        }
+    }
+
+    // Hack as methods are protected on LDAPIdentityStore :/
+    public static Method getMethodOnLDAPStore(String methodName, Class... classes) {
+        try {
+            Method m = LDAPIdentityStore.class.getDeclaredMethod(methodName, classes);
+            m.setAccessible(true);
+            return m;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    protected String getCommonName(AttributedType aType) {
+        User user = (User)aType;
+        String fullName;
+        if (user.getFirstName() != null && user.getLastName() != null) {
+            fullName = user.getFirstName() + " " + user.getLastName();
+        } else if (user.getFirstName() != null && user.getFirstName().trim().length() > 0) {
+            fullName = user.getFirstName();
+        } else {
+            fullName = user.getLastName();
+        }
+
+        // Fallback to loginName
+        if (fullName == null || fullName.trim().length() == 0) {
+            fullName = user.getLoginName();
+        }
+
+        return fullName;
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
new file mode 100755
index 0000000..c42f74c
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
@@ -0,0 +1,296 @@
+package org.keycloak.federation.ldap;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.picketlink.idm.IdentityManagementException;
+import org.picketlink.idm.IdentityManager;
+import org.picketlink.idm.PartitionManager;
+import org.picketlink.idm.credential.Credentials;
+import org.picketlink.idm.credential.Password;
+import org.picketlink.idm.credential.UsernamePasswordCredentials;
+import org.picketlink.idm.model.basic.BasicModel;
+import org.picketlink.idm.model.basic.User;
+import org.picketlink.idm.query.IdentityQuery;
+
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class LDAPFederationProvider implements UserFederationProvider {
+    private static final Logger logger = Logger.getLogger(LDAPFederationProvider.class);
+    public static final String LDAP_ID = "LDAP_ID";
+
+    protected KeycloakSession session;
+    protected UserFederationProviderModel model;
+    protected PartitionManager partitionManager;
+
+    protected static final Set<String> supportedCredentialTypes = new HashSet<String>();
+
+    static
+    {
+        supportedCredentialTypes.add(UserCredentialModel.PASSWORD);
+    }
+
+    public LDAPFederationProvider(KeycloakSession session, UserFederationProviderModel model, PartitionManager partitionManager) {
+        this.session = session;
+        this.model = model;
+        this.partitionManager = partitionManager;
+    }
+
+    private ModelException convertIDMException(IdentityManagementException ie) {
+        Throwable realCause = ie;
+        while (realCause.getCause() != null) {
+            realCause = realCause.getCause();
+        }
+
+        // Use the message from the realCause
+        return new ModelException(realCause.getMessage(), ie);
+    }
+
+    public KeycloakSession getSession() {
+        return session;
+    }
+
+    public UserFederationProviderModel getModel() {
+        return model;
+    }
+
+    public PartitionManager getPartitionManager() {
+        return partitionManager;
+    }
+
+    @Override
+    public UserModel proxy(UserModel local) {
+        // todo
+        return new LDAPUserModelDelegate(local, this);
+    }
+
+    @Override
+    public Set<String> getSupportedCredentialTypes() {
+        return supportedCredentialTypes;
+    }
+
+    @Override
+    public boolean isRegistrationSupported() {
+        return true;
+    }
+
+    @Override
+    public UserModel register(RealmModel realm, UserModel user) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            User picketlinkUser = new User(user.getUsername());
+            picketlinkUser.setFirstName(user.getFirstName());
+            picketlinkUser.setLastName(user.getLastName());
+            picketlinkUser.setEmail(user.getEmail());
+            identityManager.add(picketlinkUser);
+            return proxy(user);
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+
+    }
+
+    @Override
+    public boolean removeUser(RealmModel realm, UserModel user) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, user.getUsername());
+            if (picketlinkUser == null) {
+                return false;
+            }
+            identityManager.remove(picketlinkUser);
+            return true;
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public List<UserModel> searchByAttributes(Map<String, String> attributes, RealmModel realm) {
+        IdentityManager identityManager = getIdentityManager();
+        List<UserModel> searchResults =new LinkedList<UserModel>();
+        try {
+            Map<String, User> results = new HashMap<String, User>();
+            if (attributes.containsKey(USERNAME)) {
+                User user = BasicModel.getUser(identityManager, attributes.get(USERNAME));
+                if (user != null) results.put(user.getLoginName(), user);
+            } else if (attributes.containsKey(EMAIL)) {
+                User user = queryByEmail(identityManager, attributes.get(EMAIL));
+                if (user != null) results.put(user.getLoginName(), user);
+            } else if (attributes.containsKey(FIRST_NAME) || attributes.containsKey(LAST_NAME)) {
+                IdentityQuery<User> query = identityManager.createIdentityQuery(User.class);
+                if (attributes.containsKey(FIRST_NAME)) {
+                    query.setParameter(User.FIRST_NAME, attributes.get(FIRST_NAME));
+                }
+                if (attributes.containsKey(LAST_NAME)) {
+                    query.setParameter(User.LAST_NAME, attributes.get(LAST_NAME));
+                }
+                List<User> agents = query.getResultList();
+                for (User user : agents) {
+                    results.put(user.getLoginName(), user);
+                }
+            }
+            for (User user : results.values()) {
+                if (session.userStorage().getUserByUsername(user.getLoginName(), realm) == null) {
+                    UserModel imported = importUserFromPicketlink(realm, user);
+                    searchResults.add(imported);
+                }
+            }
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+        return searchResults;
+    }
+
+    @Override
+    public boolean isValid(UserModel local) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, local.getUsername());
+            if (picketlinkUser == null) {
+                return false;
+            }
+            return picketlinkUser.getId().equals(local.getAttribute(LDAP_ID));
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public UserModel getUserByUsername(RealmModel realm, String username) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, username);
+            if (picketlinkUser == null) {
+                return null;
+            }
+
+            return importUserFromPicketlink(realm, picketlinkUser);
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    public IdentityManager getIdentityManager() {
+        return partitionManager.createIdentityManager();
+    }
+
+    protected UserModel importUserFromPicketlink(RealmModel realm, User picketlinkUser) {
+        String email = (picketlinkUser.getEmail() != null && picketlinkUser.getEmail().trim().length() > 0) ? picketlinkUser.getEmail() : null;
+        UserModel imported = session.userStorage().addUser(realm, picketlinkUser.getLoginName());
+        imported.setEnabled(true);
+        imported.setEmail(email);
+        imported.setFirstName(picketlinkUser.getFirstName());
+        imported.setLastName(picketlinkUser.getLastName());
+        imported.setFederationLink(model.getId());
+        imported.setAttribute(LDAP_ID, picketlinkUser.getId());
+        return proxy(imported);
+    }
+
+    protected User queryByEmail(IdentityManager identityManager, String email) throws IdentityManagementException {
+        List<User> agents = identityManager.createIdentityQuery(User.class)
+                .setParameter(User.EMAIL, email).getResultList();
+
+        if (agents.isEmpty()) {
+            return null;
+        } else if (agents.size() == 1) {
+            return agents.get(0);
+        } else {
+            throw new IdentityManagementException("Error - multiple Agent objects found with same login name");
+        }
+    }
+
+
+    @Override
+    public UserModel getUserByEmail(RealmModel realm, String email) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            User picketlinkUser = queryByEmail(identityManager, email);
+            if (picketlinkUser == null) {
+                return null;
+            }
+            return importUserFromPicketlink(realm, picketlinkUser);
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+    @Override
+    public void preRemove(RealmModel realm) {
+        // complete Don't think we have to do anything
+    }
+
+    @Override
+    public void preRemove(RealmModel realm, RoleModel role) {
+        // complete I don't think we have to do anything here
+    }
+
+    public boolean validPassword(String username, String password) {
+        IdentityManager identityManager = getIdentityManager();
+
+        try {
+            UsernamePasswordCredentials credential = new UsernamePasswordCredentials();
+            credential.setUsername(username);
+            credential.setPassword(new Password(password.toCharArray()));
+            identityManager.validateCredentials(credential);
+            if (credential.getStatus() == Credentials.Status.VALID) {
+                return true;
+            } else {
+                return false;
+            }
+        } catch (IdentityManagementException ie) {
+            throw convertIDMException(ie);
+        }
+    }
+
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
+        for (UserCredentialModel cred : input) {
+            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                return validPassword(user.getUsername(), cred.getValue());
+            } else {
+                return false; // invalid cred type
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
+        for (UserCredentialModel cred : input) {
+            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                return validPassword(user.getUsername(), cred.getValue());
+            } else {
+                return false; // invalid cred type
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public void close() {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java
new file mode 100755
index 0000000..b656d7a
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java
@@ -0,0 +1,43 @@
+package org.keycloak.federation.ldap;
+
+import org.keycloak.Config;
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderFactory;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.picketlink.idm.PartitionManager;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class LDAPFederationProviderFactory implements UserFederationProviderFactory {
+    public static final String PROVIDER_NAME = "ldap";
+    PartitionManagerRegistry registry;
+
+    @Override
+    public UserFederationProvider create(KeycloakSession session) {
+        throw new IllegalAccessError("Illegal to call this method");
+    }
+
+    @Override
+    public UserFederationProvider getInstance(KeycloakSession session, UserFederationProviderModel model) {
+        PartitionManager partition = registry.getPartitionManager(model);
+        return new LDAPFederationProvider(session, model, partition);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        registry = new PartitionManagerRegistry();
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_NAME;
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPKeycloakCredentialHandler.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPKeycloakCredentialHandler.java
new file mode 100755
index 0000000..7078d87
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPKeycloakCredentialHandler.java
@@ -0,0 +1,168 @@
+package org.keycloak.federation.ldap;
+
+import org.keycloak.models.utils.reflection.Reflections;
+import org.picketlink.idm.IdentityManager;
+import org.picketlink.idm.config.LDAPMappingConfiguration;
+import org.picketlink.idm.credential.Credentials;
+import org.picketlink.idm.credential.Password;
+import org.picketlink.idm.credential.UsernamePasswordCredentials;
+import org.picketlink.idm.ldap.internal.LDAPIdentityStore;
+import org.picketlink.idm.ldap.internal.LDAPOperationManager;
+import org.picketlink.idm.ldap.internal.LDAPPlainTextPasswordCredentialHandler;
+import org.picketlink.idm.model.Account;
+import org.picketlink.idm.model.basic.User;
+import org.picketlink.idm.query.IdentityQuery;
+import org.picketlink.idm.spi.IdentityContext;
+
+import javax.naming.NamingException;
+import javax.naming.directory.BasicAttribute;
+import javax.naming.directory.DirContext;
+import javax.naming.directory.ModificationItem;
+import javax.naming.directory.SearchResult;
+import java.io.UnsupportedEncodingException;
+import java.util.Date;
+import java.util.List;
+
+import static org.picketlink.idm.IDMLog.CREDENTIAL_LOGGER;
+import static org.picketlink.idm.model.basic.BasicModel.getUser;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class LDAPKeycloakCredentialHandler extends LDAPPlainTextPasswordCredentialHandler {
+
+    // Used just in ActiveDirectory to put account into "enabled" state (aka userAccountControl=512, see http://support.microsoft.com/kb/305144/en ) after password update. If value is -1, it's ignored
+    private String userAccountControlAfterPasswordUpdate;
+
+    @Override
+    public void setup(LDAPIdentityStore store) {
+        // TODO: Don't setup it here once PLINK-508 is fixed
+        if (store.getConfig().isActiveDirectory() || Boolean.getBoolean("keycloak.ldap.ad.skipUserAccountControlAfterPasswordUpdate")) {
+            String userAccountControlProp = System.getProperty("keycloak.ldap.ad.userAccountControlAfterPasswordUpdate");
+            this.userAccountControlAfterPasswordUpdate = userAccountControlProp!=null ? userAccountControlProp : "512";
+            CREDENTIAL_LOGGER.info("Will use userAccountControl=" + userAccountControlAfterPasswordUpdate + " after password update of user in Active Directory");
+        }
+    }
+
+    // Overridden as in Keycloak, we don't have Agents
+    @Override
+    protected User getAccount(IdentityContext context, String loginName) {
+        IdentityManager identityManager = getIdentityManager(context);
+
+        if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+            CREDENTIAL_LOGGER.debugf("Trying to find account [%s] using default account type [%s]", loginName, User.class);
+        }
+
+        return getUser(identityManager, loginName);
+    }
+
+    @Override
+    public void update(IdentityContext context, Account account, Password password, LDAPIdentityStore store, Date effectiveDate, Date expiryDate) {
+        if (!store.getConfig().isActiveDirectory()) {
+            super.update(context, account, password, store, effectiveDate, expiryDate);
+        } else {
+            User user = (User)account;
+            LDAPOperationManager operationManager = Reflections.invokeMethod(false, KeycloakLDAPIdentityStore.GET_OPERATION_MANAGER_METHOD, LDAPOperationManager.class, store);
+            IdentityManager identityManager = getIdentityManager(context);
+            String userDN = getDNOfUser(user, identityManager, store, operationManager);
+
+            updateADPassword(userDN, new String(password.getValue()), operationManager);
+
+            if (userAccountControlAfterPasswordUpdate != null) {
+                ModificationItem[] mods = new ModificationItem[1];
+                BasicAttribute mod0 = new BasicAttribute("userAccountControl", userAccountControlAfterPasswordUpdate);
+                mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod0);
+                operationManager.modifyAttribute(userDN, mod0);
+            }
+        }
+    }
+
+    protected void updateADPassword(String userDN, String password, LDAPOperationManager operationManager) {
+        try {
+            // Replace the "unicdodePwd" attribute with a new value
+            // Password must be both Unicode and a quoted string
+            String newQuotedPassword = "\"" + password + "\"";
+            byte[] newUnicodePassword = newQuotedPassword.getBytes("UTF-16LE");
+            BasicAttribute unicodePwd = new BasicAttribute("unicodePwd", newUnicodePassword);
+            operationManager.modifyAttribute(userDN, unicodePwd);
+        } catch (UnsupportedEncodingException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Override
+    public void validate(IdentityContext context, UsernamePasswordCredentials credentials,
+                         LDAPIdentityStore store) {
+        credentials.setStatus(Credentials.Status.INVALID);
+        credentials.setValidatedAccount(null);
+
+        if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+            CREDENTIAL_LOGGER.debugf("Validating credentials [%s][%s] using identity store [%s] and credential handler [%s].", credentials.getClass(), credentials, store, this);
+        }
+
+        User account = getAccount(context, credentials.getUsername());
+
+        // If the user for the provided username cannot be found we fail validation
+        if (account != null) {
+            if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+                CREDENTIAL_LOGGER.debugf("Found account [%s] from credentials [%s].", account, credentials);
+            }
+
+            if (account.isEnabled()) {
+                if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+                    CREDENTIAL_LOGGER.debugf("Account [%s] is ENABLED.", account, credentials);
+                }
+
+                char[] password = credentials.getPassword().getValue();
+
+                // String bindingDN = store.getBindingDN(account);
+
+                LDAPOperationManager operationManager = Reflections.invokeMethod(false, KeycloakLDAPIdentityStore.GET_OPERATION_MANAGER_METHOD, LDAPOperationManager.class, store);
+                String bindingDN = getDNOfUser(account, getIdentityManager(context), store, operationManager);
+
+                if (operationManager.authenticate(bindingDN, new String(password))) {
+                    credentials.setValidatedAccount(account);
+                    credentials.setStatus(Credentials.Status.VALID);
+                }
+            } else {
+                if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+                    CREDENTIAL_LOGGER.debugf("Account [%s] is DISABLED.", account, credentials);
+                }
+                credentials.setStatus(Credentials.Status.ACCOUNT_DISABLED);
+            }
+        } else {
+            if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+                CREDENTIAL_LOGGER.debugf("Account NOT FOUND for credentials [%s][%s].", credentials.getClass(), credentials);
+            }
+        }
+
+        if (CREDENTIAL_LOGGER.isDebugEnabled()) {
+            CREDENTIAL_LOGGER.debugf("Credential [%s][%s] validated using identity store [%s] and credential handler [%s]. Status [%s]. Validated Account [%s]",
+                    credentials.getClass(), credentials, store, this, credentials.getStatus(), credentials.getValidatedAccount());
+        }
+    }
+
+    // TODO: remove later... It's needed just because LDAPIdentityStore.getBindingDN, which always uses idProperty as first part of DN, but in AD it doesn't work as we may have idProperty 'sAMAccountName'
+    // but DN like: cn=John Doe,OU=foo,DC=bar
+    protected String getDNOfUser(User user, IdentityManager identityManager, LDAPIdentityStore ldapStore, LDAPOperationManager operationManager) {
+
+        LDAPMappingConfiguration ldapEntryConfig = ldapStore.getConfig().getMappingConfig(User.class);
+        IdentityQuery<User> identityQuery = identityManager.createIdentityQuery(User.class)
+                .setParameter(User.LOGIN_NAME, user.getLoginName());
+        StringBuilder filter = Reflections.invokeMethod(false, KeycloakLDAPIdentityStore.CREATE_SEARCH_FILTER_METHOD, StringBuilder.class, ldapStore, identityQuery, ldapEntryConfig);
+
+        List<SearchResult> search = null;
+        try {
+            search = operationManager.search(ldapEntryConfig.getBaseDN(), filter.toString(), ldapEntryConfig);
+        } catch (NamingException ne) {
+            throw new RuntimeException(ne);
+        }
+
+        if (search.size() > 0) {
+            SearchResult sr1 = search.get(0);
+            return sr1.getNameInNamespace();
+        } else {
+            return null;
+        }
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPUserModelDelegate.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPUserModelDelegate.java
new file mode 100755
index 0000000..2a7fad5
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPUserModelDelegate.java
@@ -0,0 +1,269 @@
+package org.keycloak.federation.ldap;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.ModelException;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+import org.picketlink.idm.IdentityManagementException;
+import org.picketlink.idm.IdentityManager;
+import org.picketlink.idm.credential.Password;
+import org.picketlink.idm.credential.TOTPCredential;
+import org.picketlink.idm.model.basic.BasicModel;
+import org.picketlink.idm.model.basic.User;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class LDAPUserModelDelegate implements UserModel {
+    private static final Logger logger = Logger.getLogger(LDAPUserModelDelegate.class);
+
+    protected UserModel delegate;
+    protected LDAPFederationProvider provider;
+
+    public LDAPUserModelDelegate(UserModel delegate, LDAPFederationProvider provider) {
+        this.delegate = delegate;
+        this.provider = provider;
+    }
+
+    @Override
+    public String getId() {
+        return delegate.getId();
+    }
+
+    @Override
+    public void setAttribute(String name, String value) {
+        delegate.setAttribute(name, value);
+    }
+
+    @Override
+    public boolean isEmailVerified() {
+        return delegate.isEmailVerified();
+    }
+
+    @Override
+    public void removeAttribute(String name) {
+        delegate.removeAttribute(name);
+    }
+
+    @Override
+    public String getLastName() {
+        return delegate.getLastName();
+    }
+
+    @Override
+    public void setFederationLink(String link) {
+        delegate.setFederationLink(link);
+    }
+
+    @Override
+    public AuthenticationLinkModel getAuthenticationLink() {
+        return delegate.getAuthenticationLink();
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+        return delegate.getAttributes();
+    }
+
+    @Override
+    public boolean hasRole(RoleModel role) {
+        return delegate.hasRole(role);
+    }
+
+    @Override
+    public void grantRole(RoleModel role) {
+        delegate.grantRole(role);
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        delegate.setEnabled(enabled);
+    }
+
+    @Override
+    public void removeRequiredAction(UserModel.RequiredAction action) {
+        delegate.removeRequiredAction(action);
+    }
+
+    @Override
+    public void deleteRoleMapping(RoleModel role) {
+        delegate.deleteRoleMapping(role);
+    }
+
+    @Override
+    public void setUsername(String username) {
+        IdentityManager identityManager = provider.getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, delegate.getUsername());
+            if (picketlinkUser == null) {
+                throw new IllegalStateException("User not found in LDAP storage!");
+            }
+            picketlinkUser.setLoginName(username);
+            identityManager.update(picketlinkUser);
+        } catch (IdentityManagementException ie) {
+            throw new ModelException(ie);
+        }
+        delegate.setUsername(username);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return delegate.isEnabled();
+    }
+
+    @Override
+    public String getFirstName() {
+        return delegate.getFirstName();
+    }
+
+    @Override
+    public void setLastName(String lastName) {
+        IdentityManager identityManager = provider.getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, delegate.getUsername());
+            if (picketlinkUser == null) {
+                throw new IllegalStateException("User not found in LDAP storage!");
+            }
+            picketlinkUser.setLastName(lastName);
+            identityManager.update(picketlinkUser);
+        } catch (IdentityManagementException ie) {
+            throw new ModelException(ie);
+        }
+        delegate.setLastName(lastName);
+    }
+
+    @Override
+    public void setEmailVerified(boolean verified) {
+        delegate.setEmailVerified(verified);
+    }
+
+    @Override
+    public void updateCredential(UserCredentialModel cred) {
+        if (!provider.getSupportedCredentialTypes().contains(cred.getType())) {
+            delegate.updateCredential(cred);
+            return;
+        }
+        IdentityManager identityManager = provider.getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, getUsername());
+            if (picketlinkUser == null) {
+                logger.debugf("User '%s' doesn't exists. Skip password update", getUsername());
+                throw new IllegalStateException("User doesn't exist in LDAP storage");
+            }
+            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                identityManager.updateCredential(picketlinkUser, new Password(cred.getValue().toCharArray()));
+            } else if (cred.getType().equals(UserCredentialModel.TOTP)) {
+                TOTPCredential credential = new TOTPCredential(cred.getValue());
+                credential.setDevice(cred.getDevice());
+                identityManager.updateCredential(picketlinkUser, credential);
+            }
+        } catch (IdentityManagementException ie) {
+            throw new ModelException(ie);
+        }
+
+    }
+
+    @Override
+    public void setEmail(String email) {
+        IdentityManager identityManager = provider.getIdentityManager();
+
+        try {
+            User picketlinkUser = BasicModel.getUser(identityManager, delegate.getUsername());
+            if (picketlinkUser == null) {
+                throw new IllegalStateException("User not found in LDAP storage!");
+            }
+            picketlinkUser.setEmail(email);
+            identityManager.update(picketlinkUser);
+        } catch (IdentityManagementException ie) {
+            throw new ModelException(ie);
+        }
+        delegate.setEmail(email);
+    }
+
+    @Override
+    public void addRequiredAction(UserModel.RequiredAction action) {
+        delegate.addRequiredAction(action);
+    }
+
+    @Override
+    public List<UserCredentialValueModel> getCredentialsDirectly() {
+        return delegate.getCredentialsDirectly();
+    }
+
+    @Override
+    public boolean isTotp() {
+        return delegate.isTotp();
+    }
+
+    @Override
+    public void setFirstName(String firstName) {
+        delegate.setFirstName(firstName);
+    }
+
+    @Override
+    public Set<UserModel.RequiredAction> getRequiredActions() {
+        return delegate.getRequiredActions();
+    }
+
+    @Override
+    public String getEmail() {
+        return delegate.getEmail();
+    }
+
+    @Override
+    public void setTotp(boolean totp) {
+        delegate.setTotp(totp);
+    }
+
+    @Override
+    public void setAuthenticationLink(AuthenticationLinkModel authenticationLink) {
+        delegate.setAuthenticationLink(authenticationLink);
+    }
+
+    @Override
+    public String getUsername() {
+        return delegate.getUsername();
+    }
+
+    @Override
+    public String getFederationLink() {
+        return delegate.getFederationLink();
+    }
+
+    @Override
+    public Set<RoleModel> getRealmRoleMappings() {
+        return delegate.getRealmRoleMappings();
+    }
+
+    @Override
+    public Set<RoleModel> getRoleMappings() {
+        return delegate.getRoleMappings();
+    }
+
+    @Override
+    public Set<RoleModel> getApplicationRoleMappings(ApplicationModel app) {
+        return delegate.getApplicationRoleMappings(app);
+    }
+
+    @Override
+    public String getAttribute(String name) {
+        return delegate.getAttribute(name);
+    }
+
+    @Override
+    public void updateCredentialDirectly(UserCredentialValueModel cred) {
+        delegate.updateCredentialDirectly(cred);
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/PartitionManagerRegistry.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/PartitionManagerRegistry.java
new file mode 100755
index 0000000..5c83bda
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/PartitionManagerRegistry.java
@@ -0,0 +1,158 @@
+package org.keycloak.federation.ldap;
+
+import org.jboss.logging.Logger;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.LDAPConstants;
+import org.picketlink.idm.PartitionManager;
+import org.picketlink.idm.config.AbstractIdentityStoreConfiguration;
+import org.picketlink.idm.config.IdentityConfiguration;
+import org.picketlink.idm.config.IdentityConfigurationBuilder;
+import org.picketlink.idm.config.IdentityStoreConfiguration;
+import org.picketlink.idm.config.LDAPIdentityStoreConfiguration;
+import org.picketlink.idm.internal.DefaultPartitionManager;
+import org.picketlink.idm.model.basic.User;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.ConcurrentHashMap;
+
+import static org.picketlink.common.constants.LDAPConstants.*;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class PartitionManagerRegistry {
+
+    private static final Logger logger = Logger.getLogger(PartitionManagerRegistry.class);
+
+    private Map<String, PartitionManagerContext> partitionManagers = new ConcurrentHashMap<String, PartitionManagerContext>();
+
+    public PartitionManager getPartitionManager(UserFederationProviderModel model) {
+        PartitionManagerContext context = partitionManagers.get(model.getId());
+
+        // Ldap config might have changed for the realm. In this case, we must re-initialize
+        Map<String, String> config = model.getConfig();
+        if (context == null || !config.equals(context.config)) {
+            logger.infof("Creating new partition manager for the federation provider: %s, LDAP Connection URL: %s, LDAP Base DN: %s, LDAP Vendor: %s", model.getId(),
+                    config.get(LDAPConstants.CONNECTION_URL), config.get(LDAPConstants.BASE_DN), config.get(LDAPConstants.VENDOR));
+            PartitionManager manager = createPartitionManager(config);
+            context = new PartitionManagerContext(config, manager);
+            partitionManagers.put(model.getId(), context);
+        }
+        return context.partitionManager;
+    }
+
+    /**
+     * @param ldapConfig from realm
+     * @return PartitionManager instance based on LDAP store
+     */
+    protected PartitionManager createPartitionManager(Map<String,String> ldapConfig) {
+        IdentityConfigurationBuilder builder = new IdentityConfigurationBuilder();
+
+        Properties connectionProps = new Properties();
+        connectionProps.put("com.sun.jndi.ldap.connect.pool", "true");
+
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.authentication", "none simple");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.initsize", "1");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.maxsize", "10");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.prefsize", "5");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.timeout", "300000");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.protocol", "plain");
+        checkSystemProperty("com.sun.jndi.ldap.connect.pool.debug", "off");
+
+        String vendor = ldapConfig.get(LDAPConstants.VENDOR);
+
+        // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
+        if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
+            checkSystemProperty(LDAPIdentityStoreConfiguration.ENTRY_IDENTIFIER_ATTRIBUTE_NAME, "nsuniqueid");
+        }
+
+        boolean activeDirectory = vendor != null && vendor.equals(LDAPConstants.VENDOR_ACTIVE_DIRECTORY);
+
+        String ldapLoginNameMapping = ldapConfig.get(LDAPConstants.USERNAME_LDAP_ATTRIBUTE);
+        if (ldapLoginNameMapping == null) {
+            ldapLoginNameMapping = activeDirectory ? CN : UID;
+        }
+
+        // Try to compute properties based on LDAP server type, but still allow to override them through System properties TODO: Should allow better way than overriding from System properties. Perhaps init from XML?
+        ldapLoginNameMapping = getNameOfLDAPAttribute("keycloak.ldap.idm.loginName", ldapLoginNameMapping, ldapLoginNameMapping, activeDirectory);
+        String ldapFirstNameMapping = getNameOfLDAPAttribute("keycloak.ldap.idm.firstName", CN, "givenName", activeDirectory);
+        String ldapLastNameMapping = getNameOfLDAPAttribute("keycloak.ldap.idm.lastName", SN, SN, activeDirectory);
+        String ldapEmailMapping =  getNameOfLDAPAttribute("keycloak.ldap.idm.email", EMAIL, EMAIL, activeDirectory);
+
+        String[] userObjectClasses = getUserObjectClasses(ldapConfig);
+
+        logger.infof("LDAP Attributes mapping: loginName: %s, firstName: %s, lastName: %s, email: %s", ldapLoginNameMapping, ldapFirstNameMapping, ldapLastNameMapping, ldapEmailMapping);
+
+        // Use same mapping for User and Agent for now
+        builder
+            .named("SIMPLE_LDAP_STORE_CONFIG")
+                .stores()
+                    .ldap()
+                        .connectionProperties(connectionProps)
+                        .addCredentialHandler(LDAPKeycloakCredentialHandler.class)
+                        .baseDN(ldapConfig.get(LDAPConstants.BASE_DN))
+                        .bindDN(ldapConfig.get(LDAPConstants.BIND_DN))
+                        .bindCredential(ldapConfig.get(LDAPConstants.BIND_CREDENTIAL))
+                        .url(ldapConfig.get(LDAPConstants.CONNECTION_URL))
+                        .activeDirectory(activeDirectory)
+                        .supportAllFeatures()
+                        .mapping(User.class)
+                            .baseDN(ldapConfig.get(LDAPConstants.USER_DN_SUFFIX))
+                            .objectClasses(userObjectClasses)
+                            .attribute("loginName", ldapLoginNameMapping, true)
+                            .attribute("firstName", ldapFirstNameMapping)
+                            .attribute("lastName", ldapLastNameMapping)
+                            .attribute("email", ldapEmailMapping);
+
+        // Workaround to override the LDAPIdentityStore with our own :/
+        List<IdentityConfiguration> identityConfigs = builder.buildAll();
+        IdentityStoreConfiguration identityStoreConfig = identityConfigs.get(0).getStoreConfiguration().get(0);
+        ((AbstractIdentityStoreConfiguration)identityStoreConfig).setIdentityStoreType(KeycloakLDAPIdentityStore.class);
+
+        return new DefaultPartitionManager(identityConfigs);
+    }
+
+    private void checkSystemProperty(String name, String defaultValue) {
+        if (System.getProperty(name) == null) {
+            System.setProperty(name, defaultValue);
+        }
+    }
+
+    private String getNameOfLDAPAttribute(String systemPropertyName, String defaultAttrName, String defaultAttrNameInActiveDirectory, boolean activeDirectory) {
+        // System property has biggest priority if available
+        String sysProperty = System.getProperty(systemPropertyName);
+        if (sysProperty != null) {
+            return sysProperty;
+        }
+
+        return activeDirectory ? defaultAttrNameInActiveDirectory : defaultAttrName;
+    }
+
+    // Parse array of strings like [ "inetOrgPerson", "organizationalPerson" ] from the string like: "inetOrgPerson, organizationalPerson"
+    private String[] getUserObjectClasses(Map<String,String> ldapConfig) {
+        String objClassesCfg = ldapConfig.get(LDAPConstants.USER_OBJECT_CLASSES);
+        String objClassesStr = (objClassesCfg != null && objClassesCfg.length() > 0) ? objClassesCfg.trim() : "inetOrgPerson, organizationalPerson";
+
+        String[] objectClasses = objClassesStr.split(",");
+
+        // Trim them
+        String[] userObjectClasses = new String[objectClasses.length];
+        for (int i=0 ; i<objectClasses.length ; i++) {
+            userObjectClasses[i] = objectClasses[i].trim();
+        }
+        return userObjectClasses;
+    }
+
+    private class PartitionManagerContext {
+
+        private PartitionManagerContext(Map<String,String> config, PartitionManager manager) {
+            this.config = config;
+            this.partitionManager = manager;
+        }
+
+        private Map<String,String> config;
+        private PartitionManager partitionManager;
+    }
+}

diff --git a/federation/ldap/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory b/federation/ldap/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory
new file mode 100755
index 0000000..b8921e9
--- /dev/null
+++ b/federation/ldap/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory
@@ -0,0 +1 @@
+org.keycloak.federation.ldap.LDAPFederationProviderFactory
\ No newline at end of file

diff --git a/federation/pom.xml b/federation/pom.xml
new file mode 100755
index 0000000..5e15f90
--- /dev/null
+++ b/federation/pom.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+    <packaging>pom</packaging>
+
+    <artifactId>keycloak-federation-parent</artifactId>
+    <name>Keycloak Federation</name>
+    <description />
+
+    <modules>
+        <module>ldap</module>
+    </modules>
+
+</project>

diff --git a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccountProvider.java b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccountProvider.java
index e7d9636..ee84cc6 100755
--- a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccountProvider.java
+++ b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/FreeMarkerAccountProvider.java
@@ -124,7 +124,7 @@ public class FreeMarkerAccountProvider implements AccountProvider {
                 attributes.put("totp", new TotpBean(user, baseUri));
                 break;
             case SOCIAL:
-                attributes.put("social", new AccountSocialBean(realm, user, uriInfo.getBaseUri()));
+                attributes.put("social", new AccountSocialBean(session, realm, user, uriInfo.getBaseUri()));
                 break;
             case LOG:
                 attributes.put("log", new LogBean(events));

diff --git a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountBean.java b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountBean.java
index b07d38b..06ef6c2 100644
--- a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountBean.java
+++ b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountBean.java
@@ -22,7 +22,7 @@ public class AccountBean {
     }
 
     public String getUsername() {
-        return user.getLoginName();
+        return user.getUsername();
     }
 
     public String getEmail() {

diff --git a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountSocialBean.java b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountSocialBean.java
index 074174f..ad2786c 100755
--- a/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountSocialBean.java
+++ b/forms/account-freemarker/src/main/java/org/keycloak/account/freemarker/model/AccountSocialBean.java
@@ -8,6 +8,7 @@ import java.util.Set;
 
 import javax.ws.rs.core.UriBuilder;
 
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.SocialLinkModel;
 import org.keycloak.models.UserModel;
@@ -22,13 +23,15 @@ public class AccountSocialBean {
 
     private final List<SocialLinkEntry> socialLinks;
     private final boolean removeLinkPossible;
+    private final KeycloakSession session;
 
-    public AccountSocialBean(RealmModel realm, UserModel user, URI baseUri) {
+    public AccountSocialBean(KeycloakSession session, RealmModel realm, UserModel user, URI baseUri) {
+        this.session = session;
         URI accountSocialUpdateUri = Urls.accountSocialUpdate(baseUri, realm.getName());
         this.socialLinks = new LinkedList<SocialLinkEntry>();
 
         Map<String, String> socialConfig = realm.getSocialConfig();
-        Set<SocialLinkModel> userSocialLinks = realm.getSocialLinks(user);
+        Set<SocialLinkModel> userSocialLinks = session.users().getSocialLinks(user, realm);
 
         int availableLinks = 0;
         if (socialConfig != null && !socialConfig.isEmpty()) {

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
index 2671891..60560f3 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/applications.js
@@ -44,20 +44,48 @@ module.controller('ApplicationCredentialsCtrl', function($scope, $location, real
 });
 
 module.controller('ApplicationSessionsCtrl', function($scope, realm, sessionCount, application,
-                                                      ApplicationUserSessions,
-                                                    $location, Dialog, Notifications) {
+                                                      ApplicationUserSessions) {
     $scope.realm = realm;
     $scope.count = sessionCount.count;
     $scope.sessions = [];
     $scope.application = application;
 
+    $scope.page = 0;
+
+    $scope.query = {
+        realm : realm.realm,
+        application: $scope.application.name,
+        max : 5,
+        first : 0
+    }
+
+    $scope.firstPage = function() {
+        $scope.query.first = 0;
+        if ($scope.query.first < 0) {
+            $scope.query.first = 0;
+        }
+        $scope.loadUsers();
+    }
+
+    $scope.previousPage = function() {
+        $scope.query.first -= parseInt($scope.query.max);
+        if ($scope.query.first < 0) {
+            $scope.query.first = 0;
+        }
+        $scope.loadUsers();
+    }
+
+    $scope.nextPage = function() {
+        $scope.query.first += parseInt($scope.query.max);
+        $scope.loadUsers();
+    }
+
     $scope.toDate = function(val) {
         return new Date(val);
     };
 
     $scope.loadUsers = function() {
-        ApplicationUserSessions.query({ realm : realm.realm, application: $scope.application.name }, function(updated) {
-            $scope.count = updated.length;
+        ApplicationUserSessions.query($scope.query, function(updated) {
             $scope.sessions = updated;
         })
     };

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
index e38b4e1..571bbfc 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
@@ -134,18 +134,42 @@ module.controller('UserSocialCtrl', function($scope, realm, user, socialLinks) {
 
 module.controller('UserListCtrl', function($scope, realm, User) {
     $scope.realm = realm;
+    $scope.page = 0;
+
+    $scope.query = {
+        realm: realm.realm,
+        max : 5,
+        first : 0
+    }
+
+    $scope.firstPage = function() {
+        $scope.query.first = 0;
+        if ($scope.query.first < 0) {
+            $scope.query.first = 0;
+        }
+        $scope.searchQuery();
+    }
+
+    $scope.previousPage = function() {
+        $scope.query.first -= parseInt($scope.query.max);
+        if ($scope.query.first < 0) {
+            $scope.query.first = 0;
+        }
+        $scope.searchQuery();
+    }
+
+    $scope.nextPage = function() {
+        $scope.query.first += parseInt($scope.query.max);
+        $scope.searchQuery();
+    }
+
     $scope.searchQuery = function() {
         $scope.searchLoaded = false;
         $scope.currentSearch = $scope.search;
 
-        var params = { realm: realm.realm };
-        if ($scope.search) {
-            params.search = $scope.search;
-        }
-
-        $scope.users = User.query(params, function() {
+        $scope.users = User.query($scope.query, function() {
             $scope.searchLoaded = true;
-            $scope.lastSearch = params.search;
+            $scope.lastSearch = $scope.query.search;
         });
     };
 });

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js
index 415734a..57a3a27 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/services.js
@@ -908,6 +908,7 @@ module.factory('PasswordPolicy', function() {
     var p = {};
 
     p.policyMessages = {
+        hashIterations: "Number of hashing iterations.  Default is 1.  Recommended is 50000.",
         length:         "Minimal password length (integer type). Default value is 8.",
         digits:         "Minimal number (integer type) of digits in password. Default value is 1.",
         lowerCase:      "Minimal number (integer type) of lowercase characters in password. Default value is 1.",
@@ -916,6 +917,7 @@ module.factory('PasswordPolicy', function() {
     }
 
     p.allPolicies = [
+        { name: 'hashIterations', value: 1 },
         { name: 'length', value: 8 },
         { name: 'digits', value: 1 },
         { name: 'lowerCase', value: 1 },

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-sessions.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-sessions.html
index 93c388e..248838a 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-sessions.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-sessions.html
@@ -28,19 +28,30 @@
         </form>
         <table class="table table-striped table-bordered" data-ng-show="count > 0">
             <thead>
-            <tr>
+            <tr data-ng-hide="sessions">
                 <th class="kc-table-actions" colspan="3">
                     <div class="pull-right">
-                        <a class="btn btn-primary" ng-click="loadUsers()">Show Users</a>
+                        <a class="btn btn-primary" ng-click="loadUsers()">Show Sessions</a>
                     </div>
                 </th>
             </tr>
-            <tr>
+            <tr data-ng-show="sessions">
                 <th>User</th>
                 <th>From IP</th>
                 <th>Session Start</th>
             </tr>
             </thead>
+            <tfoot data-ng-show="sessions">
+            <tr>
+                <td colspan="7">
+                    <div class="table-nav">
+                        <button data-ng-click="firstPage()" class="first" ng-disabled="query.first == 0">First page</button>
+                        <button data-ng-click="previousPage()" class="prev" ng-disabled="query.first == 0">Previous page</button>
+                        <button data-ng-click="nextPage()" class="next" ng-disabled="sessions.length < query.max">Next page</button>
+                    </div>
+                </td>
+            </tr>
+            </tfoot>
             <tbody>
             <tr data-ng-repeat="session in sessions">
                 <td><a href="#/realms/{{realm.realm}}/users/{{session.user}}">{{session.user}}</a></td>

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-credentials.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-credentials.html
index 75a4b7a..b590604 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-credentials.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-credentials.html
@@ -50,7 +50,7 @@
                             <input class="form-control disabled" type="text" value="{{p.name|capitalize}}" readonly>
                         </td>
                         <td>
-                            <input class="form-control" ng-model="p.value" type="number" placeholder="No value assigned"  min="1" max="50">
+                            <input class="form-control" ng-model="p.value" type="number" placeholder="No value assigned"  min="1">
                         </td>
                         <td class="actions">
                             <div class="action-div"><i class="pficon pficon-delete" ng-click="removePolicy($index)" tooltip-placement="right" tooltip="Remove Policy"></i></div>

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-detail.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-detail.html
index 3b735dd..bfaaa59 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-detail.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/realm-detail.html
@@ -80,7 +80,7 @@
                     </div>
                 </fieldset>
                 <fieldset>
-                    <legend><span class="text">Optional Settings</span></legend>
+                    <legend><span class="text">Theme Settings</span></legend>
                     <div class="form-group">
                         <label class="col-sm-2 control-label" for="loginTheme">Login Theme</label>
                         <div class="col-sm-4">
@@ -130,6 +130,21 @@
                         </div>
                     </div>
                 </fieldset>
+                <fieldset>
+                    <legend><span class="text">Cache Settings</span></legend>
+                    <div class="form-group">
+                        <label class="col-sm-2 control-label" for="enabled">Realm Cache Enabled</label>
+                        <div class="col-sm-4">
+                            <input ng-model="realm.realmCacheEnabled" name="realmCacheEnabled" id="realmCacheEnabled" onoffswitch />
+                        </div>
+                    </div>
+                    <div class="form-group">
+                        <label class="col-sm-2 control-label" for="enabled">User Cache Enabled</label>
+                        <div class="col-sm-4">
+                            <input ng-model="realm.userCacheEnabled" name="userCacheEnabled" id="userCacheEnabled" onoffswitch />
+                        </div>
+                    </div>
+                </fieldset>
 
                 <div class="pull-right form-actions" data-ng-show="createRealm && access.manageRealm">
                     <button kc-cancel data-ng-click="cancel()">Cancel</button>

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-list.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-list.html
index dc54a55..d6dcd49 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-list.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-list.html
@@ -15,7 +15,7 @@
             <tr>
                 <th class="kc-table-actions" colspan="4">
                     <div class="search-comp clearfix">
-                        <input type="text" placeholder="Search..." data-ng-model="search" class="form-control search"
+                        <input type="text" placeholder="Search..." data-ng-model="query.search" class="form-control search"
                                onkeyup="if(event.keyCode == 13){$(this).next('button').click();}">
                         <button data-ng-click="searchQuery()" type="submit"
                                 class="kc-icon-search" tooltip-placement="right"
@@ -38,19 +38,17 @@
             </tr>
             </tr>
             </thead>
-            <!-- todo -->
-            <!--<tfoot data-ng-show="users && users.length > 10">
+            <tfoot data-ng-hide="!users || users.length == 0">
             <tr>
-                <td colspan="4">
+                <td colspan="7">
                     <div class="table-nav">
-                        <a href="#" class="first disabled">First page</a><a href="#" class="prev disabled">Previous
-                        page</a><span><strong>1-8</strong> of <strong>10</strong></span><a href="#"
-                                                                                           class="next">Next
-                        page</a><a href="#" class="last">Last page</a>
+                        <button data-ng-click="firstPage()" class="first" ng-disabled="query.first == 0">First page</button>
+                        <button data-ng-click="previousPage()" class="prev" ng-disabled="query.first == 0">Previous page</button>
+                        <button data-ng-click="nextPage()" class="next" ng-disabled="users.length < query.max">Next page</button>
                     </div>
                 </td>
             </tr>
-            </tfoot>-->
+            </tfoot>
             <tbody>
             <tr ng-repeat="user in users">
                 <td><a href="#/realms/{{realm.realm}}/users/{{user.username}}">{{user.username}}</a></td>

diff --git a/integration/js/pom.xml b/integration/js/pom.xml
index a08f3df..d9958b5 100755
--- a/integration/js/pom.xml
+++ b/integration/js/pom.xml
@@ -17,15 +17,32 @@
 	</dependencies>
 
 	<build>
-		<plugins>
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-compiler-plugin</artifactId>
-				<configuration>
-                                    <source>${maven.compiler.source}</source>
-                                    <target>${maven.compiler.target}</target>
-				</configuration>
-			</plugin>
+        <plugins>
+            <plugin>
+                <groupId>com.samaxes.maven</groupId>
+                <artifactId>minify-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>min-js</id>
+                        <phase>compile</phase>
+                        <configuration>
+                            <charset>utf-8</charset>
+                            <webappSourceDir>${basedir}/src/main/resources</webappSourceDir>
+                            <jsSourceDir>.</jsSourceDir>
+                            <jsSourceFiles>
+                                <jsSourceFile>keycloak.js</jsSourceFile>
+                            </jsSourceFiles>
+
+                            <webappTargetDir>${project.build.directory}/classes</webappTargetDir>
+                            <jsTargetDir>.</jsTargetDir>
+                            <jsFinalFile>keycloak.js</jsFinalFile>
+                        </configuration>
+                        <goals>
+                            <goal>minify</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
 		</plugins>
 	</build>
 

diff --git a/integration/js/src/main/resources/keycloak.js b/integration/js/src/main/resources/keycloak.js
index 617cbc4..d3881af 100755
--- a/integration/js/src/main/resources/keycloak.js
+++ b/integration/js/src/main/resources/keycloak.js
@@ -57,6 +57,17 @@
                     processCallback(callback, initPromise);
                     return;
                 } else if (initOptions) {
+                    var doLogin = function(prompt) {
+                        if (!prompt) {
+                            options.prompt = 'none';
+                        }
+                        kc.login(options).success(function () {
+                            initPromise.setSuccess();
+                        }).error(function () {
+                            initPromise.setError();
+                        });
+                    }
+
                     if (initOptions.token || initOptions.refreshToken) {
                         setToken(initOptions.token, initOptions.refreshToken);
                         initPromise.setSuccess();
@@ -64,16 +75,20 @@
                         var options = {};
                         switch (initOptions.onLoad) {
                             case 'check-sso':
-                                options.prompt = 'none';
-                            case 'login-required':
-                                var p = kc.login(options);
-                                if (p) {
-                                    p.success(function() {
-                                        initPromise.setSuccess();
-                                    }).error(function() {
-                                        initPromise.setError();
+                                if (loginIframe.enable) {
+                                    setupCheckLoginIframe().success(function() {
+                                        checkLoginIframe().success(function () {
+                                            doLogin(false);
+                                        }).error(function () {
+                                            initPromise.setSuccess();
+                                        });
                                     });
-                                };
+                                } else {
+                                    doLogin(false);
+                                }
+                                break;
+                            case 'login-required':
+                                doLogin(true);
                                 break;
                             default:
                                 throw 'Invalid value for onLoad';
@@ -525,7 +540,14 @@
         }
 
         function setupCheckLoginIframe() {
-            if (!loginIframe.enable || loginIframe.iframe) {
+            var promise = createPromise();
+
+            if (!loginIframe.enable) {
+                return;
+            }
+
+            if (loginIframe.iframe) {
+                promise.setSuccess();
                 return;
             }
 
@@ -539,6 +561,7 @@
                     loginIframe.iframeOrigin = realmUrl.substring(0, realmUrl.indexOf('/', 8));
                 }
                 loginIframe.iframe = iframe;
+                promise.setSuccess();
             }
 
             var src = getRealmUrl() + '/login-status-iframe.html?client_id=' + encodeURIComponent(kc.clientId) + '&origin=' + window.location.origin;
@@ -553,7 +576,8 @@
                 var data = event.data;
                 var promise = loginIframe.callbackMap[data.callbackId];
                 delete loginIframe.callbackMap[data.callbackId];
-                if (kc.sessionId == data.session && data.loggedIn) {
+
+                if ((!kc.sessionId || kc.sessionId == data.session) && data.loggedIn) {
                     promise.setSuccess();
                 } else {
                     clearToken();
@@ -570,12 +594,14 @@
             };
 
             setTimeout(check, loginIframe.interval * 1000);
+
+            return promise.promise;
         }
 
         function checkLoginIframe() {
             var promise = createPromise();
 
-            if (loginIframe.iframe || loginIframe.iframeOrigin) {
+            if (loginIframe.iframe && loginIframe.iframeOrigin) {
                 var msg = {};
                 msg.callbackId = createCallbackId();
                 loginIframe.callbackMap[msg.callbackId] = promise;
@@ -593,14 +619,17 @@
                 return {
                     login: function(options) {
                         window.location.href = kc.createLoginUrl(options);
+                        return createPromise().promise;
                     },
 
                     logout: function(options) {
                         window.location.href = kc.createLogoutUrl(options);
+                        return createPromise().promise;
                     },
 
                     accountManagement : function() {
                         window.location.href = kc.createAccountUrl();
+                        return createPromise().promise;
                     },
 
                     redirectUri: function(options) {

diff --git a/integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java b/integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java
index 88ae3c2..7557127 100755
--- a/integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java
+++ b/integration/undertow/src/main/java/org/keycloak/adapters/undertow/KeycloakServletExtension.java
@@ -99,12 +99,14 @@ public class KeycloakServletExtension implements ServletExtension {
         InputStream is = getConfigInputStream(servletContext);
         KeycloakDeployment deployment = null;
         if (is == null) {
-            throw new RuntimeException("Unable to find realm config in /WEB-INF/keycloak.json or in keycloak subsystem.");
+            log.warn("No adapter configuration.  Keycloak is unconfigured and will deny all requests.");
+            deployment = new KeycloakDeployment();
         } else {
             deployment = KeycloakDeploymentBuilder.build(is);
 
         }
         AdapterDeploymentContext deploymentContext = new AdapterDeploymentContext(deployment);
+        servletContext.setAttribute(AdapterDeploymentContext.class.getName(), deploymentContext);
         UndertowUserSessionManagement userSessionManagement = new UndertowUserSessionManagement();
         final ServletKeycloakAuthMech mech = createAuthenticationMechanism(deploymentInfo, deploymentContext, userSessionManagement);
 

diff --git a/integration/wildfly-subsystem/pom.xml b/integration/wildfly-subsystem/pom.xml
index 5311ee2..ff4ebf7 100755
--- a/integration/wildfly-subsystem/pom.xml
+++ b/integration/wildfly-subsystem/pom.xml
@@ -65,18 +65,22 @@
         <dependency>
             <groupId>org.wildfly</groupId>
             <artifactId>wildfly-controller</artifactId>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.wildfly</groupId>
             <artifactId>wildfly-server</artifactId>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.wildfly</groupId>
             <artifactId>wildfly-ee</artifactId>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.wildfly</groupId>
             <artifactId>wildfly-undertow</artifactId>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>

diff --git a/integration/wildfly-subsystem/src/main/resources/subsystem-templates/keycloak.xml b/integration/wildfly-subsystem/src/main/resources/subsystem-templates/keycloak.xml
new file mode 100644
index 0000000..9f3d0ed
--- /dev/null
+++ b/integration/wildfly-subsystem/src/main/resources/subsystem-templates/keycloak.xml
@@ -0,0 +1,6 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!--  Template used by WildFly build when directed to include Keycloak subsystem in a configuration. -->
+<config>
+   <extension-module>org.keycloak.keycloak-wildfly-subsystem</extension-module>
+   <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+</config>

diff --git a/model/api/pom.xml b/model/api/pom.xml
index f72d856..d0af4dc 100755
--- a/model/api/pom.xml
+++ b/model/api/pom.xml
@@ -31,6 +31,11 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.jboss.logging</groupId>
+            <artifactId>jboss-logging</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
             <scope>test</scope>

diff --git a/model/api/src/main/java/org/keycloak/models/ClientModel.java b/model/api/src/main/java/org/keycloak/models/ClientModel.java
index 321d014..33ee8e2 100755
--- a/model/api/src/main/java/org/keycloak/models/ClientModel.java
+++ b/model/api/src/main/java/org/keycloak/models/ClientModel.java
@@ -1,6 +1,5 @@
 package org.keycloak.models;
 
-import java.util.List;
 import java.util.Set;
 
 /**
@@ -75,7 +74,4 @@ public interface ClientModel {
 
     void setNotBefore(int notBefore);
 
-    Set<UserSessionModel> getUserSessions();
-
-    int getActiveUserSessions();
 }

diff --git a/model/api/src/main/java/org/keycloak/models/entities/CredentialEntity.java b/model/api/src/main/java/org/keycloak/models/entities/CredentialEntity.java
old mode 100644
new mode 100755
index 82bc922..6255836
--- a/model/api/src/main/java/org/keycloak/models/entities/CredentialEntity.java
+++ b/model/api/src/main/java/org/keycloak/models/entities/CredentialEntity.java
@@ -9,6 +9,7 @@ public class CredentialEntity {
     private String value;
     private String device;
     private byte[] salt;
+    private int hashIterations;
 
     public String getType() {
         return type;
@@ -41,4 +42,12 @@ public class CredentialEntity {
     public void setSalt(byte[] salt) {
         this.salt = salt;
     }
+
+    public int getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(int hashIterations) {
+        this.hashIterations = hashIterations;
+    }
 }

diff --git a/model/api/src/main/java/org/keycloak/models/entities/FederationProviderEntity.java b/model/api/src/main/java/org/keycloak/models/entities/FederationProviderEntity.java
new file mode 100755
index 0000000..0330acc
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/entities/FederationProviderEntity.java
@@ -0,0 +1,37 @@
+package org.keycloak.models.entities;
+
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class FederationProviderEntity {
+    protected String id;
+    protected String providerName;
+    private Map<String, String> config;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public void setProviderName(String providerName) {
+        this.providerName = providerName;
+    }
+
+    public Map<String, String> getConfig() {
+        return config;
+    }
+
+    public void setConfig(Map<String, String> config) {
+        this.config = config;
+    }
+}

diff --git a/model/api/src/main/java/org/keycloak/models/entities/RealmEntity.java b/model/api/src/main/java/org/keycloak/models/entities/RealmEntity.java
index 3c841a5..061cfe4 100755
--- a/model/api/src/main/java/org/keycloak/models/entities/RealmEntity.java
+++ b/model/api/src/main/java/org/keycloak/models/entities/RealmEntity.java
@@ -51,6 +51,7 @@ public class RealmEntity extends AbstractIdentifiableEntity {
 
     private List<RequiredCredentialEntity> requiredCredentials = new ArrayList<RequiredCredentialEntity>();
     private List<AuthenticationProviderEntity> authenticationProviders = new ArrayList<AuthenticationProviderEntity>();
+    private List<FederationProviderEntity> federationProviders = new ArrayList<FederationProviderEntity>();
 
     private Map<String, String> smtpConfig = new HashMap<String, String>();
     private Map<String, String> socialConfig = new HashMap<String, String>();
@@ -381,4 +382,12 @@ public class RealmEntity extends AbstractIdentifiableEntity {
     public void setAdminAppId(String adminAppId) {
         this.adminAppId = adminAppId;
     }
+
+    public List<FederationProviderEntity> getFederationProviders() {
+        return federationProviders;
+    }
+
+    public void setFederationProviders(List<FederationProviderEntity> federationProviders) {
+        this.federationProviders = federationProviders;
+    }
 }

diff --git a/model/api/src/main/java/org/keycloak/models/entities/UserEntity.java b/model/api/src/main/java/org/keycloak/models/entities/UserEntity.java
old mode 100644
new mode 100755
index f1248b0..9aa0b0b
--- a/model/api/src/main/java/org/keycloak/models/entities/UserEntity.java
+++ b/model/api/src/main/java/org/keycloak/models/entities/UserEntity.java
@@ -1,24 +1,23 @@
 package org.keycloak.models.entities;
 
+import org.keycloak.models.UserModel;
+
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
-import org.keycloak.models.UserModel;
-
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public class UserEntity extends AbstractIdentifiableEntity {
 
-    private String loginName;
+    private String username;
     private String firstName;
     private String lastName;
     private String email;
     private boolean emailVerified;
     private boolean totp;
     private boolean enabled;
-    private int notBefore;
 
     private String realmId;
 
@@ -29,13 +28,14 @@ public class UserEntity extends AbstractIdentifiableEntity {
     private List<CredentialEntity> credentials = new ArrayList<CredentialEntity>();
     private List<SocialLinkEntity> socialLinks;
     private AuthenticationLinkEntity authenticationLink;
+    private String federationLink;
 
-    public String getLoginName() {
-        return loginName;
+    public String getUsername() {
+        return username;
     }
 
-    public void setLoginName(String loginName) {
-        this.loginName = loginName;
+    public void setUsername(String username) {
+        this.username = username;
     }
 
     public String getFirstName() {
@@ -86,14 +86,6 @@ public class UserEntity extends AbstractIdentifiableEntity {
         this.enabled = enabled;
     }
 
-    public int getNotBefore() {
-        return notBefore;
-    }
-
-    public void setNotBefore(int notBefore) {
-        this.notBefore = notBefore;
-    }
-
     public String getRealmId() {
         return realmId;
     }
@@ -149,5 +141,13 @@ public class UserEntity extends AbstractIdentifiableEntity {
     public void setAuthenticationLink(AuthenticationLinkEntity authenticationLink) {
         this.authenticationLink = authenticationLink;
     }
+
+    public String getFederationLink() {
+        return federationLink;
+    }
+
+    public void setFederationLink(String federationLink) {
+        this.federationLink = federationLink;
+    }
 }
 

diff --git a/model/api/src/main/java/org/keycloak/models/KeycloakSession.java b/model/api/src/main/java/org/keycloak/models/KeycloakSession.java
index ba2c776..506d211 100755
--- a/model/api/src/main/java/org/keycloak/models/KeycloakSession.java
+++ b/model/api/src/main/java/org/keycloak/models/KeycloakSession.java
@@ -2,8 +2,6 @@ package org.keycloak.models;
 
 import org.keycloak.provider.Provider;
 
-import java.util.List;
-import java.util.Map;
 import java.util.Set;
 
 /**
@@ -11,9 +9,8 @@ import java.util.Set;
  * @version $Revision: 1 $
  */
 public interface KeycloakSession {
-    // Note: The reason there are so many query methods here is for layering a cache on top of an persistent KeycloakSession
 
-    KeycloakTransaction getTransaction();
+    KeycloakTransactionManager getTransaction();
 
     <T extends Provider> T getProvider(Class<T> clazz);
 
@@ -23,45 +20,41 @@ public interface KeycloakSession {
 
     <T extends Provider> Set<T> getAllProviders(Class<T> clazz);
 
-    RealmModel createRealm(String name);
-    RealmModel createRealm(String id, String name);
-    RealmModel getRealm(String id);
-    RealmModel getRealmByName(String name);
+    void enlistForClose(Provider provider);
 
-    UserModel getUserById(String id, RealmModel realm);
-    UserModel getUserByUsername(String username, RealmModel realm);
-    UserModel getUserByEmail(String email, RealmModel realm);
-    UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm);
-    List<UserModel> getUsers(RealmModel realm);
-    List<UserModel> searchForUser(String search, RealmModel realm);
-    List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm);
+    KeycloakSessionFactory getKeycloakSessionFactory();
 
-    Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm);
-    SocialLinkModel getSocialLink(UserModel user, String socialProvider, RealmModel realm);
+    /**
+     * Returns a managed provider instance.  Will start a provider transaction.  This transaction is managed by the KeycloakSession
+     * transaction.
+     *
+     * @return
+     * @throws IllegalStateException if transaction is not active
+     */
+    RealmProvider realms();
 
+    /**
+     * Returns a managed provider instance.  Will start a provider transaction.  This transaction is managed by the KeycloakSession
+     * transaction.
+     *
+     * @return
+     * @throws IllegalStateException if transaction is not active
+     */
+    UserSessionProvider sessions();
 
-    RoleModel getRoleById(String id, RealmModel realm);
-    ApplicationModel getApplicationById(String id, RealmModel realm);
-    OAuthClientModel getOAuthClientById(String id, RealmModel realm);
-    List<RealmModel> getRealms();
-    boolean removeRealm(String id);
 
-    UsernameLoginFailureModel getUserLoginFailure(String username, RealmModel realm);
-    UsernameLoginFailureModel addUserLoginFailure(String username, RealmModel realm);
-    List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm);
-
-    UserSessionModel createUserSession(RealmModel realm, UserModel user, String ipAddress);
-    UserSessionModel getUserSession(String id, RealmModel realm);
-    List<UserSessionModel> getUserSessions(UserModel user, RealmModel realm);
-    Set<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client);
-    int getActiveUserSessions(RealmModel realm, ClientModel client);
-    void removeUserSession(UserSessionModel session);
-    void removeUserSessions(RealmModel realm, UserModel user);
-    void removeExpiredUserSessions(RealmModel realm);
-    void removeUserSessions(RealmModel realm);
-
-
-    void removeAllData();
 
     void close();
+
+    /**
+     * Possibly both cached and federated view of users depending on configuration.
+     *
+     * @return
+     */
+    UserProvider users();
+
+    /**
+     *  Keycloak user storage.  Non-federated, but possibly cache (if it is on) view of users.
+     */
+    UserProvider userStorage();
 }

diff --git a/model/api/src/main/java/org/keycloak/models/KeycloakSessionFactory.java b/model/api/src/main/java/org/keycloak/models/KeycloakSessionFactory.java
index 582b7ea..af31c09 100755
--- a/model/api/src/main/java/org/keycloak/models/KeycloakSessionFactory.java
+++ b/model/api/src/main/java/org/keycloak/models/KeycloakSessionFactory.java
@@ -1,10 +1,18 @@
 package org.keycloak.models;
 
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 public interface KeycloakSessionFactory {
     KeycloakSession create();
+
+    <T extends Provider> ProviderFactory<T> getProviderFactory(Class<T> clazz);
+
+    <T extends Provider> ProviderFactory<T> getProviderFactory(Class<T> clazz, String id);
+
     void close();
 }

diff --git a/model/api/src/main/java/org/keycloak/models/KeycloakTransaction.java b/model/api/src/main/java/org/keycloak/models/KeycloakTransaction.java
index 5db29f3..cf9103e 100755
--- a/model/api/src/main/java/org/keycloak/models/KeycloakTransaction.java
+++ b/model/api/src/main/java/org/keycloak/models/KeycloakTransaction.java
@@ -10,4 +10,5 @@ public interface KeycloakTransaction {
     void rollback();
     void setRollbackOnly();
     boolean getRollbackOnly();
-    boolean isActive();}
+    boolean isActive();
+}

diff --git a/model/api/src/main/java/org/keycloak/models/KeycloakTransactionManager.java b/model/api/src/main/java/org/keycloak/models/KeycloakTransactionManager.java
new file mode 100755
index 0000000..abc64ea
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/KeycloakTransactionManager.java
@@ -0,0 +1,12 @@
+package org.keycloak.models;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface KeycloakTransactionManager extends KeycloakTransaction {
+
+    void enlist(KeycloakTransaction transaction);
+    void enlistAfterCompletion(KeycloakTransaction transaction);
+
+}

diff --git a/model/api/src/main/java/org/keycloak/models/PasswordPolicy.java b/model/api/src/main/java/org/keycloak/models/PasswordPolicy.java
old mode 100644
new mode 100755
index 99636b9..bea471d
--- a/model/api/src/main/java/org/keycloak/models/PasswordPolicy.java
+++ b/model/api/src/main/java/org/keycloak/models/PasswordPolicy.java
@@ -52,11 +52,28 @@ public class PasswordPolicy {
                 list.add(new UpperCase(args));
             } else if (name.equals(SpecialChars.NAME)) {
                 list.add(new SpecialChars(args));
+            } else if (name.equals(HashIterations.NAME)) {
+                list.add(new HashIterations(args));
             }
         }
         return list;
     }
 
+    /**
+     *
+     * @return -1 if no hash iterations setting
+     */
+    public int getHashIterations() {
+        if (policies == null) return -1;
+        for (Policy p : policies) {
+            if (p instanceof HashIterations) {
+                return ((HashIterations)p).iterations;
+            }
+
+        }
+        return -1;
+    }
+
     public String validate(String password) {
         for (Policy p : policies) {
             String error = p.validate(password);
@@ -71,6 +88,20 @@ public class PasswordPolicy {
         public String validate(String password);
     }
 
+    private static class HashIterations implements Policy {
+        private static final String NAME = "hashIterations";
+        private int iterations;
+
+        public HashIterations(String[] args) {
+            iterations = intArg(NAME, 1, args);
+        }
+
+        @Override
+        public String validate(String password) {
+            return null;
+        }
+    }
+
     private static class Length implements Policy {
         private static final String NAME = "length";
         private int min;

diff --git a/model/api/src/main/java/org/keycloak/models/RealmModel.java b/model/api/src/main/java/org/keycloak/models/RealmModel.java
index f669968..1884dec 100755
--- a/model/api/src/main/java/org/keycloak/models/RealmModel.java
+++ b/model/api/src/main/java/org/keycloak/models/RealmModel.java
@@ -106,22 +106,6 @@ public interface RealmModel extends RoleContainerModel {
 
     void setPasswordPolicy(PasswordPolicy policy);
 
-    boolean validatePassword(UserModel user, String password);
-
-    boolean validateTOTP(UserModel user, String password, String token);
-
-    UserModel getUser(String name);
-
-    UserModel getUserByEmail(String email);
-
-    UserModel getUserById(String name);
-
-    UserModel addUser(String id, String username);
-
-    UserModel addUser(String username);
-
-    boolean removeUser(String name);
-
     RoleModel getRoleById(String id);
 
     List<String> getDefaultRoles();
@@ -147,16 +131,6 @@ public interface RealmModel extends RoleContainerModel {
 
     void updateRequiredCredentials(Set<String> creds);
 
-    UserModel getUserBySocialLink(SocialLinkModel socialLink);
-
-    Set<SocialLinkModel> getSocialLinks(UserModel user);
-
-    SocialLinkModel getSocialLink(UserModel user, String socialProvider);
-
-    void addSocialLink(UserModel user, SocialLinkModel socialLink);
-
-    boolean removeSocialLink(UserModel user, String socialProvider);
-
     boolean isSocial();
 
     void setSocial(boolean social);
@@ -165,16 +139,6 @@ public interface RealmModel extends RoleContainerModel {
 
     void setUpdateProfileOnInitialSocialLogin(boolean updateProfileOnInitialSocialLogin);
 
-    UsernameLoginFailureModel getUserLoginFailure(String username);
-    UsernameLoginFailureModel addUserLoginFailure(String username);
-    List<UsernameLoginFailureModel> getAllUserLoginFailures();
-
-    List<UserModel> getUsers();
-
-    List<UserModel> searchForUser(String search);
-
-    List<UserModel> searchForUserByAttributes(Map<String, String> attributes);
-
     OAuthClientModel addOAuthClient(String name);
 
     OAuthClientModel addOAuthClient(String id, String name);
@@ -201,6 +165,10 @@ public interface RealmModel extends RoleContainerModel {
 
     void setAuthenticationProviders(List<AuthenticationProviderModel> authenticationProviders);
 
+    List<UserFederationProviderModel> getUserFederationProviders();
+
+    void setUserFederationProviders(List<UserFederationProviderModel> providers);
+
     String getLoginTheme();
 
     void setLoginTheme(String name);
@@ -245,19 +213,6 @@ public interface RealmModel extends RoleContainerModel {
 
     void setMasterAdminApp(ApplicationModel app);
 
-    UserSessionModel createUserSession(UserModel user, String ipAddress);
-
-    UserSessionModel getUserSession(String id);
-
-    List<UserSessionModel> getUserSessions(UserModel user);
-
-    void removeUserSession(UserSessionModel session);
-
-    void removeUserSessions(UserModel user);
-
-    void removeExpiredUserSessions();
-
     ClientModel findClientById(String id);
 
-    void removeUserSessions();
 }

diff --git a/model/api/src/main/java/org/keycloak/models/RoleContainerModel.java b/model/api/src/main/java/org/keycloak/models/RoleContainerModel.java
index 2cad371..f8d0000 100755
--- a/model/api/src/main/java/org/keycloak/models/RoleContainerModel.java
+++ b/model/api/src/main/java/org/keycloak/models/RoleContainerModel.java
@@ -1,6 +1,5 @@
 package org.keycloak.models;
 
-import java.util.List;
 import java.util.Set;
 
 /**

diff --git a/model/api/src/main/java/org/keycloak/models/ScopeMapperModel.java b/model/api/src/main/java/org/keycloak/models/ScopeMapperModel.java
index 0bfd293..6515ab0 100755
--- a/model/api/src/main/java/org/keycloak/models/ScopeMapperModel.java
+++ b/model/api/src/main/java/org/keycloak/models/ScopeMapperModel.java
@@ -1,8 +1,5 @@
 package org.keycloak.models;
 
-import java.util.List;
-import java.util.Set;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $

diff --git a/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java b/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
index d096b97..4c5275b 100755
--- a/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
+++ b/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
@@ -35,6 +35,13 @@ public class UserCredentialModel {
         return model;
     }
 
+    public static UserCredentialModel totp(String key) {
+        UserCredentialModel model = new UserCredentialModel();
+        model.setType(TOTP);
+        model.setValue(key);
+        return model;
+    }
+
     public static UserCredentialModel generateSecret() {
         UserCredentialModel model = new UserCredentialModel();
         model.setType(SECRET);

diff --git a/model/api/src/main/java/org/keycloak/models/UserCredentialValueModel.java b/model/api/src/main/java/org/keycloak/models/UserCredentialValueModel.java
old mode 100644
new mode 100755
index 3702274..bd1213f
--- a/model/api/src/main/java/org/keycloak/models/UserCredentialValueModel.java
+++ b/model/api/src/main/java/org/keycloak/models/UserCredentialValueModel.java
@@ -11,6 +11,7 @@ public class UserCredentialValueModel {
     private String value;
     private String device;
     private byte[] salt;
+    private int hashIterations;
 
     public String getType() {
         return type;
@@ -43,4 +44,12 @@ public class UserCredentialValueModel {
     public void setSalt(byte[] salt) {
         this.salt = salt;
     }
+
+    public int getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(int iterations) {
+        this.hashIterations = iterations;
+    }
 }

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationManager.java b/model/api/src/main/java/org/keycloak/models/UserFederationManager.java
new file mode 100755
index 0000000..14be8cc
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationManager.java
@@ -0,0 +1,358 @@
+package org.keycloak.models;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class UserFederationManager implements UserProvider {
+    protected KeycloakSession session;
+
+    public UserFederationManager(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String id, String username, boolean addDefaultRoles) {
+        UserModel user = session.userStorage().addUser(realm, id, username, addDefaultRoles);
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = session.getProvider(UserFederationProvider.class, federation.getProviderName());
+            if (fed.isRegistrationSupported()) {
+                return fed.register(realm, user);
+            }
+        }
+        return user;
+    }
+
+    protected UserFederationProvider getFederationProvider(UserFederationProviderModel model) {
+        UserFederationProviderFactory factory = (UserFederationProviderFactory)session.getKeycloakSessionFactory().getProviderFactory(UserFederationProvider.class, model.getProviderName());
+        return factory.getInstance(session, model);
+
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String username) {
+        UserModel user = session.userStorage().addUser(realm, username);
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            if (fed.isRegistrationSupported()) {
+                return fed.register(realm, user);
+            }
+        }
+        return user;
+    }
+
+    protected UserFederationProvider getFederationLink(RealmModel realm, UserModel user) {
+        if (user.getFederationLink() == null) return null;
+        for (UserFederationProviderModel fed : realm.getUserFederationProviders()) {
+            if (fed.getId().equals(user.getFederationLink())) {
+                return getFederationProvider(fed);
+            }
+        }
+        return null;
+    }
+
+    @Override
+    public boolean removeUser(RealmModel realm, UserModel user) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null) {
+            return link.removeUser(realm, user);
+        }
+        return session.userStorage().removeUser(realm, user);
+
+    }
+
+    protected void validateUser(RealmModel realm, UserModel user) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null  && !link.isValid(user)) {
+            deleteInvalidUser(realm, user);
+            throw new IllegalStateException("Federated user no longer valid");
+        }
+
+    }
+
+    protected void deleteInvalidUser(RealmModel realm, UserModel user) {
+        KeycloakSession tx = session.getKeycloakSessionFactory().create();
+        try {
+            tx.getTransaction().begin();
+            RealmModel realmModel = tx.realms().getRealm(realm.getId());
+            UserModel deletedUser = tx.userStorage().getUserById(user.getId(), realmModel);
+            tx.userStorage().removeUser(realmModel, deletedUser);
+            tx.getTransaction().commit();
+        } finally {
+            tx.close();
+        }
+    }
+
+    protected boolean isValid(RealmModel realm, UserModel user) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null) return link.isValid(user);
+        return true;
+    }
+
+
+    protected UserModel validateAndProxyUser(RealmModel realm, UserModel user) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null) {
+            if (isValid(realm, user)) {
+                return link.proxy(user);
+            } else {
+                deleteInvalidUser(realm, user);
+                return null;
+            }
+        }
+        return user;
+    }
+
+    @Override
+    public void addSocialLink(RealmModel realm, UserModel user, SocialLinkModel socialLink) {
+        validateUser(realm, user);
+        session.userStorage().addSocialLink(realm, user, socialLink);
+    }
+
+    @Override
+    public boolean removeSocialLink(RealmModel realm, UserModel user, String socialProvider) {
+        validateUser(realm, user);
+        if (user == null) throw new IllegalStateException("Federated user no longer valid");
+        return session.userStorage().removeSocialLink(realm, user, socialProvider);
+    }
+
+    @Override
+    public UserModel getUserById(String id, RealmModel realm) {
+        UserModel user = session.userStorage().getUserById(id, realm);
+        if (user != null) {
+            user = validateAndProxyUser(realm, user);
+        }
+        return user;
+    }
+
+    @Override
+    public UserModel getUserByUsername(String username, RealmModel realm) {
+        UserModel user = session.userStorage().getUserByUsername(username, realm);
+        if (user != null) {
+            user = validateAndProxyUser(realm, user);
+            if (user != null) return user;
+        }
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            user = fed.getUserByUsername(realm, username);
+            if (user != null) return user;
+        }
+        return user;
+    }
+
+    @Override
+    public UserModel getUserByEmail(String email, RealmModel realm) {
+        UserModel user = session.userStorage().getUserByEmail(email, realm);
+        if (user != null) {
+            user = validateAndProxyUser(realm, user);
+            if (user != null) return user;
+        }
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            user = fed.getUserByEmail(realm, email);
+            if (user != null) return user;
+        }
+        return user;
+    }
+
+    @Override
+    public UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm) {
+        UserModel user = session.userStorage().getUserBySocialLink(socialLink, realm);
+        if (user != null) {
+            user = validateAndProxyUser(realm, user);
+        }
+        return user;
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm) {
+        return getUsers(realm, 0, Integer.MAX_VALUE);
+
+    }
+
+    @Override
+    public int getUsersCount(RealmModel realm) {
+        return session.userStorage().getUsersCount(realm);
+    }
+
+    interface PaginatedQuery {
+        List<UserModel> query(RealmModel realm, int first, int max);
+    }
+
+    protected List<UserModel> query(PaginatedQuery pagedQuery, RealmModel realm, int firstResult, int maxResults) {
+        List<UserModel> results = new LinkedList<UserModel>();
+        if (maxResults <= 0) return results;
+        int first = firstResult;
+        int max = maxResults;
+        do {
+            List<UserModel> query = pagedQuery.query(realm, first, max);
+            if (query == null || query.size() == 0) return results;
+            int added = 0;
+            for (UserModel user : query) {
+                user = validateAndProxyUser(realm, user);
+                if (user == null) continue;
+                results.add(user);
+                added++;
+            }
+            if (results.size() == maxResults) return results;
+            if (query.size() < max) return results;
+            first = query.size();
+            max -= added;
+        } while (true);
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm, int firstResult, int maxResults) {
+        return query(new PaginatedQuery() {
+            @Override
+            public List<UserModel> query(RealmModel realm, int first, int max) {
+                return session.userStorage().getUsers(realm, first, max);
+            }
+        }, realm, firstResult, maxResults);
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm) {
+        return searchForUser(search, realm, 0, Integer.MAX_VALUE);
+    }
+
+    void federationLoad(RealmModel realm, Map<String, String> attributes) {
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            fed.searchByAttributes(attributes, realm);
+        }
+    }
+
+    @Override
+    public List<UserModel> searchForUser(final String search, RealmModel realm, int firstResult, int maxResults) {
+        Map<String, String> attributes = new HashMap<String, String>();
+        int spaceIndex = search.lastIndexOf(' ');
+        if (spaceIndex > -1) {
+            String firstName = search.substring(0, spaceIndex).trim();
+            String lastName = search.substring(spaceIndex).trim();
+            attributes.put(UserModel.FIRST_NAME, firstName);
+            attributes.put(UserModel.LAST_NAME, lastName);
+        } else if (search.indexOf('@') > -1) {
+            attributes.put(UserModel.USERNAME, search.trim());
+            attributes.put(UserModel.EMAIL, search.trim());
+        } else {
+            attributes.put(UserModel.LAST_NAME, search.trim());
+            attributes.put(UserModel.USERNAME, search.trim());
+        }
+        federationLoad(realm, attributes);
+        return query(new PaginatedQuery() {
+            @Override
+            public List<UserModel> query(RealmModel realm, int first, int max) {
+                return session.userStorage().searchForUser(search, realm, first, max);
+            }
+        }, realm, firstResult, maxResults);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm) {
+        return searchForUserByAttributes(attributes, realm, 0, Integer.MAX_VALUE);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(final Map<String, String> attributes, RealmModel realm, int firstResult, int maxResults) {
+        federationLoad(realm, attributes);
+        return query(new PaginatedQuery() {
+            @Override
+            public List<UserModel> query(RealmModel realm, int first, int max) {
+                return session.userStorage().searchForUserByAttributes(attributes, realm, first, max);
+            }
+        }, realm, firstResult, maxResults);
+    }
+
+    @Override
+    public Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm) {
+        validateUser(realm, user);
+        if (user == null) throw new IllegalStateException("Federated user no longer valid");
+        return session.userStorage().getSocialLinks(user, realm);
+    }
+
+    @Override
+    public SocialLinkModel getSocialLink(UserModel user, String socialProvider, RealmModel realm) {
+        validateUser(realm, user);
+        if (user == null) throw new IllegalStateException("Federated user no longer valid");
+        return session.userStorage().getSocialLink(user, socialProvider, realm);
+    }
+
+    @Override
+    public void preRemove(RealmModel realm) {
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            fed.preRemove(realm);
+        }
+        session.userStorage().preRemove(realm);
+    }
+
+    @Override
+    public void preRemove(RealmModel realm, RoleModel role) {
+        for (UserFederationProviderModel federation : realm.getUserFederationProviders()) {
+            UserFederationProvider fed = getFederationProvider(federation);
+            fed.preRemove(realm, role);
+        }
+        session.userStorage().preRemove(realm, role);
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null) {
+            validateUser(realm, user);
+            if (link.getSupportedCredentialTypes().size() > 0) {
+                List<UserCredentialModel> fedCreds = new ArrayList<UserCredentialModel>();
+                List<UserCredentialModel> localCreds = new ArrayList<UserCredentialModel>();
+                for (UserCredentialModel cred : input) {
+                    if (fedCreds.contains(cred.getType())) {
+                        fedCreds.add(cred);
+                    } else {
+                        localCreds.add(cred);
+                    }
+                }
+                if (!link.validCredentials(realm, user, fedCreds)) {
+                    return false;
+                }
+                return session.userStorage().validCredentials(realm, user, localCreds);
+            }
+        }
+        return session.userStorage().validCredentials(realm, user, input);
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
+        UserFederationProvider link = getFederationLink(realm, user);
+        if (link != null) {
+            validateUser(realm, user);
+            Set<String> supportedCredentialTypes = link.getSupportedCredentialTypes();
+            if (supportedCredentialTypes.size() > 0) {
+                List<UserCredentialModel> fedCreds = new ArrayList<UserCredentialModel>();
+                List<UserCredentialModel> localCreds = new ArrayList<UserCredentialModel>();
+                for (UserCredentialModel cred : input) {
+                    if (supportedCredentialTypes.contains(cred.getType())) {
+                        fedCreds.add(cred);
+                    } else {
+                        localCreds.add(cred);
+                    }
+                }
+                if (!link.validCredentials(realm, user, fedCreds)) {
+                    return false;
+                }
+                return session.userStorage().validCredentials(realm, user, localCreds);
+            }
+        }
+        return session.userStorage().validCredentials(realm, user, input);
+    }
+
+    @Override
+    public void close() {
+    }
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java b/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java
new file mode 100755
index 0000000..2ea322f
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java
@@ -0,0 +1,61 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ *
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserFederationProvider extends Provider {
+
+    public static final String USERNAME = UserModel.USERNAME;
+    public static final String EMAIL = UserModel.EMAIL;
+    public static final String FIRST_NAME = UserModel.EMAIL;
+    public static final String LAST_NAME = UserModel.LAST_NAME;
+
+    UserModel proxy(UserModel local);
+    boolean isRegistrationSupported();
+    UserModel register(RealmModel realm, UserModel user);
+    boolean removeUser(RealmModel realm, UserModel user);
+
+    /**
+     * Required to import into local storage any user found.
+     *
+     * @param realm
+     * @param username
+     * @return
+     */
+    UserModel getUserByUsername(RealmModel realm, String username);
+
+    /**
+     * Required to import into local storage any user found.
+     *
+     * @param realm
+     * @param email
+     * @return
+     */
+    UserModel getUserByEmail(RealmModel realm, String email);
+
+    /**
+     * Required to import into local storage any user found.  Must not import if user already exists in KeycloakSession.userStorage()!
+     * Currently only attributes USERNAME, EMAIL, FIRST_NAME and LAST_NAME will be used.
+     *
+     * @param attributes
+     * @param realm
+     * @return
+     */
+    List<UserModel> searchByAttributes(Map<String, String> attributes, RealmModel realm);
+
+    void preRemove(RealmModel realm);
+    void preRemove(RealmModel realm, RoleModel role);
+
+    boolean isValid(UserModel local);
+    Set<String> getSupportedCredentialTypes();
+    boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input);
+    boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input);
+    void close();}

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationProviderFactory.java b/model/api/src/main/java/org/keycloak/models/UserFederationProviderFactory.java
new file mode 100755
index 0000000..b723f3d
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationProviderFactory.java
@@ -0,0 +1,11 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserFederationProviderFactory extends ProviderFactory<UserFederationProvider> {
+    UserFederationProvider getInstance(KeycloakSession session, UserFederationProviderModel model);
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationProviderModel.java b/model/api/src/main/java/org/keycloak/models/UserFederationProviderModel.java
new file mode 100755
index 0000000..35fd727
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationProviderModel.java
@@ -0,0 +1,45 @@
+package org.keycloak.models;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ * @author <a href="mailto:bburke@redhat.com">Bill Burke</a>
+ */
+public class UserFederationProviderModel {
+
+    private String id;
+    private String providerName;
+    private Map<String, String> config = new HashMap<String, String>();
+
+    public UserFederationProviderModel() {};
+
+    public UserFederationProviderModel(String id, String providerName, Map<String, String> config) {
+        this.id = id;
+        this.providerName = providerName;
+        if (config != null) {
+           this.config.putAll(config);
+        }
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public void setProviderName(String providerName) {
+        this.providerName = providerName;
+    }
+
+    public Map<String, String> getConfig() {
+        return config;
+    }
+
+    public void setConfig(Map<String, String> config) {
+        this.config = config;
+    }
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationSpi.java b/model/api/src/main/java/org/keycloak/models/UserFederationSpi.java
new file mode 100755
index 0000000..6a22337
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserFederationSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "userFederation";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return UserFederationProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return UserFederationProviderFactory.class;
+    }
+
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserModel.java b/model/api/src/main/java/org/keycloak/models/UserModel.java
index 3a7bd0b..52f398e 100755
--- a/model/api/src/main/java/org/keycloak/models/UserModel.java
+++ b/model/api/src/main/java/org/keycloak/models/UserModel.java
@@ -9,16 +9,16 @@ import java.util.Set;
  * @version $Revision: 1 $
  */
 public interface UserModel {
-    public static final String LOGIN_NAME = "username";
+    public static final String USERNAME = "username";
     public static final String LAST_NAME = "lastName";
     public static final String FIRST_NAME = "firstName";
     public static final String EMAIL = "email";
 
     String getId();
 
-    String getLoginName();
+    String getUsername();
 
-    void setLoginName(String loginName);
+    void setUsername(String username);
 
     boolean isEnabled();
 
@@ -58,9 +58,6 @@ public interface UserModel {
 
     void setTotp(boolean totp);
 
-    int getNotBefore();
-    void setNotBefore(int notBefore);
-
     void updateCredential(UserCredentialModel cred);
 
     List<UserCredentialValueModel> getCredentialsDirectly();
@@ -80,6 +77,9 @@ public interface UserModel {
     Set<RoleModel> getRoleMappings();
     void deleteRoleMapping(RoleModel role);
 
+    String getFederationLink();
+    void setFederationLink(String link);
+
 
 
 

diff --git a/model/api/src/main/java/org/keycloak/models/UserProvider.java b/model/api/src/main/java/org/keycloak/models/UserProvider.java
new file mode 100755
index 0000000..0e063d1
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserProvider.java
@@ -0,0 +1,43 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserProvider extends Provider {
+    // Note: The reason there are so many query methods here is for layering a cache on top of an persistent KeycloakSession
+
+    UserModel addUser(RealmModel realm, String id, String username, boolean addDefaultRoles);
+    UserModel addUser(RealmModel realm, String username);
+    boolean removeUser(RealmModel realm, UserModel user);
+
+    public void addSocialLink(RealmModel realm, UserModel user, SocialLinkModel socialLink);
+    public boolean removeSocialLink(RealmModel realm, UserModel user, String socialProvider);
+
+    UserModel getUserById(String id, RealmModel realm);
+    UserModel getUserByUsername(String username, RealmModel realm);
+    UserModel getUserByEmail(String email, RealmModel realm);
+    UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm);
+    List<UserModel> getUsers(RealmModel realm);
+    int getUsersCount(RealmModel realm);
+    List<UserModel> getUsers(RealmModel realm, int firstResult, int maxResults);
+    List<UserModel> searchForUser(String search, RealmModel realm);
+    List<UserModel> searchForUser(String search, RealmModel realm, int firstResult, int maxResults);
+    List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm);
+    List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm, int firstResult, int maxResults);
+    Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm);
+    SocialLinkModel getSocialLink(UserModel user, String socialProvider, RealmModel realm);
+
+    void preRemove(RealmModel realm);
+    void preRemove(RealmModel realm, RoleModel role);
+
+    boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input);
+    boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input);
+    void close();
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserProviderFactory.java b/model/api/src/main/java/org/keycloak/models/UserProviderFactory.java
new file mode 100755
index 0000000..f052e39
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserProviderFactory.java
@@ -0,0 +1,10 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserProviderFactory extends ProviderFactory<UserProvider> {
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserSessionModel.java b/model/api/src/main/java/org/keycloak/models/UserSessionModel.java
index ada5899..e7ce35c 100755
--- a/model/api/src/main/java/org/keycloak/models/UserSessionModel.java
+++ b/model/api/src/main/java/org/keycloak/models/UserSessionModel.java
@@ -1,7 +1,6 @@
 package org.keycloak.models;
 
 import java.util.List;
-import java.util.Set;
 
 /**
  * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
@@ -16,10 +15,22 @@ public interface UserSessionModel {
 
     void setUser(UserModel user);
 
+    String getLoginUsername();
+
+    void setLoginUsername(String loginUsername);
+
     String getIpAddress();
 
     void setIpAddress(String ipAddress);
 
+    String getAuthMethod();
+
+    void setAuthMethod(String authMethod);
+
+    boolean isRememberMe();
+
+    void setRememberMe(boolean rememberMe);
+
     int getStarted();
 
     void setStarted(int started);
@@ -33,4 +44,5 @@ public interface UserSessionModel {
     List<ClientModel> getClientAssociations();
 
     void removeAssociatedClient(ClientModel client);
+
 }

diff --git a/model/api/src/main/java/org/keycloak/models/UserSessionProvider.java b/model/api/src/main/java/org/keycloak/models/UserSessionProvider.java
new file mode 100755
index 0000000..d91061d
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserSessionProvider.java
@@ -0,0 +1,34 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserSessionProvider extends Provider {
+
+    UserSessionModel createUserSession(RealmModel realm, UserModel user, String loginUsername, String ipAddress, String authMethod, boolean rememberMe);
+    UserSessionModel getUserSession(RealmModel realm, String id);
+    List<UserSessionModel> getUserSessions(RealmModel realm, UserModel user);
+    List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client);
+    List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client, int firstResult, int maxResults);
+    int getActiveUserSessions(RealmModel realm, ClientModel client);
+    void removeUserSession(RealmModel realm, UserSessionModel session);
+    void removeUserSessions(RealmModel realm, UserModel user);
+    void removeExpiredUserSessions(RealmModel realm);
+    void removeUserSessions(RealmModel realm);
+
+    UsernameLoginFailureModel getUserLoginFailure(RealmModel realm, String username);
+    UsernameLoginFailureModel addUserLoginFailure(RealmModel realm, String username);
+    List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm);
+
+    void onRealmRemoved(RealmModel realm);
+    void onClientRemoved(RealmModel realm, ClientModel client);
+    void onUserRemoved(RealmModel realm, UserModel user);
+
+    void close();
+
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserSessionProviderFactory.java b/model/api/src/main/java/org/keycloak/models/UserSessionProviderFactory.java
new file mode 100755
index 0000000..5e57609
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserSessionProviderFactory.java
@@ -0,0 +1,10 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserSessionProviderFactory extends ProviderFactory<UserSessionProvider> {
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserSessionSpi.java b/model/api/src/main/java/org/keycloak/models/UserSessionSpi.java
new file mode 100644
index 0000000..e470db5
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserSessionSpi.java
@@ -0,0 +1,29 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSessionSpi implements Spi {
+
+    public static final String NAME = "userSessions";
+
+    @Override
+    public String getName() {
+        return NAME;
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return UserSessionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return UserSessionProviderFactory.class;
+    }
+
+}

diff --git a/model/api/src/main/java/org/keycloak/models/UserSpi.java b/model/api/src/main/java/org/keycloak/models/UserSpi.java
new file mode 100755
index 0000000..e68299c
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/UserSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "user";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return UserProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return UserProviderFactory.class;
+    }
+
+}

diff --git a/model/api/src/main/java/org/keycloak/models/utils/CredentialValidation.java b/model/api/src/main/java/org/keycloak/models/utils/CredentialValidation.java
new file mode 100755
index 0000000..901571f
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/utils/CredentialValidation.java
@@ -0,0 +1,130 @@
+package org.keycloak.models.utils;
+
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class CredentialValidation {
+
+    private static int hashIterations(RealmModel realm) {
+        PasswordPolicy policy = realm.getPasswordPolicy();
+        if (policy != null) {
+            return policy.getHashIterations();
+        }
+        return -1;
+
+    }
+
+    /**
+     * Will update password if hash iteration policy has changed
+     *
+     * @param realm
+     * @param user
+     * @param password
+     * @return
+     */
+    public static boolean validPassword(RealmModel realm, UserModel user, String password) {
+        boolean validated = false;
+        UserCredentialValueModel passwordCred = null;
+        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
+            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                validated = new Pbkdf2PasswordEncoder(cred.getSalt()).verify(password, cred.getValue(), cred.getHashIterations());
+                passwordCred = cred;
+            }
+        }
+        if (validated) {
+            int iterations = hashIterations(realm);
+            if (iterations > -1 && iterations != passwordCred.getHashIterations()) {
+                UserCredentialValueModel newCred = new UserCredentialValueModel();
+                newCred.setType(passwordCred.getType());
+                newCred.setDevice(passwordCred.getDevice());
+                newCred.setSalt(passwordCred.getSalt());
+                newCred.setHashIterations(iterations);
+                newCred.setValue(new Pbkdf2PasswordEncoder(newCred.getSalt()).encode(password, iterations));
+                user.updateCredentialDirectly(newCred);
+            }
+
+        }
+        return validated;
+
+    }
+
+    public static boolean validTOTP(RealmModel realm, UserModel user, String otp) {
+        UserCredentialValueModel passwordCred = null;
+        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
+            if (cred.getType().equals(UserCredentialModel.TOTP)) {
+                if (new TimeBasedOTP().validate(otp, cred.getValue().getBytes())) {
+                    return true;
+                }
+            }
+        }
+        return false;
+
+    }
+    public static boolean validSecret(RealmModel realm, UserModel user, String secret) {
+        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
+            if (cred.getType().equals(UserCredentialModel.SECRET)) {
+                if (cred.getValue().equals(secret)) return true;
+            }
+        }
+        return false;
+
+    }
+
+    /**
+     * Must validate all credentials.  FYI, password hashes may be rehashed and updated based on realm hash password policies.
+     *
+     * @param realm
+     * @param user
+     * @param credentials
+     * @return
+     */
+    public static boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> credentials) {
+        for (UserCredentialModel credential : credentials) {
+            if (!validCredential(realm, user, credential)) return false;
+        }
+        return true;
+    }
+
+    /**
+     * Must validate all credentials.  FYI, password hashes may be rehashed and updated based on realm hash password policies.
+     *
+     * @param realm
+     * @param user
+     * @param credentials
+     * @return
+     */
+    public static boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... credentials) {
+        for (UserCredentialModel credential : credentials) {
+            if (!validCredential(realm, user, credential)) return false;
+        }
+        return true;
+    }
+
+    private static boolean validCredential(RealmModel realm, UserModel user, UserCredentialModel credential) {
+        if (credential.getType().equals(UserCredentialModel.PASSWORD)) {
+            if (!validPassword(realm, user, credential.getValue())) {
+                return false;
+            }
+        } else if (credential.getType().equals(UserCredentialModel.TOTP)) {
+            if (!validTOTP(realm, user, credential.getValue())) {
+                return false;
+            }
+        } else if (credential.getType().equals(UserCredentialModel.SECRET)) {
+            if (!validSecret(realm, user, credential.getValue())) {
+                return false;
+            }
+        } else {
+            return false;
+        }
+        return true;
+    }
+}

diff --git a/model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java b/model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
old mode 100644
new mode 100755
index 939eeba..4a00ff9
--- a/model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
+++ b/model/api/src/main/java/org/keycloak/models/utils/KeycloakModelUtils.java
@@ -1,19 +1,25 @@
 package org.keycloak.models.utils;
 
+import org.bouncycastle.openssl.PEMWriter;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.util.PemUtils;
+
 import java.io.IOException;
 import java.io.StringWriter;
 import java.security.Key;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.util.Set;
 import java.util.UUID;
-import java.util.concurrent.atomic.AtomicLong;
-
-import org.bouncycastle.openssl.PEMWriter;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.util.PemUtils;
 
 /**
  * Set of helper methods, which are useful in various model implementations.
@@ -65,6 +71,30 @@ public final class KeycloakModelUtils {
         return PemUtils.removeBeginEnd(s);
     }
 
+    public static void generateRealmKeys(RealmModel realm) {
+        KeyPair keyPair = null;
+        try {
+            keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair();
+        } catch (NoSuchAlgorithmException e) {
+            throw new RuntimeException(e);
+        }
+        realm.setPrivateKey(keyPair.getPrivate());
+        realm.setPublicKey(keyPair.getPublic());
+    }
+
+    public static UserCredentialModel generateSecret(ClientModel app) {
+        UserCredentialModel secret = UserCredentialModel.generateSecret();
+        app.setSecret(secret.getValue());
+        return secret;
+    }
+
+    public static ApplicationModel createApplication(RealmModel realm, String name) {
+        ApplicationModel app = realm.addApplication(name);
+        generateSecret(app);
+
+        return app;
+    }
+
     /**
      * Deep search if given role is descendant of composite role
      *
@@ -92,10 +122,10 @@ public final class KeycloakModelUtils {
      * @param username username or email of user
      * @return found user
      */
-    public static UserModel findUserByNameOrEmail(RealmModel realm, String username) {
-        UserModel user = realm.getUser(username);
+    public static UserModel findUserByNameOrEmail(KeycloakSession session, RealmModel realm, String username) {
+        UserModel user = session.users().getUserByUsername(username, realm);
         if (user == null && username.contains("@")) {
-            user = realm.getUserByEmail(username);
+            user =  session.users().getUserByEmail(username, realm);
         }
         return user;
     }

diff --git a/model/api/src/main/java/org/keycloak/models/utils/Pbkdf2PasswordEncoder.java b/model/api/src/main/java/org/keycloak/models/utils/Pbkdf2PasswordEncoder.java
index 33c7c41..32f0d15 100755
--- a/model/api/src/main/java/org/keycloak/models/utils/Pbkdf2PasswordEncoder.java
+++ b/model/api/src/main/java/org/keycloak/models/utils/Pbkdf2PasswordEncoder.java
@@ -43,7 +43,7 @@ public class Pbkdf2PasswordEncoder {
      * @param rawPassword The password used as a master key to derive into a session key
      * @return encoded password in Base64
      */
-    public String encode(String rawPassword) {
+    public String encode(String rawPassword, int iterations) {
 
         String encodedPassword;
 
@@ -59,6 +59,10 @@ public class Pbkdf2PasswordEncoder {
         return encodedPassword;
     }
 
+    public String encode(String rawPassword) {
+        return encode(rawPassword, iterations);
+    }
+
     /**
      * Encode the password provided and compare with the hash stored into the database
      * @param rawPassword The password provided
@@ -70,6 +74,16 @@ public class Pbkdf2PasswordEncoder {
     }
 
     /**
+     * Encode the password provided and compare with the hash stored into the database
+     * @param rawPassword The password provided
+     * @param encodedPassword Encoded hash stored into the database
+     * @return true if the password is valid, otherwise false for invalid credentials
+     */
+    public boolean verify(String rawPassword, String encodedPassword, int iterations) {
+        return encode(rawPassword, iterations).equals(encodedPassword);
+    }
+
+    /**
      * Generate a salt for each password
      * @return cryptographically strong random number
      */

diff --git a/model/api/src/main/java/org/keycloak/models/utils/reflection/Properties.java b/model/api/src/main/java/org/keycloak/models/utils/reflection/Properties.java
old mode 100644
new mode 100755
index 3348d8b..fd7c06b
--- a/model/api/src/main/java/org/keycloak/models/utils/reflection/Properties.java
+++ b/model/api/src/main/java/org/keycloak/models/utils/reflection/Properties.java
@@ -1,7 +1,5 @@
 package org.keycloak.models.utils.reflection;
 
-import java.lang.reflect.Field;
-import java.lang.reflect.Member;
 import java.lang.reflect.Method;
 
 /**

diff --git a/model/api/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java b/model/api/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
old mode 100644
new mode 100755
index 2d2c41d..604b83b
--- a/model/api/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
+++ b/model/api/src/main/java/org/keycloak/models/utils/reflection/PropertyCriteria.java
@@ -1,6 +1,5 @@
 package org.keycloak.models.utils.reflection;
 
-import java.lang.reflect.Field;
 import java.lang.reflect.Method;
 
 /**

diff --git a/model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java b/model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
new file mode 100755
index 0000000..6b3ec2d
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/utils/RepresentationToModel.java
@@ -0,0 +1,702 @@
+package org.keycloak.models.utils;
+
+import net.iharder.Base64;
+import org.jboss.logging.Logger;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.ClaimMask;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.representations.idm.UserFederationProviderRepresentation;
+import org.keycloak.representations.idm.ApplicationRepresentation;
+import org.keycloak.representations.idm.AuthenticationLinkRepresentation;
+import org.keycloak.representations.idm.AuthenticationProviderRepresentation;
+import org.keycloak.representations.idm.ClaimRepresentation;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.representations.idm.OAuthClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.RoleRepresentation;
+import org.keycloak.representations.idm.ScopeMappingRepresentation;
+import org.keycloak.representations.idm.SocialLinkRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+
+import java.io.IOException;
+import java.net.URI;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+public class RepresentationToModel {
+
+    private static Logger logger = Logger.getLogger(RepresentationToModel.class);
+
+    public static void importRealm(KeycloakSession session, RealmRepresentation rep, RealmModel newRealm) {
+        newRealm.setName(rep.getRealm());
+        if (rep.isEnabled() != null) newRealm.setEnabled(rep.isEnabled());
+        if (rep.isSocial() != null) newRealm.setSocial(rep.isSocial());
+        if (rep.isBruteForceProtected() != null) newRealm.setBruteForceProtected(rep.isBruteForceProtected());
+        if (rep.getMaxFailureWaitSeconds() != null) newRealm.setMaxFailureWaitSeconds(rep.getMaxFailureWaitSeconds());
+        if (rep.getMinimumQuickLoginWaitSeconds() != null) newRealm.setMinimumQuickLoginWaitSeconds(rep.getMinimumQuickLoginWaitSeconds());
+        if (rep.getWaitIncrementSeconds() != null) newRealm.setWaitIncrementSeconds(rep.getWaitIncrementSeconds());
+        if (rep.getQuickLoginCheckMilliSeconds() != null) newRealm.setQuickLoginCheckMilliSeconds(rep.getQuickLoginCheckMilliSeconds());
+        if (rep.getMaxDeltaTimeSeconds() != null) newRealm.setMaxDeltaTimeSeconds(rep.getMaxDeltaTimeSeconds());
+        if (rep.getFailureFactor() != null) newRealm.setFailureFactor(rep.getFailureFactor());
+
+        if (rep.getNotBefore() != null) newRealm.setNotBefore(rep.getNotBefore());
+
+        if (rep.getAccessTokenLifespan() != null) newRealm.setAccessTokenLifespan(rep.getAccessTokenLifespan());
+        else newRealm.setAccessTokenLifespan(300);
+
+        if (rep.getSsoSessionIdleTimeout() != null) newRealm.setSsoSessionIdleTimeout(rep.getSsoSessionIdleTimeout());
+        else newRealm.setSsoSessionIdleTimeout(600);
+        if (rep.getSsoSessionMaxLifespan() != null) newRealm.setSsoSessionMaxLifespan(rep.getSsoSessionMaxLifespan());
+        else newRealm.setSsoSessionMaxLifespan(36000);
+
+        if (rep.getAccessCodeLifespan() != null) newRealm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
+        else newRealm.setAccessCodeLifespan(60);
+
+        if (rep.getAccessCodeLifespanUserAction() != null)
+            newRealm.setAccessCodeLifespanUserAction(rep.getAccessCodeLifespanUserAction());
+        else newRealm.setAccessCodeLifespanUserAction(300);
+
+        if (rep.isSslNotRequired() != null) newRealm.setSslNotRequired(rep.isSslNotRequired());
+        if (rep.isPasswordCredentialGrantAllowed() != null) newRealm.setPasswordCredentialGrantAllowed(rep.isPasswordCredentialGrantAllowed());
+        if (rep.isRegistrationAllowed() != null) newRealm.setRegistrationAllowed(rep.isRegistrationAllowed());
+        if (rep.isRememberMe() != null) newRealm.setRememberMe(rep.isRememberMe());
+        if (rep.isVerifyEmail() != null) newRealm.setVerifyEmail(rep.isVerifyEmail());
+        if (rep.isResetPasswordAllowed() != null) newRealm.setResetPasswordAllowed(rep.isResetPasswordAllowed());
+        if (rep.isUpdateProfileOnInitialSocialLogin() != null)
+            newRealm.setUpdateProfileOnInitialSocialLogin(rep.isUpdateProfileOnInitialSocialLogin());
+        if (rep.getPrivateKey() == null || rep.getPublicKey() == null) {
+            KeycloakModelUtils.generateRealmKeys(newRealm);
+        } else {
+            newRealm.setPrivateKeyPem(rep.getPrivateKey());
+            newRealm.setPublicKeyPem(rep.getPublicKey());
+        }
+        if (rep.getLoginTheme() != null) newRealm.setLoginTheme(rep.getLoginTheme());
+        if (rep.getAccountTheme() != null) newRealm.setAccountTheme(rep.getAccountTheme());
+        if (rep.getAdminTheme() != null) newRealm.setAdminTheme(rep.getAdminTheme());
+        if (rep.getEmailTheme() != null) newRealm.setEmailTheme(rep.getEmailTheme());
+
+        if (rep.getRequiredCredentials() != null) {
+            for (String requiredCred : rep.getRequiredCredentials()) {
+                addRequiredCredential(newRealm, requiredCred);
+            }
+        } else {
+            addRequiredCredential(newRealm, CredentialRepresentation.PASSWORD);
+        }
+
+        if (rep.getPasswordPolicy() != null) newRealm.setPasswordPolicy(new PasswordPolicy(rep.getPasswordPolicy()));
+
+        if (rep.getApplications() != null) {
+            Map<String, ApplicationModel> appMap = createApplications(rep, newRealm);
+        }
+
+        if (rep.getRoles() != null) {
+            if (rep.getRoles().getRealm() != null) { // realm roles
+                for (RoleRepresentation roleRep : rep.getRoles().getRealm()) {
+                    createRole(newRealm, roleRep);
+                }
+            }
+            if (rep.getRoles().getApplication() != null) {
+                for (Map.Entry<String, List<RoleRepresentation>> entry : rep.getRoles().getApplication().entrySet()) {
+                    ApplicationModel app = newRealm.getApplicationByName(entry.getKey());
+                    if (app == null) {
+                        throw new RuntimeException("App doesn't exist in role definitions: " + entry.getKey());
+                    }
+                    for (RoleRepresentation roleRep : entry.getValue()) {
+                        // Application role may already exists (for example if it is defaultRole)
+                        RoleModel role = roleRep.getId()!=null ? app.addRole(roleRep.getId(), roleRep.getName()) : app.addRole(roleRep.getName());
+                        role.setDescription(roleRep.getDescription());
+                    }
+                }
+            }
+            // now that all roles are created, re-iterate and set up composites
+            if (rep.getRoles().getRealm() != null) { // realm roles
+                for (RoleRepresentation roleRep : rep.getRoles().getRealm()) {
+                    RoleModel role = newRealm.getRole(roleRep.getName());
+                    addComposites(role, roleRep, newRealm);
+                }
+            }
+            if (rep.getRoles().getApplication() != null) {
+                for (Map.Entry<String, List<RoleRepresentation>> entry : rep.getRoles().getApplication().entrySet()) {
+                    ApplicationModel app = newRealm.getApplicationByName(entry.getKey());
+                    if (app == null) {
+                        throw new RuntimeException("App doesn't exist in role definitions: " + entry.getKey());
+                    }
+                    for (RoleRepresentation roleRep : entry.getValue()) {
+                        RoleModel role = app.getRole(roleRep.getName());
+                        addComposites(role, roleRep, newRealm);
+                    }
+                }
+            }
+        }
+
+        // Setup realm default roles
+        if (rep.getDefaultRoles() != null) {
+            for (String roleString : rep.getDefaultRoles()) {
+                newRealm.addDefaultRole(roleString.trim());
+            }
+        }
+        // Setup application default roles
+        if (rep.getApplications() != null) {
+            for (ApplicationRepresentation resourceRep : rep.getApplications()) {
+                if (resourceRep.getDefaultRoles() != null) {
+                    ApplicationModel appModel = newRealm.getApplicationByName(resourceRep.getName());
+                    appModel.updateDefaultRoles(resourceRep.getDefaultRoles());
+                }
+            }
+        }
+
+        if (rep.getOauthClients() != null) {
+            createOAuthClients(rep, newRealm);
+        }
+
+
+        // Now that all possible roles and applications are created, create scope mappings
+
+        Map<String, ApplicationModel> appMap = newRealm.getApplicationNameMap();
+
+        if (rep.getApplicationScopeMappings() != null) {
+
+            for (Map.Entry<String, List<ScopeMappingRepresentation>> entry : rep.getApplicationScopeMappings().entrySet()) {
+                ApplicationModel app = appMap.get(entry.getKey());
+                if (app == null) {
+                    throw new RuntimeException("Unable to find application role mappings for app: " + entry.getKey());
+                }
+                createApplicationScopeMappings(newRealm, app, entry.getValue());
+            }
+        }
+
+        if (rep.getScopeMappings() != null) {
+            for (ScopeMappingRepresentation scope : rep.getScopeMappings()) {
+                ClientModel client = newRealm.findClient(scope.getClient());
+                for (String roleString : scope.getRoles()) {
+                    RoleModel role = newRealm.getRole(roleString.trim());
+                    if (role == null) {
+                        role = newRealm.addRole(roleString.trim());
+                    }
+                    client.addScopeMapping(role);
+                }
+
+            }
+        }
+
+        if (rep.getSmtpServer() != null) {
+            newRealm.setSmtpConfig(new HashMap(rep.getSmtpServer()));
+        }
+
+        if (rep.getSocialProviders() != null) {
+            newRealm.setSocialConfig(new HashMap(rep.getSocialProviders()));
+        }
+        if (rep.getLdapServer() != null) {
+            newRealm.setLdapServerConfig(new HashMap(rep.getLdapServer()));
+        }
+
+        if (rep.getAuthenticationProviders() != null) {
+            List<AuthenticationProviderModel> authProviderModels = convertAuthenticationProviders(rep.getAuthenticationProviders());
+            newRealm.setAuthenticationProviders(authProviderModels);
+        }  else {
+            List<AuthenticationProviderModel> authProviderModels = Arrays.asList(AuthenticationProviderModel.DEFAULT_PROVIDER);
+            newRealm.setAuthenticationProviders(authProviderModels);
+        }
+
+        if (rep.getUserFederationProviders() != null) {
+            List<UserFederationProviderModel> providerModels = convertFederationProviders(rep.getUserFederationProviders());
+            newRealm.setUserFederationProviders(providerModels);
+        }
+
+        // create users and their role mappings and social mappings
+
+        if (rep.getUsers() != null) {
+            for (UserRepresentation userRep : rep.getUsers()) {
+                UserModel user = createUser(session, newRealm, userRep, appMap);
+            }
+        }
+    }
+
+    public static void updateRealm(RealmRepresentation rep, RealmModel realm) {
+        if (rep.getRealm() != null) {
+            realm.setName(rep.getRealm());
+        }
+        if (rep.isEnabled() != null) realm.setEnabled(rep.isEnabled());
+        if (rep.isSocial() != null) realm.setSocial(rep.isSocial());
+        if (rep.isBruteForceProtected() != null) realm.setBruteForceProtected(rep.isBruteForceProtected());
+        if (rep.getMaxFailureWaitSeconds() != null) realm.setMaxFailureWaitSeconds(rep.getMaxFailureWaitSeconds());
+        if (rep.getMinimumQuickLoginWaitSeconds() != null) realm.setMinimumQuickLoginWaitSeconds(rep.getMinimumQuickLoginWaitSeconds());
+        if (rep.getWaitIncrementSeconds() != null) realm.setWaitIncrementSeconds(rep.getWaitIncrementSeconds());
+        if (rep.getQuickLoginCheckMilliSeconds() != null) realm.setQuickLoginCheckMilliSeconds(rep.getQuickLoginCheckMilliSeconds());
+        if (rep.getMaxDeltaTimeSeconds() != null) realm.setMaxDeltaTimeSeconds(rep.getMaxDeltaTimeSeconds());
+        if (rep.getFailureFactor() != null) realm.setFailureFactor(rep.getFailureFactor());
+        if (rep.isPasswordCredentialGrantAllowed() != null) realm.setPasswordCredentialGrantAllowed(rep.isPasswordCredentialGrantAllowed());
+        if (rep.isRegistrationAllowed() != null) realm.setRegistrationAllowed(rep.isRegistrationAllowed());
+        if (rep.isRememberMe() != null) realm.setRememberMe(rep.isRememberMe());
+        if (rep.isVerifyEmail() != null) realm.setVerifyEmail(rep.isVerifyEmail());
+        if (rep.isResetPasswordAllowed() != null) realm.setResetPasswordAllowed(rep.isResetPasswordAllowed());
+        if (rep.isUpdateProfileOnInitialSocialLogin() != null)
+            realm.setUpdateProfileOnInitialSocialLogin(rep.isUpdateProfileOnInitialSocialLogin());
+        if (rep.isSslNotRequired() != null) realm.setSslNotRequired((rep.isSslNotRequired()));
+        if (rep.getAccessCodeLifespan() != null) realm.setAccessCodeLifespan(rep.getAccessCodeLifespan());
+        if (rep.getAccessCodeLifespanUserAction() != null)
+            realm.setAccessCodeLifespanUserAction(rep.getAccessCodeLifespanUserAction());
+        if (rep.getNotBefore() != null) realm.setNotBefore(rep.getNotBefore());
+        if (rep.getAccessTokenLifespan() != null) realm.setAccessTokenLifespan(rep.getAccessTokenLifespan());
+        if (rep.getSsoSessionIdleTimeout() != null) realm.setSsoSessionIdleTimeout(rep.getSsoSessionIdleTimeout());
+        if (rep.getSsoSessionMaxLifespan() != null) realm.setSsoSessionMaxLifespan(rep.getSsoSessionMaxLifespan());
+        if (rep.getRequiredCredentials() != null) {
+            realm.updateRequiredCredentials(rep.getRequiredCredentials());
+        }
+        if (rep.getLoginTheme() != null) realm.setLoginTheme(rep.getLoginTheme());
+        if (rep.getAccountTheme() != null) realm.setAccountTheme(rep.getAccountTheme());
+        if (rep.getAdminTheme() != null) realm.setAdminTheme(rep.getAdminTheme());
+        if (rep.getEmailTheme() != null) realm.setEmailTheme(rep.getEmailTheme());
+
+        if (rep.getPasswordPolicy() != null) realm.setPasswordPolicy(new PasswordPolicy(rep.getPasswordPolicy()));
+
+        if (rep.getDefaultRoles() != null) {
+            realm.updateDefaultRoles(rep.getDefaultRoles().toArray(new String[rep.getDefaultRoles().size()]));
+        }
+
+        if (rep.getSmtpServer() != null) {
+            realm.setSmtpConfig(new HashMap(rep.getSmtpServer()));
+        }
+
+        if (rep.getSocialProviders() != null) {
+            realm.setSocialConfig(new HashMap(rep.getSocialProviders()));
+        }
+
+        if (rep.getLdapServer() != null) {
+            realm.setLdapServerConfig(new HashMap(rep.getLdapServer()));
+        }
+        if (rep.getAuthenticationProviders() != null) {
+            List<AuthenticationProviderModel> authProviderModels = convertAuthenticationProviders(rep.getAuthenticationProviders());
+            realm.setAuthenticationProviders(authProviderModels);
+        }
+
+        if (rep.getUserFederationProviders() != null) {
+            List<UserFederationProviderModel> providerModels = convertFederationProviders(rep.getUserFederationProviders());
+            realm.setUserFederationProviders(providerModels);
+        }
+
+        if ("GENERATE".equals(rep.getPublicKey())) {
+            KeycloakModelUtils.generateRealmKeys(realm);
+        }
+    }
+
+    // Basic realm stuff
+
+    public static void addRequiredCredential(RealmModel newRealm, String requiredCred) {
+        newRealm.addRequiredCredential(requiredCred);
+    }
+
+
+    private static List<AuthenticationProviderModel> convertAuthenticationProviders(List<AuthenticationProviderRepresentation> authenticationProviders) {
+        List<AuthenticationProviderModel> result = new ArrayList<AuthenticationProviderModel>();
+
+        for (AuthenticationProviderRepresentation representation : authenticationProviders) {
+            AuthenticationProviderModel model = new AuthenticationProviderModel(representation.getProviderName(),
+                    representation.isPasswordUpdateSupported(), representation.getConfig());
+            result.add(model);
+        }
+        return result;
+    }
+
+    private static List<UserFederationProviderModel> convertFederationProviders(List<UserFederationProviderRepresentation> providers) {
+        List<UserFederationProviderModel> result = new ArrayList<UserFederationProviderModel>();
+
+        for (UserFederationProviderRepresentation representation : providers) {
+            UserFederationProviderModel model = new UserFederationProviderModel(representation.getId(), representation.getProviderName(),
+                    representation.getConfig());
+            result.add(model);
+        }
+        return result;
+    }
+
+    // Roles
+
+    public static void createRole(RealmModel newRealm, RoleRepresentation roleRep) {
+        RoleModel role = roleRep.getId()!=null ? newRealm.addRole(roleRep.getId(), roleRep.getName()) : newRealm.addRole(roleRep.getName());
+        if (roleRep.getDescription() != null) role.setDescription(roleRep.getDescription());
+    }
+
+    private static void addComposites(RoleModel role, RoleRepresentation roleRep, RealmModel realm) {
+        if (roleRep.getComposites() == null) return;
+        if (roleRep.getComposites().getRealm() != null) {
+            for (String roleStr : roleRep.getComposites().getRealm()) {
+                RoleModel realmRole = realm.getRole(roleStr);
+                if (realmRole == null) throw new RuntimeException("Unable to find composite realm role: " + roleStr);
+                role.addCompositeRole(realmRole);
+            }
+        }
+        if (roleRep.getComposites().getApplication() != null) {
+            for (Map.Entry<String, List<String>> entry : roleRep.getComposites().getApplication().entrySet()) {
+                ApplicationModel app = realm.getApplicationByName(entry.getKey());
+                if (app == null) {
+                    throw new RuntimeException("App doesn't exist in role definitions: " + roleRep.getName());
+                }
+                for (String roleStr : entry.getValue()) {
+                    RoleModel appRole = app.getRole(roleStr);
+                    if (appRole == null) throw new RuntimeException("Unable to find composite app role: " + roleStr);
+                    role.addCompositeRole(appRole);
+                }
+
+            }
+
+        }
+
+    }
+
+    // APPLICATIONS
+
+    private static Map<String, ApplicationModel> createApplications(RealmRepresentation rep, RealmModel realm) {
+        Map<String, ApplicationModel> appMap = new HashMap<String, ApplicationModel>();
+        for (ApplicationRepresentation resourceRep : rep.getApplications()) {
+            ApplicationModel app = createApplication(realm, resourceRep, false);
+            appMap.put(app.getName(), app);
+        }
+        return appMap;
+    }
+
+    /**
+     * Does not create scope or role mappings!
+     *
+     * @param realm
+     * @param resourceRep
+     * @return
+     */
+    public static ApplicationModel createApplication(RealmModel realm, ApplicationRepresentation resourceRep, boolean addDefaultRoles) {
+        logger.debug("************ CREATE APPLICATION: {0}" + resourceRep.getName());
+        ApplicationModel applicationModel = resourceRep.getId()!=null ? realm.addApplication(resourceRep.getId(), resourceRep.getName()) : realm.addApplication(resourceRep.getName());
+        if (resourceRep.isEnabled() != null) applicationModel.setEnabled(resourceRep.isEnabled());
+        applicationModel.setManagementUrl(resourceRep.getAdminUrl());
+        if (resourceRep.isSurrogateAuthRequired() != null)
+            applicationModel.setSurrogateAuthRequired(resourceRep.isSurrogateAuthRequired());
+        applicationModel.setBaseUrl(resourceRep.getBaseUrl());
+        if (resourceRep.isBearerOnly() != null) applicationModel.setBearerOnly(resourceRep.isBearerOnly());
+        if (resourceRep.isPublicClient() != null) applicationModel.setPublicClient(resourceRep.isPublicClient());
+        applicationModel.updateApplication();
+
+        if (resourceRep.getNotBefore() != null) {
+            applicationModel.setNotBefore(resourceRep.getNotBefore());
+        }
+
+        applicationModel.setSecret(resourceRep.getSecret());
+        if (applicationModel.getSecret() == null) {
+            KeycloakModelUtils.generateSecret(applicationModel);
+        }
+
+
+        if (resourceRep.getRedirectUris() != null) {
+            for (String redirectUri : resourceRep.getRedirectUris()) {
+                applicationModel.addRedirectUri(redirectUri);
+            }
+        }
+        if (resourceRep.getWebOrigins() != null) {
+            for (String webOrigin : resourceRep.getWebOrigins()) {
+                logger.debugv("Application: {0} webOrigin: {1}", resourceRep.getName(), webOrigin);
+                applicationModel.addWebOrigin(webOrigin);
+            }
+        } else {
+            // add origins from redirect uris
+            if (resourceRep.getRedirectUris() != null) {
+                Set<String> origins = new HashSet<String>();
+                for (String redirectUri : resourceRep.getRedirectUris()) {
+                    logger.info("add redirectUri to origin: " + redirectUri);
+                    if (redirectUri.startsWith("http:")) {
+                        URI uri = URI.create(redirectUri);
+                        String origin = uri.getScheme() + "://" + uri.getHost();
+                        if (uri.getPort() != -1) {
+                            origin += ":" + uri.getPort();
+                        }
+                        logger.debugv("adding default application origin: {0}" , origin);
+                        origins.add(origin);
+                    }
+                }
+                if (origins.size() > 0) {
+                    applicationModel.setWebOrigins(origins);
+                }
+            }
+        }
+
+        if (addDefaultRoles && resourceRep.getDefaultRoles() != null) {
+            applicationModel.updateDefaultRoles(resourceRep.getDefaultRoles());
+        }
+
+        if (resourceRep.getClaims() != null) {
+            setClaims(applicationModel, resourceRep.getClaims());
+        } else {
+            applicationModel.setAllowedClaimsMask(ClaimMask.USERNAME);
+        }
+
+        return applicationModel;
+    }
+
+    public static void updateApplication(ApplicationRepresentation rep, ApplicationModel resource) {
+        if (rep.getName() != null) resource.setName(rep.getName());
+        if (rep.isEnabled() != null) resource.setEnabled(rep.isEnabled());
+        if (rep.isBearerOnly() != null) resource.setBearerOnly(rep.isBearerOnly());
+        if (rep.isPublicClient() != null) resource.setPublicClient(rep.isPublicClient());
+        if (rep.getAdminUrl() != null) resource.setManagementUrl(rep.getAdminUrl());
+        if (rep.getBaseUrl() != null) resource.setBaseUrl(rep.getBaseUrl());
+        if (rep.isSurrogateAuthRequired() != null) resource.setSurrogateAuthRequired(rep.isSurrogateAuthRequired());
+        resource.updateApplication();
+
+        if (rep.getNotBefore() != null) {
+            resource.setNotBefore(rep.getNotBefore());
+        }
+        if (rep.getDefaultRoles() != null) {
+            resource.updateDefaultRoles(rep.getDefaultRoles());
+        }
+
+        List<String> redirectUris = rep.getRedirectUris();
+        if (redirectUris != null) {
+            resource.setRedirectUris(new HashSet<String>(redirectUris));
+        }
+
+        List<String> webOrigins = rep.getWebOrigins();
+        if (webOrigins != null) {
+            resource.setWebOrigins(new HashSet<String>(webOrigins));
+        }
+
+        if (rep.getClaims() != null) {
+            setClaims(resource, rep.getClaims());
+        }
+    }
+
+    public static void setClaims(ClientModel model, ClaimRepresentation rep) {
+        long mask = model.getAllowedClaimsMask();
+        if (rep.getAddress()) {
+            mask |= ClaimMask.ADDRESS;
+        } else {
+            mask &= ~ClaimMask.ADDRESS;
+        }
+        if (rep.getEmail()) {
+            mask |= ClaimMask.EMAIL;
+        } else {
+            mask &= ~ClaimMask.EMAIL;
+        }
+        if (rep.getGender()) {
+            mask |= ClaimMask.GENDER;
+        } else {
+            mask &= ~ClaimMask.GENDER;
+        }
+        if (rep.getLocale()) {
+            mask |= ClaimMask.LOCALE;
+        } else {
+            mask &= ~ClaimMask.LOCALE;
+        }
+        if (rep.getName()) {
+            mask |= ClaimMask.NAME;
+        } else {
+            mask &= ~ClaimMask.NAME;
+        }
+        if (rep.getPhone()) {
+            mask |= ClaimMask.PHONE;
+        } else {
+            mask &= ~ClaimMask.PHONE;
+        }
+        if (rep.getPicture()) {
+            mask |= ClaimMask.PICTURE;
+        } else {
+            mask &= ~ClaimMask.PICTURE;
+        }
+        if (rep.getProfile()) {
+            mask |= ClaimMask.PROFILE;
+        } else {
+            mask &= ~ClaimMask.PROFILE;
+        }
+        if (rep.getUsername()) {
+            mask |= ClaimMask.USERNAME;
+        } else {
+            mask &= ~ClaimMask.USERNAME;
+        }
+        if (rep.getWebsite()) {
+            mask |= ClaimMask.WEBSITE;
+        } else {
+            mask &= ~ClaimMask.WEBSITE;
+        }
+        model.setAllowedClaimsMask(mask);
+    }
+
+    // OAuth clients
+
+    private static void createOAuthClients(RealmRepresentation realmRep, RealmModel realm) {
+        for (OAuthClientRepresentation rep : realmRep.getOauthClients()) {
+            createOAuthClient(rep, realm);
+        }
+    }
+
+    public static OAuthClientModel createOAuthClient(String id, String name, RealmModel realm) {
+        OAuthClientModel model = id!=null ? realm.addOAuthClient(id, name) : realm.addOAuthClient(name);
+        KeycloakModelUtils.generateSecret(model);
+        return model;
+    }
+
+    public static OAuthClientModel createOAuthClient(OAuthClientRepresentation rep, RealmModel realm) {
+        OAuthClientModel model = createOAuthClient(rep.getId(), rep.getName(), realm);
+        updateOAuthClient(rep, model);
+        return model;
+    }
+
+    public static void updateOAuthClient(OAuthClientRepresentation rep, OAuthClientModel model) {
+        if (rep.getName() != null) model.setClientId(rep.getName());
+        if (rep.isEnabled() != null) model.setEnabled(rep.isEnabled());
+        if (rep.isPublicClient() != null) model.setPublicClient(rep.isPublicClient());
+        if (rep.isDirectGrantsOnly() != null) model.setDirectGrantsOnly(rep.isDirectGrantsOnly());
+        if (rep.getClaims() != null) {
+            setClaims(model, rep.getClaims());
+        }
+        if (rep.getNotBefore() != null) {
+            model.setNotBefore(rep.getNotBefore());
+        }
+        if (rep.getSecret() != null) model.setSecret(rep.getSecret());
+        List<String> redirectUris = rep.getRedirectUris();
+        if (redirectUris != null) {
+            model.setRedirectUris(new HashSet<String>(redirectUris));
+        }
+
+        List<String> webOrigins = rep.getWebOrigins();
+        if (webOrigins != null) {
+            model.setWebOrigins(new HashSet<String>(webOrigins));
+        }
+
+        if (rep.getClaims() != null) {
+            setClaims(model, rep.getClaims());
+        }
+
+        if (rep.getNotBefore() != null) {
+            model.setNotBefore(rep.getNotBefore());
+        }
+
+    }
+
+    // Scope mappings
+
+    public static void createApplicationScopeMappings(RealmModel realm, ApplicationModel applicationModel, List<ScopeMappingRepresentation> mappings) {
+        for (ScopeMappingRepresentation mapping : mappings) {
+            ClientModel client = realm.findClient(mapping.getClient());
+            for (String roleString : mapping.getRoles()) {
+                RoleModel role = applicationModel.getRole(roleString.trim());
+                if (role == null) {
+                    role = applicationModel.addRole(roleString.trim());
+                }
+                client.addScopeMapping(role);
+            }
+        }
+    }
+
+    // Users
+
+    public static UserModel createUser(KeycloakSession session, RealmModel newRealm, UserRepresentation userRep, Map<String, ApplicationModel> appMap) {
+        UserModel user = session.users().addUser(newRealm, userRep.getId(), userRep.getUsername(), false);
+        user.setEnabled(userRep.isEnabled());
+        user.setEmail(userRep.getEmail());
+        user.setFirstName(userRep.getFirstName());
+        user.setLastName(userRep.getLastName());
+        user.setFederationLink(userRep.getFederationLink());
+        if (userRep.getAttributes() != null) {
+            for (Map.Entry<String, String> entry : userRep.getAttributes().entrySet()) {
+                user.setAttribute(entry.getKey(), entry.getValue());
+            }
+        }
+        if (userRep.getRequiredActions() != null) {
+            for (String requiredAction : userRep.getRequiredActions()) {
+                user.addRequiredAction(UserModel.RequiredAction.valueOf(requiredAction));
+            }
+        }
+        if (userRep.getCredentials() != null) {
+            for (CredentialRepresentation cred : userRep.getCredentials()) {
+                updateCredential(user, cred);
+            }
+        }
+        if (userRep.getAuthenticationLink() != null) {
+            AuthenticationLinkRepresentation link = userRep.getAuthenticationLink();
+            AuthenticationLinkModel authLink = new AuthenticationLinkModel(link.getAuthProvider(), link.getAuthUserId());
+            user.setAuthenticationLink(authLink);
+        }
+        if (userRep.getSocialLinks() != null) {
+            for (SocialLinkRepresentation socialLink : userRep.getSocialLinks()) {
+                SocialLinkModel mappingModel = new SocialLinkModel(socialLink.getSocialProvider(), socialLink.getSocialUserId(), socialLink.getSocialUsername());
+                session.users().addSocialLink(newRealm, user, mappingModel);
+            }
+        }
+        if (userRep.getRealmRoles() != null) {
+            for (String roleString : userRep.getRealmRoles()) {
+                RoleModel role = newRealm.getRole(roleString.trim());
+                if (role == null) {
+                    role = newRealm.addRole(roleString.trim());
+                }
+                user.grantRole(role);
+            }
+        }
+        if (userRep.getApplicationRoles() != null) {
+            for (Map.Entry<String, List<String>> entry : userRep.getApplicationRoles().entrySet()) {
+                ApplicationModel app = appMap.get(entry.getKey());
+                if (app == null) {
+                    throw new RuntimeException("Unable to find application role mappings for app: " + entry.getKey());
+                }
+                createApplicationRoleMappings(app, user, entry.getValue());
+            }
+        }
+        return user;
+    }
+
+    // Detect if it is "plain-text" or "hashed" representation and update model according to it
+    private static void updateCredential(UserModel user, CredentialRepresentation cred) {
+        if (cred.getValue() != null) {
+            UserCredentialModel plainTextCred = convertCredential(cred);
+            user.updateCredential(plainTextCred);
+        } else {
+            UserCredentialValueModel hashedCred = new UserCredentialValueModel();
+            hashedCred.setType(cred.getType());
+            hashedCred.setDevice(cred.getDevice());
+            hashedCred.setHashIterations(cred.getHashIterations());
+            try {
+                hashedCred.setSalt(Base64.decode(cred.getSalt()));
+            } catch (IOException ioe) {
+                throw new RuntimeException(ioe);
+            }
+            hashedCred.setValue(cred.getHashedSaltedValue());
+            user.updateCredentialDirectly(hashedCred);
+        }
+    }
+
+    public static UserCredentialModel convertCredential(CredentialRepresentation cred) {
+        UserCredentialModel credential = new UserCredentialModel();
+        credential.setType(cred.getType());
+        credential.setValue(cred.getValue());
+        return credential;
+    }
+
+    // Role mappings
+
+    public static void createApplicationRoleMappings(ApplicationModel applicationModel, UserModel user, List<String> roleNames) {
+        if (user == null) {
+            throw new RuntimeException("User not found");
+        }
+
+        for (String roleName : roleNames) {
+            RoleModel role = applicationModel.getRole(roleName.trim());
+            if (role == null) {
+                role = applicationModel.addRole(roleName.trim());
+            }
+            user.grantRole(role);
+
+        }
+    }
+
+}

diff --git a/model/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi
old mode 100644
new mode 100755
index 48ff59e..e071894
--- a/model/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/model/api/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -1 +1,4 @@
-org.keycloak.models.ModelSpi
\ No newline at end of file
+org.keycloak.models.UserFederationSpi
+org.keycloak.models.RealmSpi
+org.keycloak.models.UserSessionSpi
+org.keycloak.models.UserSpi
\ No newline at end of file

diff --git a/model/hybrid/pom.xml b/model/hybrid/pom.xml
new file mode 100755
index 0000000..344fef3
--- /dev/null
+++ b/model/hybrid/pom.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-model-hybrid</artifactId>
+    <name>Keycloak Model Hybrid</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+   </dependencies>
+</project>

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/ApplicationAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/ApplicationAdapter.java
new file mode 100755
index 0000000..713d651
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/ApplicationAdapter.java
@@ -0,0 +1,137 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class ApplicationAdapter extends ClientAdapter implements ApplicationModel {
+
+    private Application application;
+
+    ApplicationAdapter(HybridModelProvider provider, Application application) {
+        super(provider, application);
+        this.application = application;
+    }
+
+    Application getApplication() {
+        return application;
+    }
+
+    @Override
+    public void updateApplication() {
+        application.updateApplication();
+    }
+
+    @Override
+    public String getName() {
+        return application.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        application.setName(name);
+    }
+
+    @Override
+    public boolean isSurrogateAuthRequired() {
+        return application.isSurrogateAuthRequired();
+    }
+
+    @Override
+    public void setSurrogateAuthRequired(boolean surrogateAuthRequired) {
+        application.setSurrogateAuthRequired(surrogateAuthRequired);
+    }
+
+    @Override
+    public String getManagementUrl() {
+        return application.getManagementUrl();
+    }
+
+    @Override
+    public void setManagementUrl(String url) {
+        application.setManagementUrl(url);
+    }
+
+    @Override
+    public String getBaseUrl() {
+        return application.getBaseUrl();
+    }
+
+    @Override
+    public void setBaseUrl(String url) {
+        application.setBaseUrl(url);
+    }
+
+    @Override
+    public List<String> getDefaultRoles() {
+        return application.getDefaultRoles();
+    }
+
+    @Override
+    public void addDefaultRole(String name) {
+        if (getRole(name) == null) {
+            addRole(name);
+        }
+
+        application.addDefaultRole(name);
+    }
+
+    @Override
+    public void updateDefaultRoles(String[] defaultRoles) {
+        application.updateDefaultRoles(defaultRoles);
+    }
+
+    @Override
+    public Set<RoleModel> getApplicationScopeMappings(ClientModel client) {
+        return provider.mappings().wrap(application.getApplicationScopeMappings(provider.mappings().unwrap(client)));
+    }
+
+    @Override
+    public boolean isBearerOnly() {
+        return application.isBearerOnly();
+    }
+
+    @Override
+    public void setBearerOnly(boolean only) {
+        application.setBearerOnly(only);
+    }
+
+    @Override
+    public RoleModel getRole(String name) {
+        return provider.mappings().wrap(application.getRole(name));
+    }
+
+    @Override
+    public RoleModel addRole(String name) {
+        return addRole(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public RoleModel addRole(String id, String name) {
+        return provider.mappings().wrap(application.addRole(id, name));
+    }
+
+    @Override
+    public boolean removeRole(RoleModel role) {
+        if (application.removeRole(provider.mappings().unwrap(role))) {
+            provider.users().onRoleRemoved(role.getId());
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public Set<RoleModel> getRoles() {
+        return provider.mappings().wrap(application.getRoles());
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/ClientAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/ClientAdapter.java
new file mode 100755
index 0000000..dfaa612
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/ClientAdapter.java
@@ -0,0 +1,191 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.realms.Client;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public abstract class ClientAdapter implements ClientModel {
+
+    protected HybridModelProvider provider;
+
+    protected Client client;
+
+    ClientAdapter(HybridModelProvider provider, Client client) {
+        this.provider = provider;
+        this.client = client;
+    }
+
+    @Override
+    public String getId() {
+        return client.getId();
+    }
+
+    @Override
+    public String getClientId() {
+        return client.getClientId();
+    }
+
+    @Override
+    public long getAllowedClaimsMask() {
+        return client.getAllowedClaimsMask();
+    }
+
+    @Override
+    public void setAllowedClaimsMask(long mask) {
+        client.setAllowedClaimsMask(mask);
+    }
+
+    @Override
+    public Set<String> getWebOrigins() {
+        return client.getWebOrigins();
+    }
+
+    @Override
+    public void setWebOrigins(Set<String> webOrigins) {
+        client.setWebOrigins(webOrigins);
+    }
+
+    @Override
+    public void addWebOrigin(String webOrigin) {
+        client.addWebOrigin(webOrigin);
+    }
+
+    @Override
+    public void removeWebOrigin(String webOrigin) {
+        client.removeWebOrigin(webOrigin);
+    }
+
+    @Override
+    public Set<String> getRedirectUris() {
+        return client.getRedirectUris();
+    }
+
+    @Override
+    public void setRedirectUris(Set<String> redirectUris) {
+        client.setRedirectUris(redirectUris);
+    }
+
+    @Override
+    public void addRedirectUri(String redirectUri) {
+        client.addRedirectUri(redirectUri);
+    }
+
+    @Override
+    public void removeRedirectUri(String redirectUri) {
+        client.removeRedirectUri(redirectUri);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return client.isEnabled();
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        client.setEnabled(enabled);
+    }
+
+    @Override
+    public boolean validateSecret(String secret) {
+        return client.validateSecret(secret);
+    }
+
+    @Override
+    public String getSecret() {
+        return client.getSecret();
+    }
+
+    @Override
+    public void setSecret(String secret) {
+        client.setSecret(secret);
+    }
+
+    @Override
+    public boolean isPublicClient() {
+        return client.isPublicClient();
+    }
+
+    @Override
+    public void setPublicClient(boolean flag) {
+        client.setPublicClient(flag);
+    }
+
+    @Override
+    public boolean isDirectGrantsOnly() {
+        return client.isDirectGrantsOnly();
+    }
+
+    @Override
+    public void setDirectGrantsOnly(boolean flag) {
+        client.setDirectGrantsOnly(flag);
+    }
+
+    @Override
+    public Set<RoleModel> getScopeMappings() {
+        return provider.mappings().wrap(client.getScopeMappings());
+    }
+
+    @Override
+    public void addScopeMapping(RoleModel role) {
+        if (!hasScope(role)) {
+            client.addScopeMapping(provider.mappings().unwrap(role));
+        }
+    }
+
+    @Override
+    public void deleteScopeMapping(RoleModel role) {
+        client.deleteScopeMapping(provider.mappings().unwrap(role));
+    }
+
+    @Override
+    public Set<RoleModel> getRealmScopeMappings() {
+        return provider.mappings().wrap(client.getRealmScopeMappings());
+    }
+
+    @Override
+    public boolean hasScope(RoleModel role) {
+        Set<RoleModel> roles = getScopeMappings();
+        if (roles.contains(role)) {
+            return true;
+        }
+
+        for (RoleModel mapping : roles) {
+            if (mapping.hasRole(role)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    @Override
+    public RealmModel getRealm() {
+        return provider.mappings().wrap(client.getRealm());
+    }
+
+    @Override
+    public int getNotBefore() {
+        return client.getNotBefore();
+    }
+
+    @Override
+    public void setNotBefore(int notBefore) {
+        client.setNotBefore(notBefore);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (!this.getClass().equals(o.getClass())) return false;
+
+        ClientAdapter that = (ClientAdapter) o;
+        return that.getId().equals(getId());
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridKeycloakTransaction.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridKeycloakTransaction.java
new file mode 100644
index 0000000..b6a54ea
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridKeycloakTransaction.java
@@ -0,0 +1,65 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.KeycloakTransaction;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class HybridKeycloakTransaction implements KeycloakTransaction {
+
+    private KeycloakTransaction[] txs;
+
+    public HybridKeycloakTransaction(KeycloakTransaction... txs) {
+        this.txs = txs;
+    }
+
+    @Override
+    public void begin() {
+        for (KeycloakTransaction tx : txs) {
+            tx.begin();
+        }
+    }
+
+    @Override
+    public void commit() {
+        // TODO What do we do if one tx fails?
+        for (KeycloakTransaction tx : txs) {
+            tx.commit();
+        }
+    }
+
+    @Override
+    public void rollback() {
+        for (KeycloakTransaction tx : txs) {
+            tx.rollback();
+        }
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        for (KeycloakTransaction tx : txs) {
+            tx.setRollbackOnly();
+        }
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        for (KeycloakTransaction tx : txs) {
+            if (tx.getRollbackOnly()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @Override
+    public boolean isActive() {
+        for (KeycloakTransaction tx : txs) {
+            if (tx.isActive()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProvider.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProvider.java
new file mode 100755
index 0000000..1b27841
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProvider.java
@@ -0,0 +1,202 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.models.ModelProvider;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.sessions.SessionProvider;
+import org.keycloak.models.users.UserProvider;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class HybridModelProvider implements ModelProvider {
+
+    private final Mappings mappings;
+
+    private KeycloakSession session;
+
+    private HybridKeycloakTransaction tx;
+
+    public HybridModelProvider(KeycloakSession session) {
+        this.session = session;
+        this.mappings = new Mappings(this);
+    }
+
+    @Override
+    public KeycloakTransaction getTransaction() {
+        if (tx == null) {
+            tx = new HybridKeycloakTransaction(realms().getTransaction(), users().getTransaction(), sessions().getTransaction());
+        }
+
+        return tx;
+    }
+
+    Mappings mappings() {
+        return mappings;
+    }
+
+    SessionProvider sessions() {
+        return session.getProvider(SessionProvider.class);
+    }
+
+    UserProvider users() {
+        return session.getProvider(UserProvider.class);
+    }
+
+    RealmProvider realms() {
+        return session.getProvider(RealmProvider.class);
+    }
+
+    @Override
+    public RealmModel createRealm(String name) {
+        return createRealm(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public RealmModel createRealm(String id, String name) {
+        return mappings.wrap(realms().createRealm(id, name));
+    }
+
+    @Override
+    public RealmModel getRealm(String id) {
+        return mappings.wrap(realms().getRealm(id));
+    }
+
+    @Override
+    public RealmModel getRealmByName(String name) {
+        return mappings.wrap(realms().getRealmByName(name));
+    }
+
+    @Override
+    public UserModel getUserById(String id, RealmModel realm) {
+        return mappings.wrap(realm, users().getUserById(id, realm.getId()));
+    }
+
+    @Override
+    public UserModel getUserByUsername(String username, RealmModel realm) {
+        return mappings.wrap(realm, users().getUserByUsername(username, realm.getId()));
+    }
+
+    @Override
+    public UserModel getUserByEmail(String email, RealmModel realm) {
+        return mappings.wrap(realm, users().getUserByEmail(email, realm.getId()));
+    }
+
+    @Override
+    public UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm) {
+        return mappings.wrap(realm, users().getUserByAttribute("keycloak.socialLink." + socialLink.getSocialProvider() + ".userId", socialLink.getSocialUserId(), realm.getId()));
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm) {
+        return mappings.wrapUsers(realm, users().getUsers(realm.getId()));
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm) {
+        return mappings.wrapUsers(realm, users().searchForUser(search, realm.getId()));
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm) {
+        return mappings.wrapUsers(realm, users().searchForUserByAttributes(attributes, realm.getId()));
+    }
+
+    @Override
+    public Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm) {
+        Set<SocialLinkModel> links = new HashSet<SocialLinkModel>();
+
+        for (Map.Entry<String, String> e : user.getAttributes().entrySet()) {
+            if (e.getKey().matches("keycloak\\.socialLink\\..*\\.userId")) {
+                String provider = e.getKey().split("\\.")[2];
+
+                SocialLinkModel link = new SocialLinkModel();
+                link.setSocialProvider(provider);
+                link.setSocialUserId(e.getValue());
+                link.setSocialUsername(user.getAttribute("keycloak.socialLink." + provider + ".username"));
+
+                links.add(link);
+            }
+
+        }
+
+        return links;
+    }
+
+    @Override
+    public SocialLinkModel getSocialLink(UserModel user, String provider, RealmModel realm) {
+        if (user.getAttribute("keycloak.socialLink." + provider + ".userId") != null) {
+            SocialLinkModel link = new SocialLinkModel();
+            link.setSocialProvider(provider);
+            link.setSocialUserId(user.getAttribute("keycloak.socialLink." + provider + ".userId"));
+            link.setSocialUsername(user.getAttribute("keycloak.socialLink." + provider + ".username"));
+            return link;
+        } else {
+            return null;
+        }
+    }
+
+    @Override
+    public RoleModel getRoleById(String id, RealmModel realm) {
+        return mappings.wrap(realms().getRoleById(id, realm.getId()));
+    }
+
+    @Override
+    public ApplicationModel getApplicationById(String id, RealmModel realm) {
+        return mappings.wrap(realms().getApplicationById(id, realm.getId()));
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClientById(String id, RealmModel realm) {
+        return mappings.wrap(realms().getOAuthClientById(id, realm.getId()));
+    }
+
+    @Override
+    public List<RealmModel> getRealms() {
+        return mappings.wrap(realms().getRealms());
+    }
+
+    @Override
+    public boolean removeRealm(String id) {
+        if (realms().removeRealm(id)) {
+            users().onRealmRemoved(id);
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public UsernameLoginFailureModel getUserLoginFailure(String username, RealmModel realm) {
+        return mappings.wrap(sessions().getUserLoginFailure(username, realm.getId()));
+    }
+
+    @Override
+    public UsernameLoginFailureModel addUserLoginFailure(String username, RealmModel realm) {
+        return mappings.wrap(sessions().addUserLoginFailure(username, realm.getId()));
+    }
+
+    @Override
+    public List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm) {
+        return mappings.wrapLoginFailures(sessions().getAllUserLoginFailures(realm.getId()));
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProviderFactory.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProviderFactory.java
new file mode 100755
index 0000000..3a644d4
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/HybridModelProviderFactory.java
@@ -0,0 +1,31 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.ModelProvider;
+import org.keycloak.models.ModelProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class HybridModelProviderFactory implements ModelProviderFactory {
+
+    @Override
+    public String getId() {
+        return "hybrid";
+    }
+
+    @Override
+    public ModelProvider create(KeycloakSession session) {
+        return new HybridModelProvider(session);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/Mappings.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/Mappings.java
new file mode 100644
index 0000000..39972ae
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/Mappings.java
@@ -0,0 +1,220 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.Client;
+import org.keycloak.models.realms.OAuthClient;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.sessions.LoginFailure;
+import org.keycloak.models.sessions.Session;
+import org.keycloak.models.users.User;
+
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class Mappings {
+
+    private final HybridModelProvider provider;
+    private Map<Object, Object> mappings = new HashMap<Object, Object>();
+
+    public Mappings(HybridModelProvider provider) {
+        this.provider = provider;
+    }
+
+    public RealmModel wrap(Realm realm) {
+        if (realm == null) return null;
+
+        RealmAdapter adapter = (RealmAdapter) mappings.get(realm);
+        if (adapter == null) {
+            adapter = new RealmAdapter(provider, realm);
+            mappings.put(realm, adapter);
+        }
+        return adapter;
+    }
+
+    public List<RealmModel> wrap(List<Realm> realms) {
+        List<RealmModel> adapters = new LinkedList<RealmModel>();
+        for (Realm realm : realms) {
+            adapters.add(wrap(realm));
+        }
+        return adapters;
+    }
+
+    public RoleModel wrap(Role role) {
+        if (role == null) return null;
+
+        RoleAdapter adapter = (RoleAdapter) mappings.get(role);
+        if (adapter == null) {
+            adapter = new RoleAdapter(provider, role);
+            mappings.put(role, adapter);
+        }
+        return adapter;
+    }
+
+    public Set<RoleModel> wrap(Set<Role> roles) {
+        Set<RoleModel> adapters = new HashSet<RoleModel>();
+        for (Role role : roles) {
+            adapters.add(wrap(role));
+        }
+        return adapters;
+    }
+
+    public Role unwrap(RoleModel role) {
+        if (role instanceof RoleAdapter) {
+            return ((RoleAdapter) role).getRole();
+        } else {
+            return provider.realms().getRoleById(role.getId(), getRealm(role.getContainer()));
+        }
+    }
+
+    public ApplicationModel wrap(Application application) {
+        return application != null ? new ApplicationAdapter(provider, application) : null;
+    }
+
+    public List<ApplicationModel> wrapApps(List<Application> applications) {
+       List<ApplicationModel> adapters = new LinkedList<ApplicationModel>();
+        for (Application application : applications) {
+            adapters.add(wrap(application));
+        }
+        return adapters;
+    }
+
+    public Map<String, ApplicationModel> wrap(Map<String, Application> applications) {
+        Map<String, ApplicationModel> adapters = new HashMap<String, ApplicationModel>();
+        for (Map.Entry<String, Application> e : applications.entrySet()) {
+            adapters.put(e.getKey(), wrap(e.getValue()));
+        }
+        return adapters;
+    }
+
+    public OAuthClientModel wrap(OAuthClient client) {
+        return client != null ? new OAuthClientAdapter(provider, client) : null;
+    }
+
+    public List<OAuthClientModel> wrapClients(List<OAuthClient> clients) {
+       List<OAuthClientModel> adapters = new LinkedList<OAuthClientModel>();
+        for (OAuthClient client : clients) {
+            adapters.add(wrap(client));
+        }
+        return adapters;
+    }
+
+    public Client unwrap(ClientModel client) {
+        if (client == null) {
+            return null;
+        }
+
+        if (client instanceof ApplicationAdapter) {
+            return ((ApplicationAdapter) client).getApplication();
+        } else if (client instanceof OAuthClientAdapter) {
+            return ((OAuthClientAdapter) client).getOauthClient();
+        } else {
+            throw new IllegalArgumentException("Not a hybrid model");
+        }
+    }
+
+    public Application unwrap(ApplicationModel application) {
+        if (application == null) {
+            return null;
+        }
+
+        if (!(application instanceof ApplicationAdapter)) {
+            throw new IllegalArgumentException("Not a hybrid model");
+        }
+
+        return ((ApplicationAdapter) application).getApplication();
+    }
+
+    public UserModel wrap(RealmModel realm, User user) {
+        return user != null ? new UserAdapter(provider, realm, user) : null;
+    }
+
+    public List<UserModel> wrapUsers(RealmModel realm, List<User> users) {
+        List<UserModel> adapters = new LinkedList<UserModel>();
+        for (User user : users) {
+            adapters.add(wrap(realm, user));
+        }
+        return adapters;
+    }
+
+    public static User unwrap(UserModel user) {
+        if (user == null) {
+            return null;
+        }
+
+        if (!(user instanceof UserAdapter)) {
+            throw new IllegalArgumentException("Not a hybrid model");
+        }
+
+        return ((UserAdapter) user).getUser();
+    }
+
+    public UserSessionModel wrap(RealmModel realm, Session session) {
+        return session != null ? new UserSessionAdapter(provider, realm, session) : null;
+    }
+
+    public List<UserSessionModel> wrapSessions(RealmModel realm, List<Session> sessions) {
+        List<UserSessionModel> adapters = new LinkedList<UserSessionModel>();
+        for (Session session : sessions) {
+            adapters.add(wrap(realm, session));
+        }
+        return adapters;
+    }
+
+    public Set<UserSessionModel> wrapSessions(RealmModel realm, Set<Session> sessions) {
+        Set<UserSessionModel> adapters = new HashSet<UserSessionModel>();
+        for (Session session : sessions) {
+            adapters.add(wrap(realm, session));
+        }
+        return adapters;
+    }
+
+    public Session unwrap(UserSessionModel session) {
+        if (session == null) {
+            return null;
+        }
+
+        if (!(session instanceof UserSessionAdapter)) {
+            throw new IllegalArgumentException("Not a hybrid model");
+        }
+
+        return ((UserSessionAdapter) session).getSession();
+    }
+
+    public UsernameLoginFailureModel wrap(LoginFailure loginFailure) {
+        return loginFailure != null ? new UsernameLoginFailureAdapter(provider, loginFailure) : null;
+    }
+
+    public List<UsernameLoginFailureModel> wrapLoginFailures(List<LoginFailure> loginFailures) {
+        List<UsernameLoginFailureModel> adapters = new LinkedList<UsernameLoginFailureModel>();
+        for (LoginFailure loginFailure : loginFailures) {
+            adapters.add(wrap(loginFailure));
+        }
+        return adapters;
+    }
+
+    private String getRealm(RoleContainerModel container) {
+        if (container instanceof RealmModel) {
+            return ((RealmModel) container).getId();
+        } else {
+            return ((ApplicationModel) container).getRealm().getId();
+        }
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/OAuthClientAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/OAuthClientAdapter.java
new file mode 100644
index 0000000..308e819
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/OAuthClientAdapter.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.realms.OAuthClient;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class OAuthClientAdapter extends ClientAdapter implements OAuthClientModel {
+
+    private OAuthClient oauthClient;
+
+    OAuthClientAdapter(HybridModelProvider provider, OAuthClient oauthClient) {
+        super(provider, oauthClient);
+        this.oauthClient = oauthClient;
+    }
+
+    OAuthClient getOauthClient() {
+        return oauthClient;
+    }
+
+    @Override
+    public void setClientId(String id) {
+        oauthClient.setClientId(id);
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/RealmAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/RealmAdapter.java
new file mode 100755
index 0000000..f8b5415
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/RealmAdapter.java
@@ -0,0 +1,794 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredCredentialModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.Client;
+import org.keycloak.models.realms.OAuthClient;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.users.Credentials;
+import org.keycloak.models.users.Feature;
+import org.keycloak.models.users.User;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
+import org.keycloak.models.utils.TimeBasedOTP;
+
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class RealmAdapter implements RealmModel {
+
+    private HybridModelProvider provider;
+    private Realm realm;
+
+    RealmAdapter(HybridModelProvider provider, Realm realm) {
+        this.provider = provider;
+        this.realm = realm;
+    }
+
+    Realm getRealm() {
+        return realm;
+    }
+
+    @Override
+    public String getId() {
+        return realm.getId();
+    }
+
+    @Override
+    public String getName() {
+        return realm.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        realm.setName(name);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return realm.isEnabled();
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        realm.setEnabled(enabled);
+    }
+
+    @Override
+    public boolean isSslNotRequired() {
+        return realm.isSslNotRequired();
+    }
+
+    @Override
+    public void setSslNotRequired(boolean sslNotRequired) {
+        realm.setSslNotRequired(sslNotRequired);
+    }
+
+    @Override
+    public boolean isRegistrationAllowed() {
+        return realm.isRegistrationAllowed();
+    }
+
+    @Override
+    public void setRegistrationAllowed(boolean registrationAllowed) {
+        realm.setRegistrationAllowed(registrationAllowed);
+    }
+
+    @Override
+    public boolean isPasswordCredentialGrantAllowed() {
+        return realm.isPasswordCredentialGrantAllowed();
+    }
+
+    @Override
+    public void setPasswordCredentialGrantAllowed(boolean passwordCredentialGrantAllowed) {
+        realm.setPasswordCredentialGrantAllowed(passwordCredentialGrantAllowed);
+    }
+
+    @Override
+    public boolean isRememberMe() {
+        return realm.isRememberMe();
+    }
+
+    @Override
+    public void setRememberMe(boolean rememberMe) {
+        realm.setRememberMe(rememberMe);
+    }
+
+    @Override
+    public boolean isBruteForceProtected() {
+        return realm.isBruteForceProtected();
+    }
+
+    @Override
+    public void setBruteForceProtected(boolean value) {
+        realm.setBruteForceProtected(value);
+    }
+
+    @Override
+    public int getMaxFailureWaitSeconds() {
+        return realm.getMaxFailureWaitSeconds();
+    }
+
+    @Override
+    public void setMaxFailureWaitSeconds(int val) {
+        realm.setMaxFailureWaitSeconds(val);
+    }
+
+    @Override
+    public int getWaitIncrementSeconds() {
+        return realm.getWaitIncrementSeconds();
+    }
+
+    @Override
+    public void setWaitIncrementSeconds(int val) {
+        realm.setWaitIncrementSeconds(val);
+    }
+
+    @Override
+    public int getMinimumQuickLoginWaitSeconds() {
+        return realm.getMinimumQuickLoginWaitSeconds();
+    }
+
+    @Override
+    public void setMinimumQuickLoginWaitSeconds(int val) {
+        realm.setMinimumQuickLoginWaitSeconds(val);
+    }
+
+    @Override
+    public long getQuickLoginCheckMilliSeconds() {
+        return realm.getQuickLoginCheckMilliSeconds();
+    }
+
+    @Override
+    public void setQuickLoginCheckMilliSeconds(long val) {
+        realm.setQuickLoginCheckMilliSeconds(val);
+    }
+
+    @Override
+    public int getMaxDeltaTimeSeconds() {
+        return realm.getMaxDeltaTimeSeconds();
+    }
+
+    @Override
+    public void setMaxDeltaTimeSeconds(int val) {
+        realm.setMaxDeltaTimeSeconds(val);
+    }
+
+    @Override
+    public int getFailureFactor() {
+        return realm.getFailureFactor();
+    }
+
+    @Override
+    public void setFailureFactor(int failureFactor) {
+        realm.setFailureFactor(failureFactor);
+    }
+
+    @Override
+    public boolean isVerifyEmail() {
+        return realm.isVerifyEmail();
+    }
+
+    @Override
+    public void setVerifyEmail(boolean verifyEmail) {
+        realm.setVerifyEmail(verifyEmail);
+    }
+
+    @Override
+    public boolean isResetPasswordAllowed() {
+        return realm.isResetPasswordAllowed();
+    }
+
+    @Override
+    public void setResetPasswordAllowed(boolean resetPasswordAllowed) {
+        realm.setResetPasswordAllowed(resetPasswordAllowed);
+    }
+
+    @Override
+    public int getSsoSessionIdleTimeout() {
+        return realm.getSsoSessionIdleTimeout();
+    }
+
+    @Override
+    public void setSsoSessionIdleTimeout(int seconds) {
+        realm.setSsoSessionIdleTimeout(seconds);
+    }
+
+    @Override
+    public int getSsoSessionMaxLifespan() {
+        return realm.getSsoSessionMaxLifespan();
+    }
+
+    @Override
+    public void setSsoSessionMaxLifespan(int seconds) {
+        realm.setSsoSessionMaxLifespan(seconds);
+    }
+
+    @Override
+    public int getAccessTokenLifespan() {
+        return realm.getAccessTokenLifespan();
+    }
+
+    @Override
+    public void setAccessTokenLifespan(int seconds) {
+        realm.setAccessTokenLifespan(seconds);
+    }
+
+    @Override
+    public int getAccessCodeLifespan() {
+        return realm.getAccessCodeLifespan();
+    }
+
+    @Override
+    public void setAccessCodeLifespan(int seconds) {
+        realm.setAccessCodeLifespan(seconds);
+    }
+
+    @Override
+    public int getAccessCodeLifespanUserAction() {
+        return realm.getAccessCodeLifespanUserAction();
+    }
+
+    @Override
+    public void setAccessCodeLifespanUserAction(int seconds) {
+        realm.setAccessCodeLifespanUserAction(seconds);
+    }
+
+    @Override
+    public String getPublicKeyPem() {
+        return realm.getPublicKeyPem();
+    }
+
+    @Override
+    public void setPublicKeyPem(String publicKeyPem) {
+        realm.setPublicKeyPem(publicKeyPem);
+    }
+
+    @Override
+    public String getPrivateKeyPem() {
+        return realm.getPrivateKeyPem();
+    }
+
+    @Override
+    public void setPrivateKeyPem(String privateKeyPem) {
+        realm.setPrivateKeyPem(privateKeyPem);
+    }
+
+    @Override
+    public PublicKey getPublicKey() {
+        return realm.getPublicKey();
+    }
+
+    @Override
+    public void setPublicKey(PublicKey publicKey) {
+        realm.setPublicKey(publicKey);
+    }
+
+    @Override
+    public PrivateKey getPrivateKey() {
+        return realm.getPrivateKey();
+    }
+
+    @Override
+    public void setPrivateKey(PrivateKey privateKey) {
+        realm.setPrivateKey(privateKey);
+    }
+
+    @Override
+    public List<RequiredCredentialModel> getRequiredCredentials() {
+        return realm.getRequiredCredentials();
+    }
+
+    @Override
+    public void addRequiredCredential(String cred) {
+         realm.addRequiredCredential(cred);
+    }
+
+    @Override
+    public PasswordPolicy getPasswordPolicy() {
+        return realm.getPasswordPolicy();
+    }
+
+    @Override
+    public void setPasswordPolicy(PasswordPolicy policy) {
+        realm.setPasswordPolicy(policy);
+    }
+
+    @Override
+    public boolean validatePassword(UserModel userModel, String password) {
+        if (provider.users().supports(Feature.VERIFY_CREDENTIALS)) {
+            User user = provider.mappings().unwrap(userModel);
+            return provider.users().verifyCredentials(user, new Credentials(UserCredentialModel.PASSWORD, password));
+        } else {
+            for (UserCredentialValueModel cred : userModel.getCredentialsDirectly()) {
+                if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                    return new Pbkdf2PasswordEncoder(cred.getSalt()).verify(password, cred.getValue());
+                }
+            }
+            return false;
+        }
+    }
+
+    @Override
+    public boolean validateTOTP(UserModel userModel, String password, String token) {
+        if (provider.users().supports(Feature.VERIFY_CREDENTIALS)) {
+            User user = provider.mappings().unwrap(userModel);
+            return provider.users().verifyCredentials(user, new Credentials(UserCredentialModel.PASSWORD, password),
+                    new Credentials(UserCredentialModel.TOTP, token));
+        } else {
+            if (!validatePassword(userModel, password)) return false;
+            for (UserCredentialValueModel cred : userModel.getCredentialsDirectly()) {
+                if (cred.getType().equals(UserCredentialModel.TOTP)) {
+                    return new TimeBasedOTP().validate(token, cred.getValue().getBytes());
+                }
+            }
+            return false;
+        }
+    }
+
+    @Override
+    public UserModel getUser(String name) {
+        return provider.getUserByUsername(name, this);
+    }
+
+    @Override
+    public UserModel getUserByEmail(String email) {
+        return provider.getUserByEmail(email, this);
+    }
+
+    @Override
+    public UserModel getUserById(String name) {
+        return provider.getUserById(name, this);
+    }
+
+    @Override
+    public UserModel addUser(String id, String username, boolean addDefaultRoles) {
+        if (id == null) {
+            id = KeycloakModelUtils.generateId();
+        }
+
+        Set<String> initialRoles = new HashSet<String>();
+
+        if (addDefaultRoles) {
+            for (String r : realm.getDefaultRoles()) {
+                initialRoles.add(realm.getRole(r).getId());
+            }
+
+            for (Application app : realm.getApplications()) {
+                for (String r : app.getDefaultRoles()) {
+                    initialRoles.add(app.getRole(r).getId());
+                }
+            }
+        }
+
+        return provider.mappings().wrap(this, provider.users().addUser(id, username, initialRoles, realm.getId()));
+    }
+
+    @Override
+    public UserModel addUser(String username) {
+        return addUser(null, username, true);
+    }
+
+    @Override
+    public boolean removeUser(String name) {
+        return provider.users().removeUser(name, realm.getId());
+    }
+
+    @Override
+    public RoleModel getRoleById(String id) {
+        return provider.mappings().wrap(provider.realms().getRoleById(id, realm.getId()));
+    }
+
+    @Override
+    public List<String> getDefaultRoles() {
+        return realm.getDefaultRoles();
+    }
+
+    @Override
+    public void addDefaultRole(String name) {
+        if (getRole(name) == null) {
+            addRole(name);
+        }
+
+        realm.addDefaultRole(name);
+    }
+
+    @Override
+    public void updateDefaultRoles(String[] defaultRoles) {
+        for (String name : defaultRoles) {
+            if (getRole(name) == null) {
+                addRole(name);
+            }
+        }
+
+        realm.updateDefaultRoles(defaultRoles);
+    }
+
+    @Override
+    public ClientModel findClient(String clientId) {
+        Client client = realm.findClient(clientId);
+        if (client instanceof Application) {
+            return provider.mappings().wrap((Application) client);
+        } else if (client instanceof OAuthClient) {
+            return provider.mappings().wrap((OAuthClient) client);
+        } else {
+            throw new IllegalArgumentException("Unsupported client type");
+        }
+    }
+
+    @Override
+    public Map<String, ApplicationModel> getApplicationNameMap() {
+        return provider.mappings().wrap(realm.getApplicationNameMap());
+    }
+
+    @Override
+    public List<ApplicationModel> getApplications() {
+        return provider.mappings().wrapApps(realm.getApplications());
+    }
+
+    @Override
+    public ApplicationModel addApplication(String name) {
+        return addApplication(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public ApplicationModel addApplication(String id, String name) {
+        return provider.mappings().wrap(realm.addApplication(id, name));
+    }
+
+    @Override
+    public boolean removeApplication(String id) {
+        Application application = provider.realms().getApplicationById(id, realm.getId());
+        if (application != null) {
+            return realm.removeApplication(application);
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public ApplicationModel getApplicationById(String id) {
+        return provider.getApplicationById(id, this);
+    }
+
+    @Override
+    public ApplicationModel getApplicationByName(String name) {
+        return provider.mappings().wrap(realm.getApplicationByName(name));
+    }
+
+    @Override
+    public void updateRequiredCredentials(Set<String> creds) {
+        realm.updateRequiredCredentials(creds);
+    }
+
+    @Override
+    public UserModel getUserBySocialLink(SocialLinkModel socialLink) {
+        return provider.getUserBySocialLink(socialLink, this);
+    }
+
+    @Override
+    public Set<SocialLinkModel> getSocialLinks(UserModel user) {
+        return provider.getSocialLinks(user, this);
+    }
+
+    @Override
+    public SocialLinkModel getSocialLink(UserModel user, String socialProvider) {
+        return provider.getSocialLink(user, socialProvider, this);
+    }
+
+    @Override
+    public void addSocialLink(UserModel user, SocialLinkModel socialLink) {
+        user.setAttribute("keycloak.socialLink." + socialLink.getSocialProvider() + ".userId", socialLink.getSocialUserId());
+        user.setAttribute("keycloak.socialLink." + socialLink.getSocialProvider() + ".username", socialLink.getSocialUsername());
+    }
+
+    @Override
+    public boolean removeSocialLink(UserModel user, String socialProvider) {
+        if (user.getAttribute("keycloak.socialLink." + socialProvider + ".userId") != null) {
+            user.removeAttribute("keycloak.socialLink." + socialProvider + ".userId");
+            user.removeAttribute("keycloak.socialLink." + socialProvider + ".username");
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public boolean isSocial() {
+        return realm.isSocial();
+    }
+
+    @Override
+    public void setSocial(boolean social) {
+        realm.setSocial(social);
+    }
+
+    @Override
+    public boolean isUpdateProfileOnInitialSocialLogin() {
+        return realm.isUpdateProfileOnInitialSocialLogin();
+    }
+
+    @Override
+    public void setUpdateProfileOnInitialSocialLogin(boolean updateProfileOnInitialSocialLogin) {
+        realm.setUpdateProfileOnInitialSocialLogin(updateProfileOnInitialSocialLogin);
+    }
+
+    @Override
+    public UsernameLoginFailureModel getUserLoginFailure(String username) {
+        return provider.getUserLoginFailure(username, this);
+    }
+
+    @Override
+    public UsernameLoginFailureModel addUserLoginFailure(String username) {
+        return provider.addUserLoginFailure(username, this);
+    }
+
+    @Override
+    public List<UsernameLoginFailureModel> getAllUserLoginFailures() {
+        return provider.getAllUserLoginFailures(this);
+    }
+
+    @Override
+    public List<UserModel> getUsers() {
+        return provider.getUsers(this);
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search) {
+        return provider.searchForUser(search, this);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes) {
+        return provider.searchForUserByAttributes(attributes, this);
+    }
+
+    @Override
+    public OAuthClientModel addOAuthClient(String name) {
+        return addOAuthClient(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public OAuthClientModel addOAuthClient(String id, String name) {
+        return provider.mappings().wrap(realm.addOAuthClient(id, name));
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClient(String name) {
+        return provider.mappings().wrap(realm.getOAuthClient(name));
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClientById(String id) {
+        return provider.getOAuthClientById(id, this);
+    }
+
+    @Override
+    public boolean removeOAuthClient(String id) {
+        OAuthClient client = provider.realms().getOAuthClientById(id, realm.getId());
+        if (client != null) {
+            return realm.removeOAuthClient(client);
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public List<OAuthClientModel> getOAuthClients() {
+        return provider.mappings().wrapClients(realm.getOAuthClients());
+    }
+
+    @Override
+    public Map<String, String> getSmtpConfig() {
+        return realm.getSmtpConfig();
+    }
+
+    @Override
+    public void setSmtpConfig(Map<String, String> smtpConfig) {
+        realm.setSmtpConfig(smtpConfig);
+    }
+
+    @Override
+    public Map<String, String> getSocialConfig() {
+        return realm.getSocialConfig();
+    }
+
+    @Override
+    public void setSocialConfig(Map<String, String> socialConfig) {
+        realm.setSocialConfig(socialConfig);
+    }
+
+    @Override
+    public Map<String, String> getLdapServerConfig() {
+        return realm.getLdapServerConfig();
+    }
+
+    @Override
+    public void setLdapServerConfig(Map<String, String> ldapServerConfig) {
+        realm.setLdapServerConfig(ldapServerConfig);
+    }
+
+    @Override
+    public List<AuthenticationProviderModel> getAuthenticationProviders() {
+        return realm.getAuthenticationProviders();
+    }
+
+    @Override
+    public void setAuthenticationProviders(List<AuthenticationProviderModel> authenticationProviders) {
+        realm.setAuthenticationProviders(authenticationProviders);
+    }
+
+    @Override
+    public String getLoginTheme() {
+        return realm.getLoginTheme();
+    }
+
+    @Override
+    public void setLoginTheme(String name) {
+        realm.setLoginTheme(name);
+    }
+
+    @Override
+    public String getAccountTheme() {
+        return realm.getAccountTheme();
+    }
+
+    @Override
+    public void setAccountTheme(String name) {
+        realm.setAccountTheme(name);
+    }
+
+    @Override
+    public String getAdminTheme() {
+        return realm.getAdminTheme();
+    }
+
+    @Override
+    public void setAdminTheme(String name) {
+        realm.setAdminTheme(name);
+    }
+
+    @Override
+    public String getEmailTheme() {
+        return realm.getEmailTheme();
+    }
+
+    @Override
+    public void setEmailTheme(String name) {
+        realm.setEmailTheme(name);
+    }
+
+    @Override
+    public int getNotBefore() {
+        return realm.getNotBefore();
+    }
+
+    @Override
+    public void setNotBefore(int notBefore) {
+        realm.setNotBefore(notBefore);
+    }
+
+    @Override
+    public boolean isAuditEnabled() {
+        return realm.isAuditEnabled();
+    }
+
+    @Override
+    public void setAuditEnabled(boolean enabled) {
+        realm.setAuditEnabled(enabled);
+    }
+
+    @Override
+    public long getAuditExpiration() {
+        return realm.getAuditExpiration();
+    }
+
+    @Override
+    public void setAuditExpiration(long expiration) {
+        realm.setAuditExpiration(expiration);
+    }
+
+    @Override
+    public Set<String> getAuditListeners() {
+        return realm.getAuditListeners();
+    }
+
+    @Override
+    public void setAuditListeners(Set<String> listeners) {
+        realm.setAuditListeners(listeners);
+    }
+
+    @Override
+    public ApplicationModel getMasterAdminApp() {
+        return provider.mappings().wrap(realm.getMasterAdminApp());
+    }
+
+    @Override
+    public void setMasterAdminApp(ApplicationModel app) {
+        realm.setMasterAdminApp(provider.mappings().unwrap(app));
+    }
+
+    @Override
+    public ClientModel findClientById(String id) {
+        Application application = provider.realms().getApplicationById(id, realm.getId());
+        if (application != null) {
+            return provider.mappings().wrap(application);
+        }
+
+        OAuthClient client = provider.realms().getOAuthClientById(id, realm.getId());
+        if (client != null) {
+            return provider.mappings().wrap(client);
+        }
+
+        return null;
+    }
+
+    @Override
+    public RoleModel getRole(String name) {
+        return provider.mappings().wrap(realm.getRole(name));
+    }
+
+    @Override
+    public RoleModel addRole(String name) {
+        return addRole(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public RoleModel addRole(String id, String name) {
+        return provider.mappings().wrap(realm.addRole(id, name));
+
+    }
+
+    @Override
+    public boolean removeRoleById(String id) {
+        RoleModel role = getRoleById(id);
+        if (role != null) {
+            if (role.getContainer().removeRole(role)) {
+                provider.users().onRoleRemoved(role.getId());
+                return true;
+            } else {
+                return false;
+            }
+        }
+        return false;
+    }
+
+    @Override
+    public boolean removeRole(RoleModel role) {
+        return removeRoleById(role.getId());
+    }
+
+    @Override
+    public Set<RoleModel> getRoles() {
+        return provider.mappings().wrap(realm.getRoles());
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof RealmModel)) return false;
+
+        RealmModel that = (RealmModel) o;
+        return that.getId().equals(getId());
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/RoleAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/RoleAdapter.java
new file mode 100755
index 0000000..7b10d04
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/RoleAdapter.java
@@ -0,0 +1,114 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.RoleContainerModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class RoleAdapter implements RoleModel {
+
+    private HybridModelProvider provider;
+
+    private Role role;
+
+    RoleAdapter(HybridModelProvider provider, Role role) {
+        this.provider = provider;
+        this.role = role;
+    }
+
+    Role getRole() {
+        return role;
+    }
+
+    @Override
+    public String getName() {
+        return role.getName();
+    }
+
+    @Override
+    public String getDescription() {
+        return role.getDescription();
+    }
+
+    @Override
+    public void setDescription(String description) {
+        role.setDescription(description);
+    }
+
+    @Override
+    public String getId() {
+        return role.getId();
+    }
+
+    @Override
+    public void setName(String name) {
+        role.setName(name);
+    }
+
+    @Override
+    public boolean isComposite() {
+        return role.isComposite();
+    }
+
+    @Override
+    public void addCompositeRole(RoleModel role) {
+        this.role.addCompositeRole(provider.mappings().unwrap(role));
+    }
+
+    @Override
+    public void removeCompositeRole(RoleModel role) {
+        this.role.removeCompositeRole(provider.mappings().unwrap(role));
+    }
+
+    @Override
+    public Set<RoleModel> getComposites() {
+        return provider.mappings().wrap(role.getComposites());
+    }
+
+    @Override
+    public RoleContainerModel getContainer() {
+        if (role.getContainer() instanceof Application) {
+             return provider.mappings().wrap((Application) role.getContainer());
+        } else if (role.getContainer() instanceof Realm) {
+            return provider.mappings().wrap((Realm) role.getContainer());
+        } else {
+            throw new IllegalArgumentException("Unsupported role container");
+        }
+    }
+
+    @Override
+    public boolean hasRole(RoleModel role) {
+        if (this.equals(role)) {
+            return true;
+        }
+        if (!isComposite()) {
+            return false;
+        }
+
+        Set<RoleModel> visited = new HashSet<RoleModel>();
+        return KeycloakModelUtils.searchFor(role, this, visited);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof RoleModel)) return false;
+
+        RoleModel that = (RoleModel) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserAdapter.java
new file mode 100644
index 0000000..e082fc6
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserAdapter.java
@@ -0,0 +1,325 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.users.Attributes;
+import org.keycloak.models.users.Credentials;
+import org.keycloak.models.users.Feature;
+import org.keycloak.models.users.User;
+import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.keycloak.models.utils.Pbkdf2PasswordEncoder.getSalt;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserAdapter implements UserModel {
+
+    private HybridModelProvider provider;
+    private RealmModel realm;
+    private User user;
+
+    UserAdapter(HybridModelProvider provider, RealmModel realm, User user) {
+        this.provider = provider;
+        this.realm = realm;
+        this.user = user;
+    }
+
+    User getUser() {
+        return user;
+    }
+
+    @Override
+    public String getId() {
+        return user.getId();
+    }
+
+    @Override
+    public String getUsername() {
+        return user.getUsername();
+    }
+
+    @Override
+    public void setUsername(String username) {
+        user.setUsername(username);
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return user.isEnabled();
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        user.setEnabled(enabled);
+    }
+
+    @Override
+    public void setAttribute(String name, String value) {
+        user.setAttribute(name, value);
+    }
+
+    @Override
+    public void removeAttribute(String name) {
+        user.removeAttribute(name);
+    }
+
+    @Override
+    public String getAttribute(String name) {
+        return user.getAttribute(name);
+    }
+
+    @Override
+    public Map<String, String> getAttributes() {
+        return user.getAttributes();
+    }
+
+    @Override
+    public Set<RequiredAction> getRequiredActions() {
+        String value = user.getAttribute(Attributes.REQUIRED_ACTIONS);
+        if (value == null) {
+            return Collections.emptySet();
+        }
+
+        Set<RequiredAction> actions = new HashSet<RequiredAction>();
+        for (String a : value.substring(1, value.length() - 1).split(",")) {
+            actions.add(RequiredAction.valueOf(a.trim()));
+        }
+        return actions;
+    }
+
+    @Override
+    public void addRequiredAction(RequiredAction action) {
+        Set<RequiredAction> actions;
+        if (user.getAttribute(Attributes.REQUIRED_ACTIONS) == null) {
+            actions = new HashSet<RequiredAction>();
+        } else {
+            actions = getRequiredActions();
+        }
+
+        if (!actions.contains(action)) {
+            actions.add(action);
+            user.setAttribute(Attributes.REQUIRED_ACTIONS, actions.toString());
+        }
+    }
+
+    @Override
+    public void removeRequiredAction(RequiredAction action) {
+        Set<RequiredAction> actions = getRequiredActions();
+        if (actions.contains(action)) {
+            actions.remove(action);
+
+            if (actions.isEmpty()) {
+                user.removeAttribute(Attributes.REQUIRED_ACTIONS);
+            } else {
+                user.setAttribute(Attributes.REQUIRED_ACTIONS, actions.toString());
+            }
+        }
+    }
+
+    @Override
+    public String getFirstName() {
+        return user.getFirstName();
+    }
+
+    @Override
+    public void setFirstName(String firstName) {
+        user.setFirstName(firstName);
+    }
+
+    @Override
+    public String getLastName() {
+        return user.getLastName();
+    }
+
+    @Override
+    public void setLastName(String lastName) {
+        user.setLastName(lastName);
+    }
+
+    @Override
+    public String getEmail() {
+        return user.getEmail();
+    }
+
+    @Override
+    public void setEmail(String email) {
+        user.setEmail(email);
+    }
+
+    @Override
+    public boolean isEmailVerified() {
+        return isBooleanAttribute(Attributes.EMAIL_VERIFIED);
+    }
+
+    @Override
+    public void setEmailVerified(boolean verified) {
+        setBooleanAttribute(Attributes.EMAIL_VERIFIED, verified);
+    }
+
+    @Override
+    public boolean isTotp() {
+        return isBooleanAttribute(Attributes.TOTP_ENABLED);
+    }
+
+    @Override
+    public void setTotp(boolean totp) {
+        setBooleanAttribute(Attributes.TOTP_ENABLED, totp);
+    }
+
+    @Override
+    public void updateCredential(UserCredentialModel model) {
+        if (provider.users().supports(Feature.UPDATE_CREDENTIALS)) {
+            Credentials credentials;
+
+            if (model.getType().equals(UserCredentialModel.PASSWORD)) {
+                byte[] salt = getSalt();
+                int hashIterations = 1;
+                PasswordPolicy policy = realm.getPasswordPolicy();
+                if (policy != null) {
+                    hashIterations = policy.getHashIterations();
+                    if (hashIterations == -1) hashIterations = 1;
+                }
+                String value = new Pbkdf2PasswordEncoder(salt).encode(model.getValue(), hashIterations);
+
+                credentials = new Credentials(model.getType(), salt, value, hashIterations, model.getDevice());
+            } else {
+                credentials = new Credentials(model.getType(), model.getValue(), model.getDevice());
+            }
+
+            user.updateCredential(credentials);
+        } else {
+            throw new RuntimeException("Users store doesn't support updating credentials");
+        }
+    }
+
+    @Override
+    public List<UserCredentialValueModel> getCredentialsDirectly() {
+        if (provider.users().supports(Feature.READ_CREDENTIALS)) {
+            List<UserCredentialValueModel> models = new LinkedList<UserCredentialValueModel>();
+            for (Credentials cred : user.getCredentials()) {
+                UserCredentialValueModel model = new UserCredentialValueModel();
+                model.setType(cred.getType());
+                model.setValue(cred.getValue());
+                model.setDevice(cred.getDevice());
+                model.setSalt(cred.getSalt());
+                model.setHashIterations(cred.getHashIterations());
+                models.add(model);
+            }
+            return models;
+        } else {
+            throw new IllegalStateException("Users provider doesn't support reading credentials");
+        }
+    }
+
+    @Override
+    public void updateCredentialDirectly(UserCredentialValueModel model) {
+        if (provider.users().supports(Feature.UPDATE_CREDENTIALS)) {
+            Credentials credentials = new Credentials(model.getType(), model.getSalt(), model.getValue(), model.getHashIterations(), model.getDevice());
+            user.updateCredential(credentials);
+        } else {
+            throw new IllegalStateException("Users provider doesn't support updating credentials");
+        }
+    }
+
+    @Override
+    public AuthenticationLinkModel getAuthenticationLink() {
+        for (Map.Entry<String, String> e : user.getAttributes().entrySet()) {
+            if (e.getKey().matches("keycloak\\.authenticationLink\\..*\\.userId")) {
+                String provider = e.getKey().split("\\.")[2];
+                return new AuthenticationLinkModel(provider, e.getValue());
+            }
+        }
+        return null;
+    }
+
+    @Override
+    public void setAuthenticationLink(AuthenticationLinkModel authenticationLink) {
+        Iterator<Map.Entry<String, String>> itr = user.getAttributes().entrySet().iterator();
+        while (itr.hasNext()) {
+            if (itr.next().getKey().matches("keycloak\\.authenticationLink\\..*\\.userId")) {
+                itr.remove();
+            }
+        }
+        user.setAttribute("keycloak.authenticationLink." + authenticationLink.getAuthProvider() + ".userId", authenticationLink.getAuthUserId());
+    }
+
+    @Override
+    public Set<RoleModel> getRealmRoleMappings() {
+        Set<RoleModel> roles = new HashSet<RoleModel>();
+        for (RoleModel r : getRoleMappings()) {
+            if (r.getContainer() instanceof RealmModel) {
+                roles.add(r);
+            }
+        }
+        return roles;
+    }
+
+    @Override
+    public Set<RoleModel> getApplicationRoleMappings(ApplicationModel app) {
+        Set<RoleModel> roles = new HashSet<RoleModel>();
+        for (RoleModel r : getRoleMappings()) {
+            if (r.getContainer() instanceof ApplicationModel && ((ApplicationModel) r.getContainer()).getId().equals(app.getId())) {
+                roles.add(r);
+            }
+        }
+        return roles;
+    }
+
+    @Override
+    public boolean hasRole(RoleModel role) {
+        for (RoleModel r : getRoleMappings()) {
+            if (r.hasRole(role)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    @Override
+    public void grantRole(RoleModel role) {
+        user.grantRole(role.getId());
+    }
+
+    @Override
+    public Set<RoleModel> getRoleMappings() {
+        Set<RoleModel> roles = new HashSet<RoleModel>();
+        for (String r : user.getRoleMappings()) {
+            roles.add(realm.getRoleById(r));
+        }
+        return roles;
+    }
+
+    @Override
+    public void deleteRoleMapping(RoleModel role) {
+        user.deleteRoleMapping(role.getId());
+    }
+
+    private boolean isBooleanAttribute(String name) {
+        String v = user.getAttribute(name);
+        return v != null ? v.equals("true") : false;
+    }
+
+    private void setBooleanAttribute(String name, boolean enable) {
+        if (enable) {
+            user.setAttribute(name, "true");
+        } else {
+            user.removeAttribute(name);
+        }
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/UsernameLoginFailureAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UsernameLoginFailureAdapter.java
new file mode 100755
index 0000000..b496f3f
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UsernameLoginFailureAdapter.java
@@ -0,0 +1,70 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.sessions.LoginFailure;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UsernameLoginFailureAdapter implements UsernameLoginFailureModel {
+
+    private HybridModelProvider provider;
+
+    private LoginFailure loginFailure;
+
+    UsernameLoginFailureAdapter(HybridModelProvider provider, LoginFailure loginFailure) {
+        this.provider = provider;
+        this.loginFailure = loginFailure;
+    }
+
+    @Override
+    public String getUsername() {
+        return loginFailure.getUsername();
+    }
+
+    @Override
+    public int getFailedLoginNotBefore() {
+        return loginFailure.getFailedLoginNotBefore();
+    }
+
+    @Override
+    public void setFailedLoginNotBefore(int notBefore) {
+        loginFailure.setFailedLoginNotBefore(notBefore);
+    }
+
+    @Override
+    public int getNumFailures() {
+        return loginFailure.getNumFailures();
+    }
+
+    @Override
+    public void incrementFailures() {
+        loginFailure.incrementFailures();
+    }
+
+    @Override
+    public void clearFailures() {
+        loginFailure.clearFailures();
+    }
+
+    @Override
+    public long getLastFailure() {
+        return loginFailure.getLastFailure();
+    }
+
+    @Override
+    public void setLastFailure(long lastFailure) {
+        loginFailure.setLastFailure(lastFailure);
+    }
+
+    @Override
+    public String getLastIPFailure() {
+        return loginFailure.getLastIPFailure();
+    }
+
+    @Override
+    public void setLastIPFailure(String ip) {
+        loginFailure.setLastIPFailure(ip);
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserSessionAdapter.java b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserSessionAdapter.java
new file mode 100644
index 0000000..8b5a0d9
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/hybrid/UserSessionAdapter.java
@@ -0,0 +1,100 @@
+package org.keycloak.models.hybrid;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.sessions.Session;
+
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSessionAdapter implements UserSessionModel {
+
+    private HybridModelProvider provider;
+    private RealmModel realm;
+    private Session session;
+
+    UserSessionAdapter(HybridModelProvider provider, RealmModel realm, Session session) {
+        this.provider = provider;
+        this.realm = realm;
+        this.session = session;
+    }
+
+    Session getSession() {
+        return session;
+    }
+
+    @Override
+    public String getId() {
+        return session.getId();
+    }
+
+    @Override
+    public void setId(String id) {
+        session.setId(id);
+    }
+
+    @Override
+    public UserModel getUser() {
+        return provider.getUserById(session.getUser(), realm);
+    }
+
+    @Override
+    public void setUser(UserModel user) {
+        session.setUser(user.getId());
+    }
+
+    @Override
+    public String getIpAddress() {
+        return session.getIpAddress();
+    }
+
+    @Override
+    public void setIpAddress(String ipAddress) {
+       session.setIpAddress(ipAddress);
+    }
+
+    @Override
+    public int getStarted() {
+        return session.getStarted();
+    }
+
+    @Override
+    public void setStarted(int started) {
+          session.setStarted(started);
+    }
+
+    @Override
+    public int getLastSessionRefresh() {
+        return session.getLastSessionRefresh();
+    }
+
+    @Override
+    public void setLastSessionRefresh(int seconds) {
+          session.setLastSessionRefresh(seconds);
+    }
+
+    @Override
+    public void associateClient(ClientModel client) {
+        session.associateClient(client.getId());
+    }
+
+    @Override
+    public List<ClientModel> getClientAssociations() {
+        List<ClientModel> clients = new LinkedList<ClientModel>();
+        for (String id : session.getClientAssociations()) {
+            clients.add(realm.findClientById(id));
+        }
+        return clients;
+    }
+
+    @Override
+    public void removeAssociatedClient(ClientModel client) {
+        session.removeAssociatedClient(client.getId());
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/Application.java b/model/hybrid/src/main/java/org/keycloak/models/realms/Application.java
new file mode 100755
index 0000000..bf6afb0
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/Application.java
@@ -0,0 +1,40 @@
+package org.keycloak.models.realms;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface Application extends RoleContainer, Client {
+    void updateApplication();
+
+    String getName();
+
+    void setName(String name);
+
+    boolean isSurrogateAuthRequired();
+
+    void setSurrogateAuthRequired(boolean surrogateAuthRequired);
+
+    String getManagementUrl();
+
+    void setManagementUrl(String url);
+
+    String getBaseUrl();
+
+    void setBaseUrl(String url);
+
+    List<String> getDefaultRoles();
+
+    void addDefaultRole(String name);
+
+    void updateDefaultRoles(String[] defaultRoles);
+
+    Set<Role> getApplicationScopeMappings(Client client);
+
+    boolean isBearerOnly();
+    void setBearerOnly(boolean only);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/Client.java b/model/hybrid/src/main/java/org/keycloak/models/realms/Client.java
new file mode 100755
index 0000000..f7d6a6a
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/Client.java
@@ -0,0 +1,76 @@
+package org.keycloak.models.realms;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface Client {
+    /**
+     * Internal database key
+     *
+     * @return
+     */
+    String getId();
+
+    /**
+     * String exposed to outside world
+     *
+     * @return
+     */
+    String getClientId();
+
+    long getAllowedClaimsMask();
+
+    void setAllowedClaimsMask(long mask);
+
+    Set<String> getWebOrigins();
+
+    void setWebOrigins(Set<String> webOrigins);
+
+    void addWebOrigin(String webOrigin);
+
+    void removeWebOrigin(String webOrigin);
+
+    Set<String> getRedirectUris();
+
+    void setRedirectUris(Set<String> redirectUris);
+
+    void addRedirectUri(String redirectUri);
+
+    void removeRedirectUri(String redirectUri);
+
+
+    boolean isEnabled();
+
+    void setEnabled(boolean enabled);
+
+    boolean validateSecret(String secret);
+    String getSecret();
+    public void setSecret(String secret);
+
+    boolean isPublicClient();
+    void setPublicClient(boolean flag);
+
+    boolean isDirectGrantsOnly();
+    void setDirectGrantsOnly(boolean flag);
+
+    Set<Role> getScopeMappings();
+    void addScopeMapping(Role role);
+    void deleteScopeMapping(Role role);
+    Set<Role> getRealmScopeMappings();
+
+
+    Realm getRealm();
+
+    /**
+     * Time in seconds since epoc
+     *
+     * @return
+     */
+    int getNotBefore();
+
+    void setNotBefore(int notBefore);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/OAuthClient.java b/model/hybrid/src/main/java/org/keycloak/models/realms/OAuthClient.java
new file mode 100755
index 0000000..74f4cfd
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/OAuthClient.java
@@ -0,0 +1,11 @@
+package org.keycloak.models.realms;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface OAuthClient extends Client {
+
+    void setClientId(String id);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/Realm.java b/model/hybrid/src/main/java/org/keycloak/models/realms/Realm.java
new file mode 100755
index 0000000..5f1d6e8
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/Realm.java
@@ -0,0 +1,208 @@
+package org.keycloak.models.realms;
+
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RequiredCredentialModel;
+
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface Realm extends RoleContainer {
+
+    String getId();
+
+    String getName();
+
+    void setName(String name);
+
+    boolean isEnabled();
+
+    void setEnabled(boolean enabled);
+
+    boolean isSslNotRequired();
+
+    void setSslNotRequired(boolean sslNotRequired);
+
+    boolean isRegistrationAllowed();
+
+    void setRegistrationAllowed(boolean registrationAllowed);
+
+    boolean isPasswordCredentialGrantAllowed();
+
+    void setPasswordCredentialGrantAllowed(boolean passwordCredentialGrantAllowed);
+
+    boolean isRememberMe();
+
+    void setRememberMe(boolean rememberMe);
+
+    //--- brute force settings
+    boolean isBruteForceProtected();
+    void setBruteForceProtected(boolean value);
+    int getMaxFailureWaitSeconds();
+    void setMaxFailureWaitSeconds(int val);
+    int getWaitIncrementSeconds();
+    void setWaitIncrementSeconds(int val);
+    int getMinimumQuickLoginWaitSeconds();
+    void setMinimumQuickLoginWaitSeconds(int val);
+    long getQuickLoginCheckMilliSeconds();
+    void setQuickLoginCheckMilliSeconds(long val);
+    int getMaxDeltaTimeSeconds();
+    void setMaxDeltaTimeSeconds(int val);
+    int getFailureFactor();
+    void setFailureFactor(int failureFactor);
+    //--- end brute force settings
+
+
+    boolean isVerifyEmail();
+
+    void setVerifyEmail(boolean verifyEmail);
+
+    boolean isResetPasswordAllowed();
+
+    void setResetPasswordAllowed(boolean resetPasswordAllowed);
+
+    int getSsoSessionIdleTimeout();
+    void setSsoSessionIdleTimeout(int seconds);
+
+    int getSsoSessionMaxLifespan();
+    void setSsoSessionMaxLifespan(int seconds);
+
+    int getAccessTokenLifespan();
+
+    void setAccessTokenLifespan(int seconds);
+
+    int getAccessCodeLifespan();
+
+    void setAccessCodeLifespan(int seconds);
+
+    int getAccessCodeLifespanUserAction();
+
+    void setAccessCodeLifespanUserAction(int seconds);
+
+    String getPublicKeyPem();
+
+    void setPublicKeyPem(String publicKeyPem);
+
+    String getPrivateKeyPem();
+
+    void setPrivateKeyPem(String privateKeyPem);
+
+    PublicKey getPublicKey();
+
+    void setPublicKey(PublicKey publicKey);
+
+    PrivateKey getPrivateKey();
+
+    void setPrivateKey(PrivateKey privateKey);
+
+    List<RequiredCredentialModel> getRequiredCredentials();
+
+    void addRequiredCredential(String cred);
+
+    PasswordPolicy getPasswordPolicy();
+
+    void setPasswordPolicy(PasswordPolicy policy);
+
+    List<String> getDefaultRoles();
+    
+    void addDefaultRole(String name);
+    
+    void updateDefaultRoles(String[] defaultRoles);
+
+    Client findClient(String clientId);
+
+    Map<String, Application> getApplicationNameMap();
+
+    List<Application> getApplications();
+
+    Application addApplication(String id, String name);
+
+    boolean removeApplication(Application application);
+
+    Application getApplicationByName(String name);
+
+    void updateRequiredCredentials(Set<String> creds);
+
+    boolean isSocial();
+
+    void setSocial(boolean social);
+
+    boolean isUpdateProfileOnInitialSocialLogin();
+
+    void setUpdateProfileOnInitialSocialLogin(boolean updateProfileOnInitialSocialLogin);
+
+    OAuthClient addOAuthClient(String id, String name);
+
+    OAuthClient getOAuthClient(String name);
+    boolean removeOAuthClient(OAuthClient client);
+
+    List<OAuthClient> getOAuthClients();
+
+    Map<String, String> getSmtpConfig();
+
+    void setSmtpConfig(Map<String, String> smtpConfig);
+
+    Map<String, String> getSocialConfig();
+
+    void setSocialConfig(Map<String, String> socialConfig);
+
+    Map<String, String> getLdapServerConfig();
+
+    void setLdapServerConfig(Map<String, String> ldapServerConfig);
+
+    List<AuthenticationProviderModel> getAuthenticationProviders();
+
+    void setAuthenticationProviders(List<AuthenticationProviderModel> authenticationProviders);
+
+    String getLoginTheme();
+
+    void setLoginTheme(String name);
+
+    String getAccountTheme();
+
+    void setAccountTheme(String name);
+
+    String getAdminTheme();
+
+    void setAdminTheme(String name);
+
+    String getEmailTheme();
+
+    void setEmailTheme(String name);
+
+
+    /**
+     * Time in seconds since epoc
+     *
+     * @return
+     */
+    int getNotBefore();
+
+    void setNotBefore(int notBefore);
+
+    boolean removeRole(Role role);
+
+    boolean isAuditEnabled();
+
+    void setAuditEnabled(boolean enabled);
+
+    long getAuditExpiration();
+
+    void setAuditExpiration(long expiration);
+
+    Set<String> getAuditListeners();
+
+    void setAuditListeners(Set<String> listeners);
+
+    Application getMasterAdminApp();
+
+    void setMasterAdminApp(Application app);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProvider.java b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProvider.java
new file mode 100644
index 0000000..b762d67
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProvider.java
@@ -0,0 +1,29 @@
+package org.keycloak.models.realms;
+
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface RealmProvider extends Provider {
+
+    Realm createRealm(String name);
+    Realm createRealm(String id, String name);
+
+    Realm getRealm(String id);
+    Realm getRealmByName(String name);
+    List<Realm> getRealms();
+    boolean removeRealm(String id);
+
+    Role getRoleById(String id, String realm);
+    Application getApplicationById(String id, String realm);
+    OAuthClient getOAuthClientById(String id, String realm);
+
+    KeycloakTransaction getTransaction();
+
+    void close();
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProviderFactory.java b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProviderFactory.java
new file mode 100755
index 0000000..fb4dea3
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmProviderFactory.java
@@ -0,0 +1,9 @@
+package org.keycloak.models.realms;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface RealmProviderFactory extends ProviderFactory<RealmProvider> {
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/RealmSpi.java b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmSpi.java
new file mode 100644
index 0000000..9ec584f
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/RealmSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.realms;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class RealmSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "modelRealms";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return RealmProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return RealmProviderFactory.class;
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/Role.java b/model/hybrid/src/main/java/org/keycloak/models/realms/Role.java
new file mode 100755
index 0000000..431d1b6
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/Role.java
@@ -0,0 +1,31 @@
+package org.keycloak.models.realms;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface Role {
+
+    String getId();
+
+    String getName();
+
+    void setName(String name);
+
+    String getDescription();
+
+    void setDescription(String description);
+
+    boolean isComposite();
+
+    void addCompositeRole(Role role);
+
+    void removeCompositeRole(Role role);
+
+    Set<Role> getComposites();
+
+    RoleContainer getContainer();
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/realms/RoleContainer.java b/model/hybrid/src/main/java/org/keycloak/models/realms/RoleContainer.java
new file mode 100755
index 0000000..5d4c02c
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/realms/RoleContainer.java
@@ -0,0 +1,19 @@
+package org.keycloak.models.realms;
+
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface RoleContainer {
+
+    Role getRole(String name);
+
+    Set<Role> getRoles();
+
+    Role addRole(String id, String name);
+
+    boolean removeRole(Role role);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/sessions/LoginFailure.java b/model/hybrid/src/main/java/org/keycloak/models/sessions/LoginFailure.java
new file mode 100755
index 0000000..f0e7b24
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/sessions/LoginFailure.java
@@ -0,0 +1,29 @@
+package org.keycloak.models.sessions;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface LoginFailure {
+
+    String getUsername();
+
+    int getFailedLoginNotBefore();
+
+    void setFailedLoginNotBefore(int notBefore);
+
+    int getNumFailures();
+
+    void incrementFailures();
+
+    void clearFailures();
+
+    long getLastFailure();
+
+    void setLastFailure(long lastFailure);
+
+    String getLastIPFailure();
+
+    void setLastIPFailure(String ip);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/sessions/Session.java b/model/hybrid/src/main/java/org/keycloak/models/sessions/Session.java
new file mode 100755
index 0000000..722895d
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/sessions/Session.java
@@ -0,0 +1,36 @@
+package org.keycloak.models.sessions;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Session {
+
+    String getId();
+
+    void setId(String id);
+
+    String getUser();
+
+    void setUser(String user);
+
+    String getIpAddress();
+
+    void setIpAddress(String ipAddress);
+
+    int getStarted();
+
+    void setStarted(int started);
+
+    int getLastSessionRefresh();
+
+    void setLastSessionRefresh(int seconds);
+
+    void associateClient(String client);
+
+    List<String> getClientAssociations();
+
+    void removeAssociatedClient(String client);
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProvider.java b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProvider.java
new file mode 100644
index 0000000..baf0396
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProvider.java
@@ -0,0 +1,42 @@
+package org.keycloak.models.sessions;
+
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface SessionProvider extends Provider {
+
+    LoginFailure getUserLoginFailure(String username, String realm);
+
+    LoginFailure addUserLoginFailure(String username, String realm);
+
+    List<LoginFailure> getAllUserLoginFailures(String realm);
+
+    Session createUserSession(String realm, String id, String user, String ipAddress);
+
+    Session getUserSession(String id, String realm);
+
+    List<Session> getUserSessionsByUser(String user, String realm);
+
+    Set<Session> getUserSessionsByClient(String realm, String client);
+
+    int getActiveUserSessions(String realm, String client);
+
+    void removeUserSession(Session session);
+
+    void removeUserSessions(String realm, String user);
+
+    void removeExpiredUserSessions(String realm, long refreshTimeout, long sessionTimeout);
+
+    void removeUserSessions(String realm);
+
+    KeycloakTransaction getTransaction();
+
+    void close();
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProviderFactory.java b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProviderFactory.java
new file mode 100755
index 0000000..08e2051
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionProviderFactory.java
@@ -0,0 +1,9 @@
+package org.keycloak.models.sessions;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface SessionProviderFactory extends ProviderFactory<SessionProvider> {
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionSpi.java b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionSpi.java
new file mode 100644
index 0000000..cf6c7fc
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/sessions/SessionSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.sessions;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class SessionSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "modelSessions";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return SessionProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return SessionProviderFactory.class;
+    }
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/Attributes.java b/model/hybrid/src/main/java/org/keycloak/models/users/Attributes.java
new file mode 100644
index 0000000..c341ab0
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/Attributes.java
@@ -0,0 +1,12 @@
+package org.keycloak.models.users;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface Attributes {
+
+    String EMAIL_VERIFIED = "keycloak.emailVerified";
+    String TOTP_ENABLED = "keycloak.totpEnabled";
+    String REQUIRED_ACTIONS = "keycloak.requiredActions";
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/Credentials.java b/model/hybrid/src/main/java/org/keycloak/models/users/Credentials.java
new file mode 100644
index 0000000..57368bc
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/Credentials.java
@@ -0,0 +1,72 @@
+package org.keycloak.models.users;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class Credentials {
+
+    private byte[] salt;
+    private String type;
+    private String value;
+    private String device;
+    private int hashIterations;
+
+    public Credentials(String type, String value) {
+        this.type = type;
+        this.value = value;
+    }
+
+    public Credentials(String type, String value, String device) {
+        this.type = type;
+        this.value = value;
+        this.device = device;
+    }
+
+    public Credentials(String type, byte[] salt, String value, int hashIterations, String device) {
+        this.salt = salt;
+        this.type = type;
+        this.value = value;
+        this.hashIterations = hashIterations;
+        this.device = device;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public String getDevice() {
+        return device;
+    }
+
+    public void setDevice(String device) {
+        this.device = device;
+    }
+
+    public byte[] getSalt() {
+        return salt;
+    }
+
+    public void setSalt(byte[] salt) {
+        this.salt = salt;
+    }
+
+    public int getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(int hashIterations) {
+        this.hashIterations = hashIterations;
+    }
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/Feature.java b/model/hybrid/src/main/java/org/keycloak/models/users/Feature.java
new file mode 100644
index 0000000..395fb03
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/Feature.java
@@ -0,0 +1,12 @@
+package org.keycloak.models.users;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public enum Feature {
+
+    READ_CREDENTIALS,
+    UPDATE_CREDENTIALS,
+    VERIFY_CREDENTIALS;
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/User.java b/model/hybrid/src/main/java/org/keycloak/models/users/User.java
new file mode 100755
index 0000000..90f2880
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/User.java
@@ -0,0 +1,58 @@
+package org.keycloak.models.users;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface User {
+
+    public static final String USERNAME = "username";
+    public static final String LAST_NAME = "lastName";
+    public static final String FIRST_NAME = "firstName";
+    public static final String EMAIL = "email";
+
+    String getId();
+
+    boolean isEnabled();
+
+    void setEnabled(boolean enabled);
+
+    String getUsername();
+
+    void setUsername(String username);
+
+    String getFirstName();
+
+    void setFirstName(String firstName);
+
+    String getLastName();
+
+    void setLastName(String lastName);
+
+    String getEmail();
+
+    void setEmail(String email);
+
+    String getAttribute(String name);
+
+    Map<String, String> getAttributes();
+
+    void setAttribute(String name, String value);
+
+    void removeAttribute(String name);
+
+    List<Credentials> getCredentials();
+
+    void updateCredential(Credentials cred);
+
+    Set<String> getRoleMappings();
+
+    void grantRole(String role);
+
+    void deleteRoleMapping(String role);
+
+}
\ No newline at end of file

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/UserProvider.java b/model/hybrid/src/main/java/org/keycloak/models/users/UserProvider.java
new file mode 100644
index 0000000..de53736
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/UserProvider.java
@@ -0,0 +1,46 @@
+package org.keycloak.models.users;
+
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.provider.Provider;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface UserProvider extends Provider {
+
+    KeycloakTransaction getTransaction();
+
+    User addUser(String id, String username, Set<String> roles, String realm);
+
+    boolean removeUser(String name, String realm);
+
+    User getUserById(String id, String realm);
+    User getUserByUsername(String username, String realm);
+    User getUserByEmail(String email, String realm);
+    User getUserByAttribute(String name, String value, String realm);
+
+    List<User> getUsers(String realm);
+    List<User> searchForUser(String search, String realm);
+    List<User> searchForUserByAttributes(Map<String, String> attributes, String realm);
+
+    /**
+     * Returns features supported by the provider. A provider is required to at least support one of verifying credentials
+     * or reading credentials.
+     *
+     * @param feature
+     * @return
+     */
+    boolean supports(Feature feature);
+
+    boolean verifyCredentials(User user, Credentials... credentials);
+
+    void onRealmRemoved(String realm);
+    void onRoleRemoved(String role);
+
+    void close();
+
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/UserProviderFactory.java b/model/hybrid/src/main/java/org/keycloak/models/users/UserProviderFactory.java
new file mode 100755
index 0000000..e2f7c46
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/UserProviderFactory.java
@@ -0,0 +1,9 @@
+package org.keycloak.models.users;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public interface UserProviderFactory extends ProviderFactory<UserProvider> {
+}

diff --git a/model/hybrid/src/main/java/org/keycloak/models/users/UserSpi.java b/model/hybrid/src/main/java/org/keycloak/models/users/UserSpi.java
new file mode 100644
index 0000000..e3d8e23
--- /dev/null
+++ b/model/hybrid/src/main/java/org/keycloak/models/users/UserSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.users;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "modelUsers";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return UserProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return UserProviderFactory.class;
+    }
+
+}

diff --git a/model/hybrid/src/main/resources/META-INF/services/org.keycloak.models.ModelProviderFactory b/model/hybrid/src/main/resources/META-INF/services/org.keycloak.models.ModelProviderFactory
new file mode 100644
index 0000000..4fdf853
--- /dev/null
+++ b/model/hybrid/src/main/resources/META-INF/services/org.keycloak.models.ModelProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.hybrid.HybridModelProviderFactory
\ No newline at end of file

diff --git a/model/hybrid/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/hybrid/src/main/resources/META-INF/services/org.keycloak.provider.Spi
new file mode 100644
index 0000000..6f3050e
--- /dev/null
+++ b/model/hybrid/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -0,0 +1,3 @@
+org.keycloak.models.realms.RealmSpi
+org.keycloak.models.sessions.SessionSpi
+org.keycloak.models.users.UserSpi
\ No newline at end of file

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ApplicationAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ApplicationAdapter.java
index 31e938e..58fecaf 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ApplicationAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ApplicationAdapter.java
@@ -19,7 +19,7 @@ public class ApplicationAdapter extends ClientAdapter implements ApplicationMode
     protected ApplicationModel updated;
     protected CachedApplication cached;
 
-    public ApplicationAdapter(RealmModel cachedRealm, CachedApplication cached, CacheModelProvider cacheSession, KeycloakCache cache) {
+    public ApplicationAdapter(RealmModel cachedRealm, CachedApplication cached, CacheRealmProvider cacheSession, RealmCache cache) {
         super(cachedRealm, cached, cache, cacheSession);
         this.cached = cached;
     }
@@ -185,6 +185,20 @@ public class ApplicationAdapter extends ClientAdapter implements ApplicationMode
     }
 
     @Override
+    public boolean hasScope(RoleModel role) {
+        if (super.hasScope(role)) {
+            return true;
+        }
+        Set<RoleModel> roles = getRoles();
+        if (roles.contains(role)) return true;
+
+        for (RoleModel mapping : roles) {
+            if (mapping.hasRole(role)) return true;
+        }
+        return false;
+    }
+
+    @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || !(o instanceof ApplicationModel)) return false;

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProvider.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProvider.java
new file mode 100755
index 0000000..8a5f68f
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProvider.java
@@ -0,0 +1,15 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserProvider;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface CacheUserProvider extends UserProvider {
+    UserProvider getDelegate();
+    boolean isEnabled();
+    void setEnabled(boolean enabled);
+    void registerUserInvalidation(RealmModel realm, String id);
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderFactory.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderFactory.java
new file mode 100755
index 0000000..4341ad5
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderFactory.java
@@ -0,0 +1,11 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.provider.ProviderFactory;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface CacheUserProviderFactory extends ProviderFactory<CacheUserProvider> {
+
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java
new file mode 100755
index 0000000..6c0fae5
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/CacheUserProviderSpi.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.provider.Provider;
+import org.keycloak.provider.ProviderFactory;
+import org.keycloak.provider.Spi;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class CacheUserProviderSpi implements Spi {
+
+    @Override
+    public String getName() {
+        return "userCache";
+    }
+
+    @Override
+    public Class<? extends Provider> getProviderClass() {
+        return CacheUserProvider.class;
+    }
+
+    @Override
+    public Class<? extends ProviderFactory> getProviderFactoryClass() {
+        return CacheUserProviderFactory.class;
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java
index 8be3d82..ae913a1 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/ClientAdapter.java
@@ -4,7 +4,6 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.cache.entities.CachedClient;
 
 import java.util.HashSet;
@@ -16,12 +15,12 @@ import java.util.Set;
  */
 public abstract class ClientAdapter implements ClientModel {
     protected CachedClient cachedClient;
-    protected CacheModelProvider cacheSession;
+    protected CacheRealmProvider cacheSession;
     protected ClientModel updatedClient;
     protected RealmModel cachedRealm;
-    protected KeycloakCache cache;
+    protected RealmCache cache;
 
-    public ClientAdapter(RealmModel cachedRealm, CachedClient cached, KeycloakCache cache, CacheModelProvider cacheSession) {
+    public ClientAdapter(RealmModel cachedRealm, CachedClient cached, RealmCache cache, CacheRealmProvider cacheSession) {
         this.cachedRealm = cachedRealm;
         this.cache = cache;
         this.cacheSession = cacheSession;
@@ -196,13 +195,4 @@ public abstract class ClientAdapter implements ClientModel {
         updatedClient.setNotBefore(notBefore);
     }
 
-    public Set<UserSessionModel> getUserSessions() {
-        if (updatedClient != null) return updatedClient.getUserSessions();
-        return cacheSession.getUserSessions(cachedRealm, this);
-    }
-
-    public int getActiveUserSessions() {
-        if (updatedClient != null) return updatedClient.getActiveUserSessions();
-        return cacheSession.getActiveUserSessions(cachedRealm, this);
-    }
 }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplication.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplication.java
index 06cc7fe..db0e1c0 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplication.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplication.java
@@ -1,21 +1,15 @@
 package org.keycloak.models.cache.entities;
 
 import org.keycloak.models.ApplicationModel;
-import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelProvider;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.cache.KeycloakCache;
+import org.keycloak.models.cache.RealmCache;
 
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -29,7 +23,7 @@ public class CachedApplication extends CachedClient {
     private boolean bearerOnly;
     private Map<String, String> roles = new HashMap<String, String>();
 
-    public CachedApplication(KeycloakCache cache, ModelProvider delegate, RealmModel realm, ApplicationModel model) {
+    public CachedApplication(RealmCache cache, RealmProvider delegate, RealmModel realm, ApplicationModel model) {
         super(cache, delegate, realm, model);
         surrogateAuthRequired = model.isSurrogateAuthRequired();
         managementUrl = model.getManagementUrl();
@@ -38,7 +32,7 @@ public class CachedApplication extends CachedClient {
         bearerOnly = model.isBearerOnly();
         for (RoleModel role : model.getRoles()) {
             roles.put(role.getName(), role.getId());
-            cache.addCachedRole(new CachedApplicationRole(id, role));
+            cache.addCachedRole(new CachedApplicationRole(id, role, realm));
         }
 
 

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplicationRole.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplicationRole.java
index 269fba9..da0451c 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplicationRole.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedApplicationRole.java
@@ -1,5 +1,6 @@
 package org.keycloak.models.cache.entities;
 
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 
 /**
@@ -9,8 +10,8 @@ import org.keycloak.models.RoleModel;
 public class CachedApplicationRole extends CachedRole {
     private final String appId;
 
-    public CachedApplicationRole(String appId, RoleModel model) {
-        super(model);
+    public CachedApplicationRole(String appId, RoleModel model, RealmModel realm) {
+        super(model, realm);
         this.appId = appId;
 
     }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java
index 7e62422..8e4b008 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedClient.java
@@ -1,12 +1,10 @@
 package org.keycloak.models.cache.entities;
 
-import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelProvider;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.cache.KeycloakCache;
+import org.keycloak.models.cache.RealmCache;
 
 import java.util.HashSet;
 import java.util.Set;
@@ -18,6 +16,7 @@ import java.util.Set;
 public class CachedClient {
     protected String id;
     protected String name;
+    protected String realm;
     protected long allowedClaimsMask;
     protected Set<String> redirectUris = new HashSet<String>();
     protected boolean enabled;
@@ -28,10 +27,11 @@ public class CachedClient {
     protected Set<String> scope = new HashSet<String>();
     protected Set<String> webOrigins = new HashSet<String>();
 
-    public CachedClient(KeycloakCache cache, ModelProvider delegate, RealmModel realm, ClientModel model) {
+    public CachedClient(RealmCache cache, RealmProvider delegate, RealmModel realm, ClientModel model) {
         id = model.getId();
         secret = model.getSecret();
         name = model.getClientId();
+        this.realm = realm.getId();
         enabled = model.isEnabled();
         notBefore = model.getNotBefore();
         directGrantsOnly = model.isDirectGrantsOnly();
@@ -53,6 +53,10 @@ public class CachedClient {
         return name;
     }
 
+    public String getRealm() {
+        return realm;
+    }
+
     public long getAllowedClaimsMask() {
         return allowedClaimsMask;
     }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedOAuthClient.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedOAuthClient.java
index 397010f..0ab872a 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedOAuthClient.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedOAuthClient.java
@@ -1,17 +1,16 @@
 package org.keycloak.models.cache.entities;
 
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelProvider;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.cache.KeycloakCache;
+import org.keycloak.models.cache.RealmCache;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 public class CachedOAuthClient extends CachedClient {
-    public CachedOAuthClient(KeycloakCache cache, ModelProvider delegate, RealmModel realm, OAuthClientModel model) {
+    public CachedOAuthClient(RealmCache cache, RealmProvider delegate, RealmModel realm, OAuthClientModel model) {
         super(cache, delegate, realm, model);
 
     }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealm.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealm.java
index ffaa6c5..c8748fe 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealm.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealm.java
@@ -2,14 +2,14 @@ package org.keycloak.models.cache.entities;
 
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationProviderModel;
-import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelProvider;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.cache.KeycloakCache;
+import org.keycloak.models.cache.RealmCache;
 
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -65,6 +65,7 @@ public class CachedRealm {
 
     private List<RequiredCredentialModel> requiredCredentials = new ArrayList<RequiredCredentialModel>();
     private List<AuthenticationProviderModel> authenticationProviders = new ArrayList<AuthenticationProviderModel>();
+    private List<UserFederationProviderModel> federationProviders = new ArrayList<UserFederationProviderModel>();
 
     private Map<String, String> smtpConfig = new HashMap<String, String>();
     private Map<String, String> socialConfig = new HashMap<String, String>();
@@ -81,7 +82,7 @@ public class CachedRealm {
     public CachedRealm() {
     }
 
-    public CachedRealm(KeycloakCache cache, ModelProvider delegate, RealmModel model) {
+    public CachedRealm(RealmCache cache, RealmProvider delegate, RealmModel model) {
         id = model.getId();
         name = model.getName();
         enabled = model.isEnabled();
@@ -121,6 +122,7 @@ public class CachedRealm {
 
         requiredCredentials = model.getRequiredCredentials();
         authenticationProviders = model.getAuthenticationProviders();
+        federationProviders = model.getUserFederationProviders();
 
         smtpConfig.putAll(model.getSmtpConfig());
         socialConfig.putAll(model.getSocialConfig());
@@ -134,7 +136,7 @@ public class CachedRealm {
 
         for (RoleModel role : model.getRoles()) {
             realmRoles.put(role.getName(), role.getId());
-            CachedRole cachedRole = new CachedRealmRole(role);
+            CachedRole cachedRole = new CachedRealmRole(role, model);
             cache.addCachedRole(cachedRole);
         }
 
@@ -329,4 +331,7 @@ public class CachedRealm {
         return auditListeners;
     }
 
+    public List<UserFederationProviderModel> getFederationProviders() {
+        return federationProviders;
+    }
 }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealmRole.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealmRole.java
index b6f6668..e34478e 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealmRole.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRealmRole.java
@@ -1,10 +1,8 @@
 package org.keycloak.models.cache.entities;
 
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 
-import java.util.HashSet;
-import java.util.Set;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
@@ -12,8 +10,8 @@ import java.util.Set;
 public class CachedRealmRole extends CachedRole {
 
 
-    public CachedRealmRole(RoleModel model) {
-        super(model);
+    public CachedRealmRole(RoleModel model, RealmModel realm) {
+        super(model, realm);
 
     }
 

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRole.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRole.java
index ed451e2..d52d0ff 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRole.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedRole.java
@@ -1,5 +1,6 @@
 package org.keycloak.models.cache.entities;
 
+import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 
 import java.util.HashSet;
@@ -12,15 +13,17 @@ import java.util.Set;
 public class CachedRole {
     final protected String id;
     final protected String name;
+    final protected String realm;
     final protected String description;
     final protected boolean composite;
     final protected Set<String> composites = new HashSet<String>();
 
-    public CachedRole(RoleModel model) {
+    public CachedRole(RoleModel model, RealmModel realm) {
         composite = model.isComposite();
         description = model.getDescription();
         id = model.getId();
         name = model.getName();
+        this.realm = realm.getId();
         if (composite) {
             for (RoleModel child : model.getComposites()) {
                 composites.add(child.getId());
@@ -37,6 +40,10 @@ public class CachedRole {
         return name;
     }
 
+    public String getRealm() {
+        return realm;
+    }
+
     public String getDescription() {
         return description;
     }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedUser.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedUser.java
index 465f08f..a376012 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedUser.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/entities/CachedUser.java
@@ -19,18 +19,16 @@ import java.util.Set;
  */
 public class CachedUser {
     private String id;
-    private String loginName;
-    private String usernameKey;
+    private String username;
     private String firstName;
     private String lastName;
     private String email;
-    private String emailKey;
     private boolean emailVerified;
-    private int notBefore;
     private List<UserCredentialValueModel> credentials = new LinkedList<UserCredentialValueModel>();
     private boolean enabled;
     private boolean totp;
     private AuthenticationLinkModel authenticationLink;
+    private String federationLink;
     private Map<String, String> attributes = new HashMap<String, String>();
     private Set<UserModel.RequiredAction> requiredActions = new HashSet<UserModel.RequiredAction>();
     private Set<String> roleMappings = new HashSet<String>();
@@ -38,20 +36,16 @@ public class CachedUser {
 
     public CachedUser(RealmModel realm, UserModel user) {
         this.id = user.getId();
-        this.loginName = user.getLoginName();
-        this.usernameKey = realm.getId() + "." + this.loginName;
+        this.username = user.getUsername();
         this.firstName = user.getFirstName();
         this.lastName = user.getLastName();
         this.attributes.putAll(user.getAttributes());
         this.email = user.getEmail();
-        if (this.email != null) {
-            this.emailKey = realm.getId() + "." + this.email;
-        }
         this.emailVerified = user.isEmailVerified();
-        this.notBefore = user.getNotBefore();
         this.credentials.addAll(user.getCredentialsDirectly());
         this.enabled = user.isEnabled();
         this.totp = user.isTotp();
+        this.federationLink = user.getFederationLink();
         this.requiredActions.addAll(user.getRequiredActions());
         this.authenticationLink = user.getAuthenticationLink();
         for (RoleModel role : user.getRoleMappings()) {
@@ -63,16 +57,8 @@ public class CachedUser {
         return id;
     }
 
-    public String getLoginName() {
-        return loginName;
-    }
-
-    public String getUsernameKey() {
-        return usernameKey;
-    }
-
-    public String getEmailKey() {
-        return emailKey;
+    public String getUsername() {
+        return username;
     }
 
     public String getFirstName() {
@@ -91,10 +77,6 @@ public class CachedUser {
         return emailVerified;
     }
 
-    public int getNotBefore() {
-        return notBefore;
-    }
-
     public List<UserCredentialValueModel> getCredentials() {
         return credentials;
     }
@@ -122,4 +104,8 @@ public class CachedUser {
     public AuthenticationLinkModel getAuthenticationLink() {
         return authenticationLink;
     }
+
+    public String getFederationLink() {
+        return federationLink;
+    }
 }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryCacheUserProviderFactory.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryCacheUserProviderFactory.java
new file mode 100755
index 0000000..54974b7
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryCacheUserProviderFactory.java
@@ -0,0 +1,35 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class MemoryCacheUserProviderFactory implements CacheUserProviderFactory {
+    protected MemoryUserCache cache;
+
+    @Override
+    public CacheUserProvider create(KeycloakSession session) {
+        return new DefaultCacheUserProvider(cache, session);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        config.get("");
+        cache = new MemoryUserCache();
+        int size = config.getInt("maxSize", 10000);
+        cache.setMaxUserCacheSize(size);
+    }
+
+    @Override
+    public void close() {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public String getId() {
+        return "mem";
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryUserCache.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryUserCache.java
new file mode 100755
index 0000000..360a02d
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/MemoryUserCache.java
@@ -0,0 +1,156 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.models.cache.entities.CachedUser;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class MemoryUserCache implements UserCache {
+
+    protected int maxUserCacheSize = 10000;
+    protected volatile boolean enabled = true;
+
+
+    protected class RealmUsers {
+        protected class LRUCache extends LinkedHashMap<String, CachedUser> {
+            public LRUCache() {
+                super(1000, 1.1F, true);
+            }
+
+            @Override
+            public CachedUser put(String key, CachedUser value) {
+                usersByUsername.put(value.getUsername(), value);
+                if (value.getEmail() != null) {
+                    usersByEmail.put(value.getEmail(), value);
+                }
+                return super.put(key, value);
+            }
+
+            @Override
+            public CachedUser remove(Object key) {
+                CachedUser user = super.remove(key);
+                if (user == null) return null;
+                removeUser(user);
+                return user;
+            }
+
+            @Override
+            public void clear() {
+                super.clear();
+                usersByUsername.clear();
+                usersByEmail.clear();
+            }
+
+            @Override
+            protected boolean removeEldestEntry(Map.Entry<String, CachedUser> eldest) {
+                boolean evict = size() > maxUserCacheSize;
+                if (evict) {
+                    removeUser(eldest.getValue());
+                }
+                return evict;
+            }
+
+            private void removeUser(CachedUser value) {
+                usersByUsername.remove(value.getUsername());
+                if (value.getEmail() != null) usersByEmail.remove(value.getEmail());
+            }
+        }
+
+        protected Map<String, CachedUser> usersById = Collections.synchronizedMap(new LRUCache());
+        protected Map<String, CachedUser> usersByUsername = new ConcurrentHashMap<String, CachedUser>();
+        protected Map<String, CachedUser> usersByEmail = new ConcurrentHashMap<String, CachedUser>();
+
+    }
+
+    protected ConcurrentHashMap<String, RealmUsers> realmUsers = new ConcurrentHashMap<String, RealmUsers>();
+
+    public int getMaxUserCacheSize() {
+        return maxUserCacheSize;
+    }
+
+    public void setMaxUserCacheSize(int maxUserCacheSize) {
+        this.maxUserCacheSize = maxUserCacheSize;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        clear();
+        this.enabled = enabled;
+        clear();
+    }
+
+    @Override
+    public CachedUser getCachedUser(String realmId, String id) {
+        if (realmId == null || id == null) return null;
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) return null;
+        return users.usersById.get(id);
+    }
+
+    @Override
+    public void invalidateCachedUser(String realmId, CachedUser user) {
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) return;
+        users.usersById.remove(user.getId());
+    }
+
+    @Override
+    public void invalidateCachedUserById(String realmId, String id) {
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) return;
+        users.usersById.remove(id);
+    }
+
+    @Override
+    public void addCachedUser(String realmId, CachedUser user) {
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) {
+            users = new RealmUsers();
+            realmUsers.put(realmId, users);
+        }
+        users.usersById.put(user.getId(), user);
+    }
+
+    @Override
+    public CachedUser getCachedUserByUsername(String realmId, String name) {
+        if (realmId == null || name == null) return null;
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) return null;
+        CachedUser user = users.usersByUsername.get(name);
+        if (user == null) return null;
+        users.usersById.get(user.getId()); // refresh cache entry age
+        return user;
+    }
+
+    @Override
+    public CachedUser getCachedUserByEmail(String realmId, String email) {
+        if (realmId == null || email == null) return null;
+        RealmUsers users = realmUsers.get(realmId);
+        if (users == null) return null;
+        CachedUser user = users.usersByEmail.get(email);
+        if (user == null) return null;
+        users.usersById.get(user.getId()); // refresh cache entry age
+        return user;
+    }
+
+    @Override
+    public void invalidateRealmUsers(String realmId) {
+        realmUsers.remove(realmId);
+    }
+
+    @Override
+    public void clear() {
+        realmUsers.clear();
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheRealmProvider.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheRealmProvider.java
new file mode 100755
index 0000000..e704042
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheRealmProvider.java
@@ -0,0 +1,112 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class NoCacheRealmProvider implements CacheRealmProvider {
+    protected KeycloakSession session;
+    protected RealmProvider delegate;
+
+    public NoCacheRealmProvider(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return false;  //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public RealmProvider getDelegate() {
+        if (delegate != null) return delegate;
+        delegate = session.getProvider(RealmProvider.class);
+        return delegate;
+    }
+
+    @Override
+    public void registerRealmInvalidation(String id) {
+    }
+
+    @Override
+    public void registerApplicationInvalidation(String id) {
+    }
+
+    @Override
+    public void registerRoleInvalidation(String id) {
+    }
+
+    @Override
+    public void registerOAuthClientInvalidation(String id) {
+    }
+
+    @Override
+    public RealmModel createRealm(String name) {
+        return getDelegate().createRealm(name);
+    }
+
+    @Override
+    public RealmModel createRealm(String id, String name) {
+        return getDelegate().createRealm(id, name);
+    }
+
+    @Override
+    public RealmModel getRealm(String id) {
+        return getDelegate().getRealm(id);
+    }
+
+    @Override
+    public RealmModel getRealmByName(String name) {
+        return getDelegate().getRealmByName(name);
+    }
+
+    @Override
+    public List<RealmModel> getRealms() {
+        // we don't cache this for now
+        return getDelegate().getRealms();
+    }
+
+    @Override
+    public boolean removeRealm(String id) {
+        return getDelegate().removeRealm(id);
+    }
+
+    @Override
+    public void close() {
+        if (delegate != null) delegate.close();
+    }
+
+    @Override
+    public RoleModel getRoleById(String id, RealmModel realm) {
+       return getDelegate().getRoleById(id, realm);
+    }
+
+    @Override
+    public ApplicationModel getApplicationById(String id, RealmModel realm) {
+        return getDelegate().getApplicationById(id, realm);
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClientById(String id, RealmModel realm) {
+        return getDelegate().getOAuthClientById(id, realm);
+    }
+
+    @Override
+    public void registerUserInvalidation(String id) {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java
new file mode 100755
index 0000000..6831a43
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java
@@ -0,0 +1,161 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserProvider;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class NoCacheUserProvider implements CacheUserProvider {
+    protected KeycloakSession session;
+    protected UserProvider delegate;
+
+    public NoCacheUserProvider(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return false;
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+    }
+
+    @Override
+    public UserProvider getDelegate() {
+        if (delegate != null) return delegate;
+        delegate = session.getProvider(UserProvider.class);
+        return delegate;
+    }
+
+    @Override
+    public void registerUserInvalidation(RealmModel realm, String id) {
+    }
+
+    @Override
+    public UserModel getUserById(String id, RealmModel realm) {
+        return getDelegate().getUserById(id, realm);
+    }
+
+    @Override
+    public UserModel getUserByUsername(String username, RealmModel realm) {
+        return getDelegate().getUserByUsername(username, realm);
+    }
+
+    @Override
+    public UserModel getUserByEmail(String email, RealmModel realm) {
+        return getDelegate().getUserByEmail(email, realm);
+    }
+
+    @Override
+    public void close() {
+        if (delegate != null) delegate.close();
+    }
+
+    @Override
+    public UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm) {
+        return getDelegate().getUserBySocialLink(socialLink, realm);
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm) {
+        return getDelegate().getUsers(realm);
+    }
+
+    @Override
+    public int getUsersCount(RealmModel realm) {
+        return getDelegate().getUsersCount(realm);
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm, int firstResult, int maxResults) {
+        return getDelegate().getUsers(realm, firstResult, maxResults);
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm) {
+        return getDelegate().searchForUser(search, realm);
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm, int firstResult, int maxResults) {
+        return getDelegate().searchForUser(search, realm, firstResult, maxResults);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm) {
+        return getDelegate().searchForUserByAttributes(attributes, realm);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm, int firstResult, int maxResults) {
+        return getDelegate().searchForUserByAttributes(attributes, realm, firstResult, maxResults);
+    }
+
+    @Override
+    public Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm) {
+        return getDelegate().getSocialLinks(user, realm);
+    }
+
+    @Override
+    public SocialLinkModel getSocialLink(UserModel user, String socialProvider, RealmModel realm) {
+        return getDelegate().getSocialLink(user, socialProvider, realm);
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String id, String username, boolean addDefaultRoles) {
+        return getDelegate().addUser(realm, id, username, addDefaultRoles);
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String username) {
+        return getDelegate().addUser(realm, username);
+    }
+
+    @Override
+    public boolean removeUser(RealmModel realm, UserModel user) {
+        return getDelegate().removeUser(realm, user);
+    }
+
+    @Override
+    public void addSocialLink(RealmModel realm, UserModel user, SocialLinkModel socialLink) {
+        getDelegate().addSocialLink(realm, user, socialLink);
+    }
+
+    @Override
+    public boolean removeSocialLink(RealmModel realm, UserModel user, String socialProvider) {
+        return getDelegate().removeSocialLink(realm, user, socialProvider);
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
+        return getDelegate().validCredentials(realm, user, input);
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
+        return getDelegate().validCredentials(realm, user, input);
+    }
+
+    @Override
+    public void preRemove(RealmModel realm) {
+        getDelegate().preRemove(realm);
+    }
+
+    @Override
+    public void preRemove(RealmModel realm, RoleModel role) {
+        getDelegate().preRemove(realm, role);
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProviderFactory.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProviderFactory.java
new file mode 100755
index 0000000..1008a00
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProviderFactory.java
@@ -0,0 +1,30 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class NoCacheUserProviderFactory implements CacheUserProviderFactory {
+    @Override
+    public CacheUserProvider create(KeycloakSession session) {
+        return new NoCacheUserProvider(session);
+    }
+
+    @Override
+    public void close() {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+        //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public String getId() {
+        return "none";
+    }
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/OAuthClientAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/OAuthClientAdapter.java
index 2831ea0..50708b9 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/OAuthClientAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/OAuthClientAdapter.java
@@ -12,7 +12,7 @@ public class OAuthClientAdapter extends ClientAdapter implements OAuthClientMode
     protected OAuthClientModel updated;
     protected CachedOAuthClient cached;
 
-    public OAuthClientAdapter(RealmModel cachedRealm, CachedOAuthClient cached, CacheModelProvider cacheSession, KeycloakCache cache) {
+    public OAuthClientAdapter(RealmModel cachedRealm, CachedOAuthClient cached, CacheRealmProvider cacheSession, RealmCache cache) {
         super(cachedRealm, cached, cache, cacheSession);
         this.cached = cached;
     }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RealmAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RealmAdapter.java
index 3b5158c..4d9bf61 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RealmAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RealmAdapter.java
@@ -1,23 +1,17 @@
 package org.keycloak.models.cache;
 
+import org.keycloak.Config;
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationProviderModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.UserFederationProviderModel;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.SocialLinkModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserCredentialValueModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.UsernameLoginFailureModel;
 import org.keycloak.models.cache.entities.CachedRealm;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
-import org.keycloak.models.utils.TimeBasedOTP;
 
 import java.security.PrivateKey;
 import java.security.PublicKey;
@@ -34,13 +28,13 @@ import java.util.Set;
  */
 public class RealmAdapter implements RealmModel {
     protected CachedRealm cached;
-    protected CacheModelProvider cacheSession;
+    protected CacheRealmProvider cacheSession;
     protected RealmModel updated;
-    protected KeycloakCache cache;
+    protected RealmCache cache;
     protected volatile transient PublicKey publicKey;
     protected volatile transient PrivateKey privateKey;
 
-    public RealmAdapter(CachedRealm cached, CacheModelProvider cacheSession) {
+    public RealmAdapter(CachedRealm cached, CacheRealmProvider cacheSession) {
         this.cached = cached;
         this.cacheSession = cacheSession;
     }
@@ -379,61 +373,6 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
-    public boolean validatePassword(UserModel user, String password) {
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
-                return new Pbkdf2PasswordEncoder(cred.getSalt()).verify(password, cred.getValue());
-
-            }
-        }
-        return false;
-    }
-
-    @Override
-    public boolean validateTOTP(UserModel user, String password, String token) {
-        if (!validatePassword(user, password)) return false;
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.TOTP)) {
-                return new TimeBasedOTP().validate(token, cred.getValue().getBytes());
-            }
-        }
-        return false;
-    }
-
-    @Override
-    public UserModel getUser(String name) {
-        return cacheSession.getUserByUsername(name, this);
-    }
-
-    @Override
-    public UserModel getUserByEmail(String email) {
-        return cacheSession.getUserByEmail(email, this);
-    }
-
-    @Override
-    public UserModel getUserById(String id) {
-        return cacheSession.getUserById(id, this);
-    }
-
-    @Override
-    public UserModel addUser(String id, String username) {
-        getDelegateForUpdate();
-        return updated.addUser(id, username);
-    }
-
-    @Override
-    public UserModel addUser(String username) {
-        getDelegateForUpdate();
-        return updated.addUser(username);
-    }
-
-    @Override
-    public boolean removeUser(String name) {
-        getDelegateForUpdate();
-        return updated.removeUser(name);
-    }
-
-    @Override
     public RoleModel getRoleById(String id) {
         if (updated != null) return updated.getRoleById(id);
         return cacheSession.getRoleById(id, this);
@@ -544,36 +483,6 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
-    public UserModel getUserBySocialLink(SocialLinkModel socialLink) {
-        if (updated != null) return updated.getUserBySocialLink(socialLink);
-        return cacheSession.getUserBySocialLink(socialLink, this);
-    }
-
-    @Override
-    public Set<SocialLinkModel> getSocialLinks(UserModel user) {
-        if (updated != null) return updated.getSocialLinks(user);
-        return cacheSession.getSocialLinks(user, this);
-    }
-
-    @Override
-    public SocialLinkModel getSocialLink(UserModel user, String socialProvider) {
-        if (updated != null) return updated.getSocialLink(user, socialProvider);
-        return cacheSession.getSocialLink(user, socialProvider, this);
-    }
-
-    @Override
-    public void addSocialLink(UserModel user, SocialLinkModel socialLink) {
-        getDelegateForUpdate();
-        updated.addSocialLink(user, socialLink);
-    }
-
-    @Override
-    public boolean removeSocialLink(UserModel user, String socialProvider) {
-        getDelegateForUpdate();
-        return updated.removeSocialLink(user, socialProvider);
-    }
-
-    @Override
     public boolean isSocial() {
         if (updated != null) return updated.isSocial();
         return cached.isSocial();
@@ -598,24 +507,6 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
-    public List<UserModel> getUsers() {
-        if (updated != null) return updated.getUsers();
-        return cacheSession.getUsers(this);
-    }
-
-    @Override
-    public List<UserModel> searchForUser(String search) {
-        if (updated != null) return updated.searchForUser(search);
-        return cacheSession.searchForUser(search, this);
-    }
-
-    @Override
-    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes) {
-        if (updated != null) return updated.searchForUserByAttributes(attributes);
-        return cacheSession.searchForUserByAttributes(attributes, this);
-    }
-
-    @Override
     public OAuthClientModel addOAuthClient(String name) {
         getDelegateForUpdate();
         OAuthClientModel client = updated.addOAuthClient(name);
@@ -715,6 +606,18 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
+    public List<UserFederationProviderModel> getUserFederationProviders() {
+        if (updated != null) return updated.getUserFederationProviders();
+        return cached.getFederationProviders();
+    }
+
+    @Override
+    public void setUserFederationProviders(List<UserFederationProviderModel> providers) {
+        getDelegateForUpdate();
+        updated.setUserFederationProviders(providers);
+    }
+
+    @Override
     public String getLoginTheme() {
         if (updated != null) return updated.getLoginTheme();
         return cached.getLoginTheme();
@@ -819,8 +722,7 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public ApplicationModel getMasterAdminApp() {
-        if (updated != null) return updated.getMasterAdminApp();
-        return getApplicationById(cached.getMasterAdminApp());
+        return cacheSession.getRealm(Config.getAdminRealm()).getApplicationById(cached.getMasterAdminApp());
     }
 
     @Override
@@ -880,83 +782,6 @@ public class RealmAdapter implements RealmModel {
         return getOAuthClientById(id);
     }
 
-
-    @Override
-    public UsernameLoginFailureModel getUserLoginFailure(String username) {
-        if (updated != null) return updated.getUserLoginFailure(username);
-        return cacheSession.getUserLoginFailure(username, this);
-    }
-
-    @Override
-    public UsernameLoginFailureModel addUserLoginFailure(String username) {
-        if (updated != null) return updated.addUserLoginFailure(username);
-        return cacheSession.addUserLoginFailure(username, this);
-    }
-
-    @Override
-    public List<UsernameLoginFailureModel> getAllUserLoginFailures() {
-        if (updated != null) return updated.getAllUserLoginFailures();
-        return cacheSession.getAllUserLoginFailures(this);
-    }
-
-    @Override
-    public UserSessionModel createUserSession(UserModel user, String ipAddress) {
-        if (updated != null) return updated.createUserSession(user, ipAddress);
-        return cacheSession.createUserSession(this, user, ipAddress);
-    }
-
-    @Override
-    public UserSessionModel getUserSession(String id) {
-        if (updated != null) return updated.getUserSession(id);
-        return cacheSession.getUserSession(id, this);
-    }
-
-    @Override
-    public List<UserSessionModel> getUserSessions(UserModel user) {
-        if (updated != null) return updated.getUserSessions(user);
-        return cacheSession.getUserSessions(user, this);
-    }
-
-    @Override
-    public void removeUserSession(UserSessionModel session) {
-        if (updated != null) {
-            updated.removeUserSession(session);
-        } else {
-            cacheSession.removeUserSession(session);
-
-        }
-    }
-
-    @Override
-    public void removeUserSessions(UserModel user) {
-        if (updated != null) {
-            updated.removeUserSessions(user);
-        } else {
-            cacheSession.removeUserSessions(this, user);
-
-        }
-    }
-
-    @Override
-    public void removeExpiredUserSessions() {
-        if (updated != null) {
-            updated.removeExpiredUserSessions();
-        } else {
-            cacheSession.removeExpiredUserSessions(this);
-
-        }
-    }
-
-    @Override
-    public void removeUserSessions() {
-        if (updated != null) {
-            updated.removeUserSessions();
-        } else {
-            cacheSession.removeUserSessions(this);
-
-        }
-    }
-
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RoleAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RoleAdapter.java
index bbf2766..18f6422 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RoleAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/RoleAdapter.java
@@ -19,11 +19,11 @@ public class RoleAdapter implements RoleModel {
 
     protected RoleModel updated;
     protected CachedRole cached;
-    protected KeycloakCache cache;
-    protected CacheModelProvider cacheSession;
+    protected RealmCache cache;
+    protected CacheRealmProvider cacheSession;
     protected RealmModel realm;
 
-    public RoleAdapter(CachedRole cached, KeycloakCache cache, CacheModelProvider session, RealmModel realm) {
+    public RoleAdapter(CachedRole cached, RealmCache cache, CacheRealmProvider session, RealmModel realm) {
         this.cached = cached;
         this.cache = cache;
         this.cacheSession = session;

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserAdapter.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserAdapter.java
index 727244c..9f4ffe3 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserAdapter.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserAdapter.java
@@ -2,6 +2,7 @@ package org.keycloak.models.cache;
 
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
@@ -22,21 +23,21 @@ import java.util.Set;
 public class UserAdapter implements UserModel {
     protected UserModel updated;
     protected CachedUser cached;
-    protected KeycloakCache cache;
-    protected CacheModelProvider cacheSession;
+    protected CacheUserProvider userProviderCache;
+    protected KeycloakSession keycloakSession;
     protected RealmModel realm;
 
-    public UserAdapter(CachedUser cached, KeycloakCache cache, CacheModelProvider session, RealmModel realm) {
+    public UserAdapter(CachedUser cached, CacheUserProvider userProvider, KeycloakSession keycloakSession, RealmModel realm) {
         this.cached = cached;
-        this.cache = cache;
-        this.cacheSession = session;
+        this.userProviderCache = userProvider;
+        this.keycloakSession = keycloakSession;
         this.realm = realm;
     }
 
     protected void getDelegateForUpdate() {
         if (updated == null) {
-            cacheSession.registerUserInvalidation(getId());
-            updated = cacheSession.getDelegate().getUserById(getId(), realm);
+            userProviderCache.registerUserInvalidation(realm, getId());
+            updated = userProviderCache.getDelegate().getUserById(getId(), realm);
             if (updated == null) throw new IllegalStateException("Not found in database");
         }
     }
@@ -47,15 +48,15 @@ public class UserAdapter implements UserModel {
     }
 
     @Override
-    public String getLoginName() {
-        if (updated != null) return updated.getLoginName();
-        return cached.getLoginName();
+    public String getUsername() {
+        if (updated != null) return updated.getUsername();
+        return cached.getUsername();
     }
 
     @Override
-    public void setLoginName(String loginName) {
+    public void setUsername(String username) {
         getDelegateForUpdate();
-        updated.setLoginName(loginName);
+        updated.setUsername(username);
     }
 
     @Override
@@ -173,18 +174,6 @@ public class UserAdapter implements UserModel {
     }
 
     @Override
-    public int getNotBefore() {
-        if (updated != null) return updated.getNotBefore();
-        return cached.getNotBefore();
-    }
-
-    @Override
-    public void setNotBefore(int notBefore) {
-        getDelegateForUpdate();
-        updated.setNotBefore(notBefore);
-    }
-
-    @Override
     public void updateCredential(UserCredentialModel cred) {
         getDelegateForUpdate();
         updated.updateCredential(cred);
@@ -215,6 +204,18 @@ public class UserAdapter implements UserModel {
     }
 
     @Override
+    public String getFederationLink() {
+        if (updated != null) return updated.getFederationLink();
+        return cached.getFederationLink();
+    }
+
+    @Override
+    public void setFederationLink(String link) {
+        getDelegateForUpdate();
+        updated.setFederationLink(link);
+   }
+
+    @Override
     public Set<RoleModel> getRealmRoleMappings() {
         if (updated != null) return updated.getRealmRoleMappings();
         Set<RoleModel> roleMappings = getRoleMappings();
@@ -269,7 +270,13 @@ public class UserAdapter implements UserModel {
         if (updated != null) return updated.getRoleMappings();
         Set<RoleModel> roles = new HashSet<RoleModel>();
         for (String id : cached.getRoleMappings()) {
-            roles.add(cacheSession.getRoleById(id, realm));
+            RoleModel roleById = keycloakSession.realms().getRoleById(id, realm);
+            if (roleById == null) {
+                // chance that role was removed, so just delete to persistence and get user invalidated
+                getDelegateForUpdate();
+                return updated.getRoleMappings();
+            }
+            roles.add(roleById);
 
         }
         return roles;

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserCache.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserCache.java
new file mode 100755
index 0000000..61f1188
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/UserCache.java
@@ -0,0 +1,29 @@
+package org.keycloak.models.cache;
+
+import org.keycloak.models.cache.entities.CachedUser;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public interface UserCache {
+    void clear();
+
+    CachedUser getCachedUser(String realmId, String id);
+
+    void invalidateCachedUser(String realmId, CachedUser user);
+
+    void addCachedUser(String realmId, CachedUser user);
+
+    CachedUser getCachedUserByUsername(String realmId, String name);
+
+    CachedUser getCachedUserByEmail(String realmId, String name);
+
+    void invalidateCachedUserById(String realmId, String id);
+
+    void invalidateRealmUsers(String realmId);
+
+    boolean isEnabled();
+
+    void setEnabled(boolean enabled);
+}

diff --git a/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheRealmProviderFactory b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheRealmProviderFactory
new file mode 100755
index 0000000..82ddea9
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheRealmProviderFactory
@@ -0,0 +1,2 @@
+org.keycloak.models.cache.MemoryCacheRealmProviderFactory
+org.keycloak.models.cache.NoCacheRealmProviderFactory
\ No newline at end of file

diff --git a/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheUserProviderFactory b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheUserProviderFactory
new file mode 100755
index 0000000..438f9e1
--- /dev/null
+++ b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.models.cache.CacheUserProviderFactory
@@ -0,0 +1,2 @@
+org.keycloak.models.cache.MemoryCacheUserProviderFactory
+org.keycloak.models.cache.NoCacheUserProviderFactory

diff --git a/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.provider.Spi b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.provider.Spi
index eb9e116..d793d8a 100755
--- a/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.provider.Spi
+++ b/model/invalidation-cache/model-adapters/src/main/resources/META-INF/services/org.keycloak.provider.Spi
@@ -1 +1,2 @@
-org.keycloak.models.cache.CacheModelProviderSpi
\ No newline at end of file
+org.keycloak.models.cache.CacheRealmProviderSpi
+org.keycloak.models.cache.CacheUserProviderSpi
\ No newline at end of file

diff --git a/model/jpa/pom.xml b/model/jpa/pom.xml
index 987abd2..52c7db5 100755
--- a/model/jpa/pom.xml
+++ b/model/jpa/pom.xml
@@ -37,6 +37,11 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-connections-jpa</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
             <artifactId>keycloak-invalidation-cache-model</artifactId>
             <version>${project.version}</version>
             <scope>test</scope>
@@ -53,6 +58,13 @@
             <scope>provided</scope>
         </dependency>
         <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-sessions-mem</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+
+        </dependency>
+        <dependency>
             <groupId>org.jboss.resteasy</groupId>
             <artifactId>resteasy-jaxrs</artifactId>
             <scope>provided</scope>
@@ -71,26 +83,6 @@
                 </exclusion>
             </exclusions>
         </dependency>
-
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-model-tests</artifactId>
-            <version>${project.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-model-tests</artifactId>
-            <version>${project.version}</version>
-            <classifier>tests</classifier>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>com.h2database</groupId>
-            <artifactId>h2</artifactId>
-            <scope>test</scope>
-        </dependency>
-
     </dependencies>
     <build>
         <plugins>
@@ -102,37 +94,6 @@
                     <target>${maven.compiler.target}</target>
                 </configuration>
             </plugin>
-
-            <!-- Test jar used in export-import -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>package-tests-jar</id>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>test-jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>default-test</id>
-                        <configuration>
-                            <dependenciesToScan>
-                                <dependency>org.keycloak:keycloak-model-tests</dependency>
-                            </dependenciesToScan>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
         </plugins>
     </build>
 

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/ApplicationAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/ApplicationAdapter.java
index 0ebe017..f83599c 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/ApplicationAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/ApplicationAdapter.java
@@ -2,12 +2,13 @@ package org.keycloak.models.jpa;
 
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.ClientModel;
-import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.jpa.entities.*;
+import org.keycloak.models.jpa.entities.ApplicationEntity;
+import org.keycloak.models.jpa.entities.RoleEntity;
+import org.keycloak.models.jpa.entities.ScopeMappingEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
 import javax.persistence.EntityManager;
@@ -25,10 +26,12 @@ import java.util.Set;
 public class ApplicationAdapter extends ClientAdapter implements ApplicationModel {
 
     protected EntityManager em;
+    protected KeycloakSession session;
     protected ApplicationEntity applicationEntity;
 
-    public ApplicationAdapter(RealmModel realm, EntityManager em, ApplicationEntity applicationEntity) {
+    public ApplicationAdapter(RealmModel realm, EntityManager em, KeycloakSession session, ApplicationEntity applicationEntity) {
         super(realm, applicationEntity, em);
+        this.session = session;
         this.realm = realm;
         this.em = em;
         this.applicationEntity = applicationEntity;
@@ -135,15 +138,15 @@ public class ApplicationAdapter extends ClientAdapter implements ApplicationMode
         }
         if (!roleModel.getContainer().equals(this)) return false;
 
+        session.users().preRemove(getRealm(), roleModel);
         RoleEntity role = RoleAdapter.toRoleEntity(roleModel, em);
         if (!role.isApplicationRole()) return false;
 
 
         applicationEntity.getRoles().remove(role);
         applicationEntity.getDefaultRoles().remove(role);
-        em.createNativeQuery("delete from CompositeRole where childRole = :role").setParameter("role", role).executeUpdate();
-        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", role).executeUpdate();
-        em.createQuery("delete from " + UserRoleMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", role).executeUpdate();
+        em.createNativeQuery("delete from COMPOSITE_ROLE where CHILD_ROLE = :role").setParameter("role", role).executeUpdate();
+        em.createNamedQuery("deleteScopeMappingByRole").setParameter("role", role).executeUpdate();
         role.setApplication(null);
         em.flush();
         em.remove(role);
@@ -164,6 +167,20 @@ public class ApplicationAdapter extends ClientAdapter implements ApplicationMode
     }
 
     @Override
+    public boolean hasScope(RoleModel role) {
+        if (super.hasScope(role)) {
+            return true;
+        }
+        Set<RoleModel> roles = getRoles();
+        if (roles.contains(role)) return true;
+
+        for (RoleModel mapping : roles) {
+            if (mapping.hasRole(role)) return true;
+        }
+        return false;
+    }
+
+    @Override
     public Set<RoleModel> getApplicationScopeMappings(ClientModel client) {
         Set<RoleModel> roleMappings = client.getScopeMappings();
 

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java
index 2e99658..6a07b5e 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/ClientAdapter.java
@@ -4,16 +4,12 @@ import org.keycloak.models.ClientModel;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.jpa.entities.ClientEntity;
-import org.keycloak.models.jpa.entities.ClientUserSessionAssociationEntity;
 import org.keycloak.models.jpa.entities.RoleEntity;
 import org.keycloak.models.jpa.entities.ScopeMappingEntity;
 
 import javax.persistence.EntityManager;
-import javax.persistence.Query;
 import javax.persistence.TypedQuery;
-import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -154,31 +150,6 @@ public abstract class ClientAdapter implements ClientModel {
     }
 
     @Override
-    public int getActiveUserSessions() {
-        Query query = em.createNamedQuery("getActiveClientSessions");
-        query.setParameter("clientId", getId());
-        Object count = query.getSingleResult();
-        return ((Number)count).intValue();
-    }
-
-    @Override
-    public Set<UserSessionModel> getUserSessions() {
-        Set<UserSessionModel> list = new HashSet<UserSessionModel>();
-        TypedQuery<ClientUserSessionAssociationEntity> query = em.createNamedQuery("getClientUserSessionByClient", ClientUserSessionAssociationEntity.class);
-        String id = getId();
-        query.setParameter("clientId", id);
-        List<ClientUserSessionAssociationEntity> results = query.getResultList();
-        for (ClientUserSessionAssociationEntity entity : results) {
-            list.add(new UserSessionAdapter(em, realm, entity.getSession()));
-        }
-        return list;
-    }
-
-    public void deleteUserSessionAssociation() {
-        em.createNamedQuery("removeClientUserSessionByClient").setParameter("clientId", getId()).executeUpdate();
-    }
-
-    @Override
     public Set<RoleModel> getRealmScopeMappings() {
         Set<RoleModel> roleMappings = getScopeMappings();
 

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ApplicationEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ApplicationEntity.java
index 8327bd0..c34761f 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ApplicationEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ApplicationEntity.java
@@ -1,25 +1,15 @@
 package org.keycloak.models.jpa.entities;
 
 import javax.persistence.CascadeType;
-import javax.persistence.CollectionTable;
-import javax.persistence.ElementCollection;
+import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
-import javax.persistence.Id;
 import javax.persistence.JoinColumn;
 import javax.persistence.JoinTable;
-import javax.persistence.ManyToOne;
 import javax.persistence.OneToMany;
-import javax.persistence.OneToOne;
 import javax.persistence.Table;
-import javax.persistence.UniqueConstraint;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.HashSet;
-import java.util.Set;
-
-import org.hibernate.annotations.GenericGenerator;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -28,16 +18,23 @@ import org.hibernate.annotations.GenericGenerator;
 @Entity
 public class ApplicationEntity extends ClientEntity {
 
+    @Column(name="SURROGATE_AUTH_REQUIRED")
     private boolean surrogateAuthRequired;
+
+    @Column(name="BASE_URL")
     private String baseUrl;
+
+    @Column(name="MANAGEMENT_URL")
     private String managementUrl;
+
+    @Column(name="BEARER_ONLY")
     private boolean bearerOnly;
 
     @OneToMany(fetch = FetchType.EAGER, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "application")
     Collection<RoleEntity> roles = new ArrayList<RoleEntity>();
 
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
-    @JoinTable(name="ApplicationDefaultRoles")
+    @JoinTable(name="APPLICATION_DEFAULT_ROLES", joinColumns = { @JoinColumn(name="APPLICATION_ID")}, inverseJoinColumns = { @JoinColumn(name="ROLE_ID")})
     Collection<RoleEntity> defaultRoles = new ArrayList<RoleEntity>();
 
     public boolean isSurrogateAuthRequired() {

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationLinkEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationLinkEntity.java
old mode 100644
new mode 100755
index e6ae8d4..e21b4fc
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationLinkEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationLinkEntity.java
@@ -1,36 +1,39 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
+import javax.persistence.FetchType;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
-import javax.persistence.OneToOne;
-
-import org.hibernate.annotations.GenericGenerator;
+import javax.persistence.OneToMany;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
+@NamedQueries({
+        @NamedQuery(name="deleteAuthenticationLinksByRealm", query="delete from AuthenticationLinkEntity authLink where authLink.user IN (select u from UserEntity u where u.realmId=:realmId)")
+})
+@Table(name="AUTHENTICATION_LINK")
 @Entity
+@IdClass(AuthenticationLinkEntity.Key.class)
 public class AuthenticationLinkEntity {
 
     @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
-    private String id;
-
+    @Column(name="AUTH_PROVIDER")
     protected String authProvider;
+    @Column(name="AUTH_USER_ID")
     protected String authUserId;
 
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
+    @Id
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name="USER_ID")
+    protected UserEntity user;
 
     public String getAuthProvider() {
         return authProvider;
@@ -47,4 +50,56 @@ public class AuthenticationLinkEntity {
     public void setAuthUserId(String authUserId) {
         this.authUserId = authUserId;
     }
+
+    public UserEntity getUser() {
+        return user;
+    }
+
+    public void setUser(UserEntity user) {
+        this.user = user;
+    }
+
+    public static class Key implements Serializable {
+
+        protected UserEntity user;
+
+        protected String authProvider;
+
+        public Key() {
+        }
+
+        public Key(UserEntity user, String authProvider) {
+            this.user = user;
+            this.authProvider = authProvider;
+        }
+
+        public UserEntity getUser() {
+            return user;
+        }
+
+        public String getAuthProvider() {
+            return authProvider;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (authProvider != null ? !authProvider.equals(key.authProvider) : key.authProvider != null) return false;
+            if (user != null ? !user.getId().equals(key.user != null ? key.user.getId() : null) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = user != null ? user.getId().hashCode() : 0;
+            result = 31 * result + (authProvider != null ? authProvider.hashCode() : 0);
+            return result;
+        }
+    }
+
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationProviderEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationProviderEntity.java
old mode 100644
new mode 100755
index 2ce4c12..89cfe49
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationProviderEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/AuthenticationProviderEntity.java
@@ -1,49 +1,54 @@
 package org.keycloak.models.jpa.entities;
 
-import java.util.Map;
-
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
+import javax.persistence.FetchType;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
 import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.Table;
-
-import org.hibernate.annotations.GenericGenerator;
+import java.io.Serializable;
+import java.util.Map;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 @Entity
-@Table(name="AuthProviderEntity")
+@Table(name="AUTH_PROVIDER")
+@IdClass(AuthenticationProviderEntity.Key.class)
 public class AuthenticationProviderEntity {
 
     @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
-    protected String id;
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "REALM_ID")
+    protected RealmEntity realm;
 
+    @Id
+    @Column(name="PROVIDER_NAME")
     private String providerName;
+    @Column(name="PASSWORD_UPDATE_SUPPORTED")
     private boolean passwordUpdateSupported;
+    @Column(name="PRIORITY")
     private int priority;
 
     @ElementCollection
-    @MapKeyColumn(name="name")
-    @Column(name="value")
-    @CollectionTable(name="AuthProviderEntity_cfg", joinColumns = {
-            @JoinColumn(name = "AuthProviderEntity_id")
-    })
+    @MapKeyColumn(name="NAME")
+    @Column(name="VALUE")
+    @CollectionTable(name="AUTH_PROVIDER_CONFIG", joinColumns = {
+            @JoinColumn(name="REALM_ID", referencedColumnName = "REALM_ID"),
+            @JoinColumn(name="AUTH_PROVIDER_NAME", referencedColumnName = "PROVIDER_NAME")})
     private Map<String, String> config;
 
-    public String getId() {
-        return id;
+    public RealmEntity getRealm() {
+        return realm;
     }
 
-    public void setId(String id) {
-        this.id = id;
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
     }
 
     public String getProviderName() {
@@ -77,4 +82,48 @@ public class AuthenticationProviderEntity {
     public void setConfig(Map<String, String> config) {
         this.config = config;
     }
+
+    public static class Key implements Serializable {
+
+        protected RealmEntity realm;
+
+        protected String providerName;
+
+        public Key() {
+        }
+
+        public Key(RealmEntity realm, String providerName) {
+            this.realm = realm;
+            this.providerName = providerName;
+        }
+
+        public RealmEntity getRealm() {
+            return realm;
+        }
+
+        public String getProviderName() {
+            return providerName;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (providerName != null ? !providerName.equals(key.providerName) : key.providerName != null) return false;
+            if (realm != null ? !realm.getId().equals(key.realm != null ? key.realm.getId() : null) : key.realm != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = realm != null ? realm.getId().hashCode() : 0;
+            result = 31 * result + (providerName != null ? providerName.hashCode() : 0);
+            return result;
+        }
+    }
+
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
index 9367d25..2f8625b 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ClientEntity.java
@@ -1,20 +1,15 @@
 package org.keycloak.models.jpa.entities;
 
-import org.hibernate.annotations.GenericGenerator;
-
-import javax.persistence.CascadeType;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
 import javax.persistence.Inheritance;
 import javax.persistence.InheritanceType;
 import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
-import javax.persistence.OneToMany;
 import javax.persistence.Table;
 import javax.persistence.UniqueConstraint;
 import java.util.HashSet;
@@ -26,27 +21,36 @@ import java.util.Set;
  */
 @Entity
 @Inheritance(strategy = InheritanceType.SINGLE_TABLE)
-@Table(uniqueConstraints = {@UniqueConstraint(columnNames = {"realm", "name"})})
+@Table(name="CLIENT", uniqueConstraints = {@UniqueConstraint(columnNames = {"REALM_ID", "NAME"})})
 public abstract class ClientEntity {
     @Id
+    @Column(name="ID", length = 36)
     private String id;
-    @Column(name = "name")
+    @Column(name = "NAME")
     private String name;
+    @Column(name="ENABLED")
     private boolean enabled;
+    @Column(name="SECRET")
     private String secret;
+    @Column(name="ALLOWED_CLAIMS_MASK")
     private long allowedClaimsMask;
+    @Column(name="NOT_BEFORE")
     private int notBefore;
+    @Column(name="PUBLIC_CLIENT")
     private boolean publicClient;
 
     @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "realm")
+    @JoinColumn(name = "REALM_ID")
     protected RealmEntity realm;
 
     @ElementCollection
-    @CollectionTable
+    @Column(name="VALUE")
+    @CollectionTable(name = "WEB_ORIGINS", joinColumns={ @JoinColumn(name="CLIENT_ID") })
     protected Set<String> webOrigins = new HashSet<String>();
+
     @ElementCollection
-    @CollectionTable
+    @Column(name="VALUE")
+    @CollectionTable(name = "REDIRECT_URIS", joinColumns={ @JoinColumn(name="CLIENT_ID") })
     protected Set<String> redirectUris = new HashSet<String>();
 
     public RealmEntity getRealm() {

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
index e18c2f8..d67402e 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/CredentialEntity.java
@@ -1,37 +1,56 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
-
-import org.hibernate.annotations.GenericGenerator;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 @NamedQueries({
-        @NamedQuery(name="credentialByUserAndType", query="select cred from CredentialEntity cred where cred.user = :user and cred.type = :type")
+        @NamedQuery(name="credentialByUserAndType", query="select cred from CredentialEntity cred where cred.user = :user and cred.type = :type"),
+        @NamedQuery(name="deleteCredentialsByRealm", query="delete from CredentialEntity cred where cred.user IN (select u from UserEntity u where u.realmId=:realmId)")
+
 })
+@Table(name="CREDENTIAL")
 @Entity
 public class CredentialEntity {
     @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
+    @Column(name="ID", length = 36)
     protected String id;
 
+    @Column(name="TYPE")
     protected String type;
+    @Column(name="VALUE")
     protected String value;
+    @Column(name="DEVICE")
     protected String device;
+    @Column(name="SALT")
     protected byte[] salt;
+    @Column(name="HASH_ITERATIONS")
+    protected int hashIterations;
 
     @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name="USER_ID")
     protected UserEntity user;
 
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
     public String getValue() {
         return value;
     }
@@ -48,14 +67,6 @@ public class CredentialEntity {
         this.type = type;
     }
 
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
     public String getDevice() {
         return device;
     }
@@ -80,5 +91,11 @@ public class CredentialEntity {
         this.salt = salt;
     }
 
+    public int getHashIterations() {
+        return hashIterations;
+    }
 
+    public void setHashIterations(int hashIterations) {
+        this.hashIterations = hashIterations;
+    }
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/FederationProviderEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/FederationProviderEntity.java
new file mode 100755
index 0000000..830065c
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/FederationProviderEntity.java
@@ -0,0 +1,85 @@
+package org.keycloak.models.jpa.entities;
+
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.Table;
+import java.io.Serializable;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ * @author <a href="mailto:bburke@redhat.com">Bill Burke</a>
+ */
+@Entity
+@Table(name="FEDERATION_PROVIDER")
+public class FederationProviderEntity {
+
+    @Id
+    @Column(name="ID", length = 36)
+    protected String id;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "REALM_ID")
+    protected RealmEntity realm;
+
+    @Column(name="PROVIDER_NAME")
+    private String providerName;
+    @Column(name="PRIORITY")
+    private int priority;
+
+    @ElementCollection
+    @MapKeyColumn(name="name")
+    @Column(name="value")
+    @CollectionTable(name="FEDERATION_PROVIDER_CONFIG")
+    private Map<String, String> config;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public RealmEntity getRealm() {
+        return realm;
+    }
+
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public void setProviderName(String providerName) {
+        this.providerName = providerName;
+    }
+
+    public int getPriority() {
+        return priority;
+    }
+
+    public void setPriority(int priority) {
+        this.priority = priority;
+    }
+
+    public Map<String, String> getConfig() {
+        return config;
+    }
+
+    public void setConfig(Map<String, String> config) {
+        this.config = config;
+    }
+
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OAuthClientEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OAuthClientEntity.java
index dbdf080..7fac887 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OAuthClientEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/OAuthClientEntity.java
@@ -1,6 +1,8 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
+import javax.persistence.Id;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
 
@@ -15,6 +17,7 @@ import javax.persistence.NamedQuery;
 })
 @Entity
 public class OAuthClientEntity extends ClientEntity {
+    @Column(name="DIRECT_GRANTS_ONLY")
     protected boolean directGrantsOnly;
 
     public boolean isDirectGrantsOnly() {

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java
index 8fd8a56..b7af403 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RealmEntity.java
@@ -8,12 +8,14 @@ import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
 import javax.persistence.Id;
+import javax.persistence.JoinColumn;
 import javax.persistence.JoinTable;
 import javax.persistence.MapKeyColumn;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
 import javax.persistence.OneToMany;
 import javax.persistence.OneToOne;
+import javax.persistence.Table;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
@@ -26,6 +28,7 @@ import java.util.Set;
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
+@Table(name="REALM")
 @Entity
 @NamedQueries({
         @NamedQuery(name="getAllRealms", query="select realm from RealmEntity realm"),
@@ -33,95 +36,130 @@ import java.util.Set;
 })
 public class RealmEntity {
     @Id
+    @Column(name="ID", length = 36)
     protected String id;
 
-    @Column(unique = true)
+    @Column(name="NAME", unique = true)
     protected String name;
 
+    @Column(name="ENABLED")
     protected boolean enabled;
+    @Column(name="SSL_NOT_REQUIRED")
     protected boolean sslNotRequired;
+    @Column(name="REGISTRATION_ALLOWED")
     protected boolean registrationAllowed;
+    @Column(name="PASSWORD_CRED_GRANT_ALLOWED")
     protected boolean passwordCredentialGrantAllowed;
+    @Column(name="VERIFY_EMAIL")
     protected boolean verifyEmail;
+    @Column(name="RESET_PASSWORD_ALLOWED")
     protected boolean resetPasswordAllowed;
+    @Column(name="SOCIAL")
     protected boolean social;
+    @Column(name="REMEMBER_ME")
     protected boolean rememberMe;
     //--- brute force settings
+    @Column(name="BRUTE_FORCE_PROTECTED")
     protected boolean bruteForceProtected;
+    @Column(name="MAX_FAILURE_WAIT")
     protected int maxFailureWaitSeconds;
+    @Column(name="MINIMUM_QUICK_LOGIN_WAIT")
     protected int minimumQuickLoginWaitSeconds;
+    @Column(name="WAIT_INCREMENT_SECONDS")
     protected int waitIncrementSeconds;
+    @Column(name="QUICK_LOGIN_CHECK")
     protected long quickLoginCheckMilliSeconds;
+    @Column(name="MAX_DELTA_TIME")
     protected int maxDeltaTimeSeconds;
+    @Column(name="FAILURE_FACTOR")
     protected int failureFactor;
     //--- end brute force settings
 
 
-    @Column(name="updateProfileOnInitSocLogin")
+    @Column(name="UPDATE_PROFILE_ON_SOC_LOGIN")
     protected boolean updateProfileOnInitialSocialLogin;
+    @Column(name="PASSWORD_POLICY")
     protected String passwordPolicy;
 
+    @Column(name="SSO_IDLE_TIMEOUT")
     private int ssoSessionIdleTimeout;
+    @Column(name="SSO_MAX_LIFESPAN")
     private int ssoSessionMaxLifespan;
+    @Column(name="ACCESS_TOKEN_LIFESPAN")
     protected int accessTokenLifespan;
+    @Column(name="ACCESS_CODE_LIFESPAN")
     protected int accessCodeLifespan;
+    @Column(name="USER_ACTION_LIFESPAN")
     protected int accessCodeLifespanUserAction;
+    @Column(name="NOT_BEFORE")
     protected int notBefore;
 
-    @Column(length = 2048)
+    @Column(name="PUBLIC_KEY", length = 2048)
     protected String publicKeyPem;
-    @Column(length = 2048)
+    @Column(name="PRIVATE_KEY", length = 2048)
     protected String privateKeyPem;
 
+    @Column(name="LOGIN_THEME")
     protected String loginTheme;
+    @Column(name="ACCOUNT_THEME")
     protected String accountTheme;
+    @Column(name="ADMIN_THEME")
     protected String adminTheme;
+    @Column(name="EMAIL_THEME")
     protected String emailTheme;
 
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
-    @JoinTable(name="User_RequiredCreds")
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
     Collection<RequiredCredentialEntity> requiredCredentials = new ArrayList<RequiredCredentialEntity>();
 
 
-    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
-    @JoinTable(name="AuthProviders")
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
     List<AuthenticationProviderEntity> authenticationProviders = new ArrayList<AuthenticationProviderEntity>();
 
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="FED_PROVIDERS")
+    List<FederationProviderEntity> federationProviders = new ArrayList<FederationProviderEntity>();
+
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="REALM_APPLICATION", joinColumns={ @JoinColumn(name="APPLICATION_ID") }, inverseJoinColumns={ @JoinColumn(name="REALM_ID") })
     Collection<ApplicationEntity> applications = new ArrayList<ApplicationEntity>();
 
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
     Collection<RoleEntity> roles = new ArrayList<RoleEntity>();
 
     @ElementCollection
-    @MapKeyColumn(name="name")
-    @Column(name="value")
-    @CollectionTable
+    @MapKeyColumn(name="NAME")
+    @Column(name="VALUE")
+    @CollectionTable(name="REALM_SMTP_CONFIG", joinColumns={ @JoinColumn(name="REALM_ID") })
     protected Map<String, String> smtpConfig = new HashMap<String, String>();
 
     @ElementCollection
-    @MapKeyColumn(name="name")
-    @Column(name="value")
-    @CollectionTable
+    @MapKeyColumn(name="NAME")
+    @Column(name="VALUE")
+    @CollectionTable(name="REALM_SOCIAL_CONFIG", joinColumns={ @JoinColumn(name="REALM_ID") })
     protected Map<String, String> socialConfig = new HashMap<String, String>();
 
     @ElementCollection
-    @MapKeyColumn(name="name")
-    @Column(name="value")
-    @CollectionTable
+    @MapKeyColumn(name="NAME")
+    @Column(name="VALUE")
+    @CollectionTable(name="REALM_LDAP_CONFIG", joinColumns={ @JoinColumn(name="REALM_ID") })
     protected Map<String, String> ldapServerConfig = new HashMap<String, String>();
 
     @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
-    @JoinTable(name="RealmDefaultRoles")
+    @JoinTable(name="REALM_DEFAULT_ROLES", joinColumns = { @JoinColumn(name="REALM_ID")}, inverseJoinColumns = { @JoinColumn(name="ROLE_ID")})
     protected Collection<RoleEntity> defaultRoles = new ArrayList<RoleEntity>();
 
+    @Column(name="AUDIT_ENABLED")
     protected boolean auditEnabled;
+    @Column(name="AUDIT_EXPIRATION")
     protected long auditExpiration;
 
     @ElementCollection
+    @Column(name="VALUE")
+    @CollectionTable(name="REALM_AUDIT_LISTENERS", joinColumns={ @JoinColumn(name="REALM_ID") })
     protected Set<String> auditListeners= new HashSet<String>();
 
     @OneToOne
+    @JoinColumn(name="MASTER_ADMIN_APP")
     protected ApplicationEntity masterAdminApp;
 
     public String getId() {
@@ -475,5 +513,12 @@ public class RealmEntity {
         this.masterAdminApp = masterAdminApp;
     }
 
+    public List<FederationProviderEntity> getFederationProviders() {
+        return federationProviders;
+    }
+
+    public void setFederationProviders(List<FederationProviderEntity> federationProviders) {
+        this.federationProviders = federationProviders;
+    }
 }
 

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RequiredCredentialEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RequiredCredentialEntity.java
index 9487022..7e4245c 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RequiredCredentialEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RequiredCredentialEntity.java
@@ -1,33 +1,45 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
+import javax.persistence.FetchType;
 import javax.persistence.Id;
-
-import org.hibernate.annotations.GenericGenerator;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
+@Table(name="REALM_REQUIRED_CREDENTIAL")
 @Entity
+@IdClass(RequiredCredentialEntity.Key.class)
 public class RequiredCredentialEntity {
+
     @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
-    protected String id;
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "REALM_ID")
+    protected RealmEntity realm;
 
+    @Id
+    @Column(name = "TYPE")
     protected String type;
+    @Column(name = "INPUT")
     protected boolean input;
+    @Column(name = "SECRET")
     protected boolean secret;
+    @Column(name = "FORM_LABEL")
     protected String formLabel;
 
-    public String getId() {
-        return id;
+    public RealmEntity getRealm() {
+        return realm;
     }
 
-    public void setId(String id) {
-        this.id = id;
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
     }
 
     public String getType() {
@@ -61,4 +73,48 @@ public class RequiredCredentialEntity {
     public void setFormLabel(String formLabel) {
         this.formLabel = formLabel;
     }
+
+    public static class Key implements Serializable {
+
+        protected RealmEntity realm;
+
+        protected String type;
+
+        public Key() {
+        }
+
+        public Key(RealmEntity realm, String type) {
+            this.realm = realm;
+            this.type = type;
+        }
+
+        public RealmEntity getRealm() {
+            return realm;
+        }
+
+        public String getType() {
+            return type;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (realm != null ? !realm.getId().equals(key.realm != null ? key.realm.getId() : null) : key.realm != null) return false;
+            if (type != null ? !type.equals(key.type) : key.type != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = realm != null ? realm.getId().hashCode() : 0;
+            result = 31 * result + (type != null ? type.hashCode() : 0);
+            return result;
+        }
+    }
+
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
index d3fc6df..a17f8e5 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/RoleEntity.java
@@ -3,10 +3,7 @@ package org.keycloak.models.jpa.entities;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
-import javax.persistence.Inheritance;
-import javax.persistence.InheritanceType;
 import javax.persistence.JoinColumn;
 import javax.persistence.JoinTable;
 import javax.persistence.ManyToMany;
@@ -18,15 +15,13 @@ import javax.persistence.UniqueConstraint;
 import java.util.ArrayList;
 import java.util.Collection;
 
-import org.hibernate.annotations.GenericGenerator;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 @Entity
-@Table(uniqueConstraints = {
-        @UniqueConstraint(columnNames = { "name", "appRealmConstraint" })
+@Table(name="KEYCLOAK_ROLE", uniqueConstraints = {
+        @UniqueConstraint(columnNames = { "NAME", "APP_REALM_CONSTRAINT" })
 })
 @NamedQueries({
         @NamedQuery(name="getAppRoleByName", query="select role from RoleEntity role where role.name = :name and role.application = :application"),
@@ -35,31 +30,35 @@ import org.hibernate.annotations.GenericGenerator;
 
 public class RoleEntity {
     @Id
-    @Column(name="id")
+    @Column(name="id", length = 36)
     private String id;
 
+    @Column(name = "NAME")
     private String name;
+    @Column(name = "DESCRIPTION")
     private String description;
 
     // hax! couldn't get constraint to work properly
+    @Column(name = "REALM_ID")
     private String realmId;
 
     @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "realm")
+    @JoinColumn(name = "REALM")
     private RealmEntity realm;
 
-    @Column(name="applicationRole")
+    @Column(name="APPLICATION_ROLE")
     private boolean applicationRole;
 
     @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "application")
+    @JoinColumn(name = "APPLICATION")
     private ApplicationEntity application;
 
     // Hack to ensure that either name+application or name+realm are unique. Needed due to MS-SQL as it don't allow multiple NULL values in the column, which is part of constraint
+    @Column(name="APP_REALM_CONSTRAINT", length = 36)
     private String appRealmConstraint;
 
     @ManyToMany(fetch = FetchType.LAZY, cascade = {})
-    @JoinTable(name = "CompositeRole", joinColumns = @JoinColumn(name = "composite"), inverseJoinColumns = @JoinColumn(name = "childRole"))
+    @JoinTable(name = "COMPOSITE_ROLE", joinColumns = @JoinColumn(name = "COMPOSITE"), inverseJoinColumns = @JoinColumn(name = "CHILD_ROLE"))
     private Collection<RoleEntity> compositeRoles = new ArrayList<RoleEntity>();
 
     public String getId() {

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ScopeMappingEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ScopeMappingEntity.java
index b45b69b..93d375d 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ScopeMappingEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/ScopeMappingEntity.java
@@ -1,15 +1,16 @@
 package org.keycloak.models.jpa.entities;
 
-import org.hibernate.annotations.GenericGenerator;
-
+import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
 import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -18,29 +19,25 @@ import javax.persistence.NamedQuery;
 @NamedQueries({
         @NamedQuery(name="hasScope", query="select m from ScopeMappingEntity m where m.client = :client and m.role = :role"),
         @NamedQuery(name="clientScopeMappings", query="select m from ScopeMappingEntity m where m.client = :client"),
-        @NamedQuery(name="clientScopeMappingIds", query="select m.role.id from ScopeMappingEntity m where m.client = :client")
+        @NamedQuery(name="clientScopeMappingIds", query="select m.role.id from ScopeMappingEntity m where m.client = :client"),
+        @NamedQuery(name="deleteScopeMappingByRole", query="delete from ScopeMappingEntity where role = :role"),
+        @NamedQuery(name="deleteScopeMappingByClient", query="delete from ScopeMappingEntity where client = :client")
 })
+@Table(name="SCOPE_MAPPING")
 @Entity
+@IdClass(ScopeMappingEntity.Key.class)
 public class ScopeMappingEntity {
+
     @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
-    protected String id;
     @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "CLIENT_ID")
     protected ClientEntity client;
 
+    @Id
     @ManyToOne(fetch= FetchType.LAZY)
-    @JoinColumn(name="roleId")
+    @JoinColumn(name="ROLE_ID")
     protected RoleEntity role;
 
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
     public ClientEntity getClient() {
         return client;
     }
@@ -57,4 +54,47 @@ public class ScopeMappingEntity {
         this.role = role;
     }
 
+    public static class Key implements Serializable {
+
+        protected ClientEntity client;
+
+        protected RoleEntity role;
+
+        public Key() {
+        }
+
+        public Key(ClientEntity client, RoleEntity role) {
+            this.client = client;
+            this.role = role;
+        }
+
+        public ClientEntity getClient() {
+            return client;
+        }
+
+        public RoleEntity getRole() {
+            return role;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (client != null ? !client.getId().equals(key.client != null ? key.client.getId() : null) : key.client != null) return false;
+            if (role != null ? !role.getId().equals(key.role != null ? key.role.getId() : null) : key.role != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = client != null ? client.getId().hashCode() : 0;
+            result = 31 * result + (role != null ? role.getId().hashCode() : 0);
+            return result;
+        }
+    }
+
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/SocialLinkEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/SocialLinkEntity.java
index a1de3af..de33d6c 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/SocialLinkEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/SocialLinkEntity.java
@@ -1,14 +1,16 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
-
-import org.hibernate.annotations.GenericGenerator;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -17,33 +19,31 @@ import org.hibernate.annotations.GenericGenerator;
 @NamedQueries({
         @NamedQuery(name="findSocialLinkByUser", query="select link from SocialLinkEntity link where link.user = :user"),
         @NamedQuery(name="findSocialLinkByUserAndProvider", query="select link from SocialLinkEntity link where link.user = :user and link.socialProvider = :socialProvider"),
-        @NamedQuery(name="findUserByLinkAndRealm", query="select link.user from SocialLinkEntity link where link.realm = :realm and link.socialProvider = :socialProvider and link.socialUserId = :socialUserId")
+        @NamedQuery(name="findUserByLinkAndRealm", query="select link.user from SocialLinkEntity link where link.realmId = :realmId and link.socialProvider = :socialProvider and link.socialUserId = :socialUserId"),
+        @NamedQuery(name="deleteSocialLinkByRealm", query="delete from SocialLinkEntity social where social.user IN (select u from UserEntity u where realmId=:realmId)"),
+        @NamedQuery(name="deleteSocialLinkByUser", query="delete from SocialLinkEntity social where social.user = :user")
 })
+@Table(name="USER_SOCIAL_LINK")
 @Entity
+@IdClass(SocialLinkEntity.Key.class)
 public class SocialLinkEntity {
-    @Id
-    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.jpa.utils.JpaIdGenerator")
-    @GeneratedValue(generator = "keycloak_generator")
-    private String id;
 
+    @Id
     @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "USER_ID")
     private UserEntity user;
 
-    @ManyToOne(fetch = FetchType.LAZY)
-    protected RealmEntity realm;
+    @Column(name = "REALM_ID")
+    protected String realmId;
 
+    @Id
+    @Column(name = "SOCIAL_PROVIDER")
     protected String socialProvider;
+    @Column(name = "SOCIAL_USER_ID")
     protected String socialUserId;
+    @Column(name = "SOCIAL_USERNAME")
     protected String socialUsername;
 
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
     public UserEntity getUser() {
         return user;
     }
@@ -76,11 +76,56 @@ public class SocialLinkEntity {
         this.socialUsername = socialUsername;
     }
 
-    public RealmEntity getRealm() {
-        return realm;
+    public String getRealmId() {
+        return realmId;
     }
 
-    public void setRealm(RealmEntity realm) {
-        this.realm = realm;
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
     }
+
+    public static class Key implements Serializable {
+
+        protected UserEntity user;
+
+        protected String socialProvider;
+
+        public Key() {
+        }
+
+        public Key(UserEntity user, String socialProvider) {
+            this.user = user;
+            this.socialProvider = socialProvider;
+        }
+
+        public UserEntity getUser() {
+            return user;
+        }
+
+        public String getSocialProvider() {
+            return socialProvider;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (socialProvider != null ? !socialProvider.equals(key.socialProvider) : key.socialProvider != null)
+                return false;
+            if (user != null ? !user.getId().equals(key.user != null ? key.user.getId() : null) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = user != null ? user.getId().hashCode() : 0;
+            result = 31 * result + (socialProvider != null ? socialProvider.hashCode() : 0);
+            return result;
+        }
+    }
+
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserAttributeEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserAttributeEntity.java
new file mode 100755
index 0000000..a861276
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserAttributeEntity.java
@@ -0,0 +1,105 @@
+package org.keycloak.models.jpa.entities;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@NamedQueries({
+        @NamedQuery(name="deleteUserAttributesByRealm", query="delete from  UserAttributeEntity attr where attr.user IN (select u from UserEntity u where u.realmId=:realmId)")
+})
+@Table(name="USER_ATTRIBUTE")
+@Entity
+@IdClass(UserAttributeEntity.Key.class)
+public class UserAttributeEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name = "USER_ID")
+    protected UserEntity user;
+
+    @Id
+    @Column(name = "NAME")
+    protected String name;
+    @Column(name = "VALUE")
+    protected String value;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public UserEntity getUser() {
+        return user;
+    }
+
+    public void setUser(UserEntity user) {
+        this.user = user;
+    }
+
+    public static class Key implements Serializable {
+
+        protected UserEntity user;
+
+        protected String name;
+
+        public Key() {
+        }
+
+        public Key(UserEntity user, String name) {
+            this.user = user;
+            this.name = name;
+        }
+
+        public UserEntity getUser() {
+            return user;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (name != null ? !name.equals(key.name) : key.name != null) return false;
+            if (user != null ? !user.getId().equals(key.user != null ? key.user.getId() : null) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = user != null ? user.getId().hashCode() : 0;
+            result = 31 * result + (name != null ? name.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
index 3b765b4..31e139a 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserEntity.java
@@ -1,6 +1,5 @@
 package org.keycloak.models.jpa.entities;
 
-import org.hibernate.annotations.GenericGenerator;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
@@ -10,7 +9,6 @@ import javax.persistence.Column;
 import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
 import javax.persistence.FetchType;
-import javax.persistence.GeneratedValue;
 import javax.persistence.Id;
 import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
@@ -21,7 +19,6 @@ import javax.persistence.OneToMany;
 import javax.persistence.OneToOne;
 import javax.persistence.Table;
 import javax.persistence.UniqueConstraint;
-
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
@@ -34,52 +31,62 @@ import java.util.Set;
  * @version $Revision: 1 $
  */
 @NamedQueries({
-        @NamedQuery(name="getRealmUserById", query="select u from UserEntity u where u.id = :id and u.realm = :realm"),
-        @NamedQuery(name="getRealmUserByLoginName", query="select u from UserEntity u where u.loginName = :loginName and u.realm = :realm"),
-        @NamedQuery(name="getRealmUserByEmail", query="select u from UserEntity u where u.email = :email and u.realm = :realm"),
-        @NamedQuery(name="getRealmUserByLastName", query="select u from UserEntity u where u.lastName = :lastName and u.realm = :realm"),
-        @NamedQuery(name="getRealmUserByFirstLastName", query="select u from UserEntity u where u.firstName = :first and u.lastName = :last and u.realm = :realm")
+        @NamedQuery(name="getAllUsersByRealm", query="select u from UserEntity u where u.realmId = :realmId order by u.username"),
+        @NamedQuery(name="searchForUser", query="select u from UserEntity u where u.realmId = :realmId and ( lower(u.username) like :search or lower(concat(u.firstName, ' ', u.lastName)) like :search or u.email like :search ) order by u.username"),
+        @NamedQuery(name="getRealmUserById", query="select u from UserEntity u where u.id = :id and u.realmId = :realmId"),
+        @NamedQuery(name="getRealmUserByUsername", query="select u from UserEntity u where u.username = :username and u.realmId = :realmId"),
+        @NamedQuery(name="getRealmUserByEmail", query="select u from UserEntity u where u.email = :email and u.realmId = :realmId"),
+        @NamedQuery(name="getRealmUserByLastName", query="select u from UserEntity u where u.lastName = :lastName and u.realmId = :realmId"),
+        @NamedQuery(name="getRealmUserByFirstLastName", query="select u from UserEntity u where u.firstName = :first and u.lastName = :last and u.realmId = :realmId"),
+        @NamedQuery(name="getRealmUserCount", query="select count(u) from UserEntity u where u.realmId = :realmId"),
+        @NamedQuery(name="deleteUsersByRealm", query="delete from UserEntity u where u.realmId = :realmId")
 })
 @Entity
-@Table(uniqueConstraints = {
-        @UniqueConstraint(columnNames = { "realm", "loginName" }),
-        @UniqueConstraint(columnNames = { "realm", "emailConstraint" })
+@Table(name="USER_ENTITY", uniqueConstraints = {
+        @UniqueConstraint(columnNames = { "REALM_ID", "USERNAME" }),
+        @UniqueConstraint(columnNames = { "REALM_ID", "EMAIL_CONSTRAINT" })
 })
 public class UserEntity {
     @Id
+    @Column(name="ID", length = 36)
     protected String id;
 
-    protected String loginName;
+    @Column(name = "USERNAME")
+    protected String username;
+    @Column(name = "FIRST_NAME")
     protected String firstName;
+    @Column(name = "LAST_NAME")
     protected String lastName;
+    @Column(name = "EMAIL")
     protected String email;
+    @Column(name = "ENABLED")
     protected boolean enabled;
+    @Column(name = "TOTP")
     protected boolean totp;
+    @Column(name = "EMAIL_VERIFIED")
     protected boolean emailVerified;
-    protected int notBefore;
 
     // Hack just to workaround the fact that on MS-SQL you can't have unique constraint with multiple NULL values TODO: Find better solution (like unique index with 'where' but that's proprietary)
+    @Column(name = "EMAIL_CONSTRAINT")
     protected String emailConstraint = KeycloakModelUtils.generateId();
 
-    @ManyToOne(fetch = FetchType.LAZY)
-    @JoinColumn(name = "realm")
-    protected RealmEntity realm;
+    @Column(name = "REALM_ID")
+    protected String realmId;
 
-    @ElementCollection
-    @MapKeyColumn(name="name")
-    @Column(name="value")
-    @CollectionTable
-    protected Map<String, String> attributes = new HashMap<String, String>();
+    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="user")
+    protected Collection<UserAttributeEntity> attributes = new ArrayList<UserAttributeEntity>();
 
-    @ElementCollection
-    @CollectionTable
-    protected Set<UserModel.RequiredAction> requiredActions = new HashSet<UserModel.RequiredAction>();
+    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="user")
+    protected Collection<UserRequiredActionEntity> requiredActions = new ArrayList<UserRequiredActionEntity>();
 
-    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true)
+    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="user")
     protected Collection<CredentialEntity> credentials = new ArrayList<CredentialEntity>();
 
-    @OneToOne(cascade = CascadeType.REMOVE, orphanRemoval = true)
-    protected AuthenticationLinkEntity authenticationLink;
+    @Column(name="federation_link")
+    protected String federationLink;
+
+    @OneToMany(cascade = CascadeType.REMOVE, orphanRemoval = true, mappedBy="user")
+    protected Collection<AuthenticationLinkEntity> authenticationLink;
 
     public String getId() {
         return id;
@@ -89,12 +96,12 @@ public class UserEntity {
         this.id = id;
     }
 
-    public String getLoginName() {
-        return loginName;
+    public String getUsername() {
+        return username;
     }
 
-    public void setLoginName(String loginName) {
-        this.loginName = loginName;
+    public void setUsername(String username) {
+        this.username = username;
     }
 
     public String getFirstName() {
@@ -154,28 +161,28 @@ public class UserEntity {
         this.emailVerified = emailVerified;
     }
 
-    public Map<String, String> getAttributes() {
+    public Collection<UserAttributeEntity> getAttributes() {
         return attributes;
     }
 
-    public void setAttributes(Map<String, String> attributes) {
+    public void setAttributes(Collection<UserAttributeEntity> attributes) {
         this.attributes = attributes;
     }
 
-    public Set<UserModel.RequiredAction> getRequiredActions() {
+    public Collection<UserRequiredActionEntity> getRequiredActions() {
         return requiredActions;
     }
 
-    public void setRequiredActions(Set<UserModel.RequiredAction> requiredActions) {
+    public void setRequiredActions(Collection<UserRequiredActionEntity> requiredActions) {
         this.requiredActions = requiredActions;
     }
 
-    public RealmEntity getRealm() {
-        return realm;
+    public String getRealmId() {
+        return realmId;
     }
 
-    public void setRealm(RealmEntity realm) {
-        this.realm = realm;
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
     }
 
     public Collection<CredentialEntity> getCredentials() {
@@ -186,19 +193,19 @@ public class UserEntity {
         this.credentials = credentials;
     }
 
-    public AuthenticationLinkEntity getAuthenticationLink() {
+    public Collection<AuthenticationLinkEntity> getAuthenticationLink() {
         return authenticationLink;
     }
 
-    public void setAuthenticationLink(AuthenticationLinkEntity authenticationLink) {
+    public void setAuthenticationLink(Collection<AuthenticationLinkEntity> authenticationLink) {
         this.authenticationLink = authenticationLink;
     }
 
-    public int getNotBefore() {
-        return notBefore;
+    public String getFederationLink() {
+        return federationLink;
     }
 
-    public void setNotBefore(int notBefore) {
-        this.notBefore = notBefore;
+    public void setFederationLink(String federationLink) {
+        this.federationLink = federationLink;
     }
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRequiredActionEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRequiredActionEntity.java
new file mode 100755
index 0000000..d2161e9
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRequiredActionEntity.java
@@ -0,0 +1,98 @@
+package org.keycloak.models.jpa.entities;
+
+import org.keycloak.models.UserModel;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@NamedQueries({
+        @NamedQuery(name="deleteUserRequiredActionsByRealm", query="delete from UserRequiredActionEntity action where action.user IN (select u from UserEntity u where u.realmId=:realmId)")
+})
+@Entity
+@Table(name="USER_REQUIRED_ACTION")
+@IdClass(UserRequiredActionEntity.Key.class)
+public class UserRequiredActionEntity {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name="USER_ID")
+    protected UserEntity user;
+
+    @Id
+    @Column(name="ACTION")
+    protected UserModel.RequiredAction action;
+
+    public UserModel.RequiredAction getAction() {
+        return action;
+    }
+
+    public void setAction(UserModel.RequiredAction action) {
+        this.action = action;
+    }
+
+    public UserEntity getUser() {
+        return user;
+    }
+
+    public void setUser(UserEntity user) {
+        this.user = user;
+    }
+
+    public static class Key implements Serializable {
+
+        protected UserEntity user;
+
+        protected UserModel.RequiredAction action;
+
+        public Key() {
+        }
+
+        public Key(UserEntity user, UserModel.RequiredAction action) {
+            this.user = user;
+            this.action = action;
+        }
+
+        public UserEntity getUser() {
+            return user;
+        }
+
+        public UserModel.RequiredAction getAction() {
+            return action;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (action != key.action) return false;
+            if (user != null ? !user.getId().equals(key.user != null ? key.user.getId() : null) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = user != null ? user.getId().hashCode() : 0;
+            result = 31 * result + (action != null ? action.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRoleMappingEntity.java b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRoleMappingEntity.java
index 647acea..608847b 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRoleMappingEntity.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/entities/UserRoleMappingEntity.java
@@ -1,19 +1,101 @@
 package org.keycloak.models.jpa.entities;
 
+import javax.persistence.Column;
 import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
 import javax.persistence.NamedQueries;
 import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+import java.io.Serializable;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
  */
 @NamedQueries({
-        @NamedQuery(name="userHasRole", query="select m from UserRoleMappingEntity m where m.user = :user and m.role = :role"),
+        @NamedQuery(name="userHasRole", query="select m from UserRoleMappingEntity m where m.user = :user and m.roleId = :roleId"),
         @NamedQuery(name="userRoleMappings", query="select m from UserRoleMappingEntity m where m.user = :user"),
-        @NamedQuery(name="userRoleMappingIds", query="select m.role.id from UserRoleMappingEntity m where m.user = :user")
+        @NamedQuery(name="userRoleMappingIds", query="select m.roleId from UserRoleMappingEntity m where m.user = :user"),
+        @NamedQuery(name="deleteUserRoleMappingsByRealm", query="delete from  UserRoleMappingEntity mapping where mapping.user IN (select u from UserEntity u where u.realmId=:realmId)"),
+        @NamedQuery(name="deleteUserRoleMappingsByRole", query="delete from UserRoleMappingEntity m where m.roleId = :roleId"),
+        @NamedQuery(name="deleteUserRoleMappingsByUser", query="delete from UserRoleMappingEntity m where m.user = :user")
+
 })
+@Table(name="USER_ROLE_MAPPING")
 @Entity
-public class UserRoleMappingEntity extends AbstractRoleMappingEntity {
+@IdClass(UserRoleMappingEntity.Key.class)
+public class UserRoleMappingEntity  {
+
+    @Id
+    @ManyToOne(fetch= FetchType.LAZY)
+    @JoinColumn(name="USER_ID")
+    protected UserEntity user;
+
+    @Id
+    @Column(name = "ROLE_ID")
+    protected String roleId;
+
+    public UserEntity getUser() {
+        return user;
+    }
+
+    public void setUser(UserEntity user) {
+        this.user = user;
+    }
+
+    public String getRoleId() {
+        return roleId;
+    }
+
+    public void setRoleId(String roleId) {
+        this.roleId = roleId;
+    }
+
+
+    public static class Key implements Serializable {
+
+        protected UserEntity user;
+
+        protected String roleId;
+
+        public Key() {
+        }
+
+        public Key(UserEntity user, String roleId) {
+            this.user = user;
+            this.roleId = roleId;
+        }
+
+        public UserEntity getUser() {
+            return user;
+        }
+
+        public String getRoleId() {
+            return roleId;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (!roleId.equals(key.roleId)) return false;
+            if (!user.equals(key.user)) return false;
+
+            return true;
+        }
 
+        @Override
+        public int hashCode() {
+            int result = user.hashCode();
+            result = 31 * result + roleId.hashCode();
+            return result;
+        }
+    }
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
new file mode 100755
index 0000000..a80485b
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProvider.java
@@ -0,0 +1,130 @@
+package org.keycloak.models.jpa;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.jpa.entities.ApplicationEntity;
+import org.keycloak.models.jpa.entities.OAuthClientEntity;
+import org.keycloak.models.jpa.entities.RealmEntity;
+import org.keycloak.models.jpa.entities.RoleEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaRealmProvider implements RealmProvider {
+    private final KeycloakSession session;
+    protected EntityManager em;
+
+    public JpaRealmProvider(KeycloakSession session, EntityManager em) {
+        this.session = session;
+        this.em = em;
+    }
+
+    @Override
+    public RealmModel createRealm(String name) {
+        return createRealm(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public RealmModel createRealm(String id, String name) {
+        RealmEntity realm = new RealmEntity();
+        realm.setName(name);
+        realm.setId(id);
+        em.persist(realm);
+        em.flush();
+        return new RealmAdapter(session, em, realm);
+    }
+
+    @Override
+    public RealmModel getRealm(String id) {
+        RealmEntity realm = em.find(RealmEntity.class, id);
+        if (realm == null) return null;
+        return new RealmAdapter(session, em, realm);
+    }
+
+    @Override
+    public List<RealmModel> getRealms() {
+        TypedQuery<RealmEntity> query = em.createNamedQuery("getAllRealms", RealmEntity.class);
+        List<RealmEntity> entities = query.getResultList();
+        List<RealmModel> realms = new ArrayList<RealmModel>();
+        for (RealmEntity entity : entities) {
+            realms.add(new RealmAdapter(session, em, entity));
+        }
+        return realms;
+    }
+
+    @Override
+    public RealmModel getRealmByName(String name) {
+        TypedQuery<RealmEntity> query = em.createNamedQuery("getRealmByName", RealmEntity.class);
+        query.setParameter("name", name);
+        List<RealmEntity> entities = query.getResultList();
+        if (entities.size() == 0) return null;
+        if (entities.size() > 1) throw new IllegalStateException("Should not be more than one realm with same name");
+        RealmEntity realm = query.getResultList().get(0);
+        if (realm == null) return null;
+        return new RealmAdapter(session, em, realm);
+    }
+
+    @Override
+    public boolean removeRealm(String id) {
+        RealmEntity realm = em.find(RealmEntity.class, id);
+        if (realm == null) {
+            return false;
+        }
+
+        RealmAdapter adapter = new RealmAdapter(session, em, realm);
+        session.users().preRemove(adapter);
+        for (ApplicationEntity a : new LinkedList<ApplicationEntity>(realm.getApplications())) {
+            adapter.removeApplication(a.getId());
+        }
+
+        for (OAuthClientModel oauth : adapter.getOAuthClients()) {
+            adapter.removeOAuthClient(oauth.getId());
+        }
+
+       em.remove(realm);
+        return true;
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public RoleModel getRoleById(String id, RealmModel realm) {
+        RoleEntity entity = em.find(RoleEntity.class, id);
+        if (entity == null) return null;
+        if (!realm.getId().equals(entity.getRealmId())) return null;
+        return new RoleAdapter(realm, em, entity);
+    }
+
+    @Override
+    public ApplicationModel getApplicationById(String id, RealmModel realm) {
+        ApplicationEntity app = em.find(ApplicationEntity.class, id);
+
+        // Check if application belongs to this realm
+        if (app == null || !realm.getId().equals(app.getRealm().getId())) return null;
+        return new ApplicationAdapter(realm, em, session, app);
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClientById(String id, RealmModel realm) {
+        OAuthClientEntity client = em.find(OAuthClientEntity.class, id);
+
+        // Check if client belongs to this realm
+        if (client == null || !realm.getId().equals(client.getRealm().getId())) return null;
+        return new OAuthClientAdapter(realm, client, em);
+    }
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProviderFactory.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProviderFactory.java
new file mode 100755
index 0000000..7e090c2
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaRealmProviderFactory.java
@@ -0,0 +1,36 @@
+package org.keycloak.models.jpa;
+
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.RealmProviderFactory;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaRealmProviderFactory implements RealmProviderFactory {
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public String getId() {
+        return "jpa";
+    }
+
+    @Override
+    public RealmProvider create(KeycloakSession session) {
+        EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        return new JpaRealmProvider(session, em);
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
new file mode 100755
index 0000000..b3e5bf7
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
@@ -0,0 +1,327 @@
+package org.keycloak.models.jpa;
+
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.SocialLinkModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserProvider;
+import org.keycloak.models.jpa.entities.AuthenticationLinkEntity;
+import org.keycloak.models.jpa.entities.SocialLinkEntity;
+import org.keycloak.models.jpa.entities.UserEntity;
+import org.keycloak.models.utils.CredentialValidation;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaUserProvider implements UserProvider {
+    private final KeycloakSession session;
+    protected EntityManager em;
+
+    public JpaUserProvider(KeycloakSession session, EntityManager em) {
+        this.session = session;
+        this.em = em;
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String id, String username, boolean addDefaultRoles) {
+        if (id == null) {
+            id = KeycloakModelUtils.generateId();
+        }
+
+        UserEntity entity = new UserEntity();
+        entity.setId(id);
+        entity.setUsername(username);
+        entity.setRealmId(realm.getId());
+        em.persist(entity);
+        em.flush();
+        UserModel userModel = new UserAdapter(realm, em, entity);
+
+        if (addDefaultRoles) {
+            for (String r : realm.getDefaultRoles()) {
+                userModel.grantRole(realm.getRole(r));
+            }
+
+            for (ApplicationModel application : realm.getApplications()) {
+                for (String r : application.getDefaultRoles()) {
+                    userModel.grantRole(application.getRole(r));
+                }
+            }
+        }
+
+        return userModel;
+    }
+
+    @Override
+    public UserModel addUser(RealmModel realm, String username) {
+        return addUser(realm, KeycloakModelUtils.generateId(), username, true);
+    }
+
+    @Override
+    public boolean removeUser(RealmModel realm, UserModel user) {
+        UserEntity userEntity = em.find(UserEntity.class, user.getId());
+        if (userEntity == null) return false;
+        removeUser(userEntity);
+        return true;
+    }
+
+    private void removeUser(UserEntity user) {
+        em.createNamedQuery("deleteUserRoleMappingsByUser").setParameter("user", user).executeUpdate();
+        em.createNamedQuery("deleteSocialLinkByUser").setParameter("user", user).executeUpdate();
+        if (user.getAuthenticationLink() != null) {
+            for (AuthenticationLinkEntity l : user.getAuthenticationLink()) {
+                em.remove(l);
+            }
+        }
+        em.remove(user);
+    }
+
+    @Override
+    public void addSocialLink(RealmModel realm, UserModel user, SocialLinkModel socialLink) {
+        SocialLinkEntity entity = new SocialLinkEntity();
+        entity.setRealmId(realm.getId());
+        entity.setSocialProvider(socialLink.getSocialProvider());
+        entity.setSocialUserId(socialLink.getSocialUserId());
+        entity.setSocialUsername(socialLink.getSocialUsername());
+        UserEntity userEntity = em.getReference(UserEntity.class, user.getId());
+        entity.setUser(userEntity);
+        em.persist(entity);
+        em.flush();
+    }
+
+    @Override
+    public boolean removeSocialLink(RealmModel realm, UserModel user, String socialProvider) {
+        SocialLinkEntity entity = findSocialLink(user, socialProvider);
+        if (entity != null) {
+            em.remove(entity);
+            em.flush();
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+
+
+    @Override
+    public void preRemove(RealmModel realm) {
+        int num = em.createNamedQuery("deleteUserRoleMappingsByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteUserRequiredActionsByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteSocialLinkByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteCredentialsByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteUserAttributesByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteAuthenticationLinksByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+        num = em.createNamedQuery("deleteUsersByRealm")
+                .setParameter("realmId", realm.getId()).executeUpdate();
+    }
+
+    @Override
+    public void preRemove(RealmModel realm, RoleModel role) {
+        em.createNamedQuery("deleteUserRoleMappingsByRole").setParameter("roleId", role.getId()).executeUpdate();
+    }
+
+    @Override
+    public UserModel getUserById(String id, RealmModel realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserById", UserEntity.class);
+        query.setParameter("id", id);
+        query.setParameter("realmId", realm.getId());
+        List<UserEntity> entities = query.getResultList();
+        if (entities.size() == 0) return null;
+        return new UserAdapter(realm, em, entities.get(0));
+    }
+
+    @Override
+    public UserModel getUserByUsername(String username, RealmModel realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByUsername", UserEntity.class);
+        query.setParameter("username", username);
+        query.setParameter("realmId", realm.getId());
+        List<UserEntity> results = query.getResultList();
+        if (results.size() == 0) return null;
+        return new UserAdapter(realm, em, results.get(0));
+    }
+
+    @Override
+    public UserModel getUserByEmail(String email, RealmModel realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByEmail", UserEntity.class);
+        query.setParameter("email", email);
+        query.setParameter("realmId", realm.getId());
+        List<UserEntity> results = query.getResultList();
+        return results.isEmpty() ? null : new UserAdapter(realm, em, results.get(0));
+    }
+
+     @Override
+    public void close() {
+    }
+
+    @Override
+    public UserModel getUserBySocialLink(SocialLinkModel socialLink, RealmModel realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("findUserByLinkAndRealm", UserEntity.class);
+        query.setParameter("realmId", realm.getId());
+        query.setParameter("socialProvider", socialLink.getSocialProvider());
+        query.setParameter("socialUserId", socialLink.getSocialUserId());
+        List<UserEntity> results = query.getResultList();
+        if (results.isEmpty()) {
+            return null;
+        } else if (results.size() > 1) {
+            throw new IllegalStateException("More results found for socialProvider=" + socialLink.getSocialProvider() +
+                    ", socialUserId=" + socialLink.getSocialUserId() + ", results=" + results);
+        } else {
+            UserEntity user = results.get(0);
+            return new UserAdapter(realm, em, user);
+        }
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm) {
+        return getUsers(realm, -1, -1);
+    }
+
+    @Override
+    public int getUsersCount(RealmModel realm) {
+        // TODO: named query?
+        Object count = em.createNamedQuery("getRealmUserCount")
+                .setParameter("realmId", realm.getId())
+                .getSingleResult();
+        return ((Number)count).intValue();
+    }
+
+    @Override
+    public List<UserModel> getUsers(RealmModel realm, int firstResult, int maxResults) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getAllUsersByRealm", UserEntity.class);
+        query.setParameter("realmId", realm.getId());
+        if (firstResult != -1) {
+            query.setFirstResult(firstResult);
+        }
+        if (maxResults != -1) {
+            query.setMaxResults(maxResults);
+        }
+        List<UserEntity> results = query.getResultList();
+        List<UserModel> users = new ArrayList<UserModel>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm) {
+        return searchForUser(search, realm, -1, -1);
+    }
+
+    @Override
+    public List<UserModel> searchForUser(String search, RealmModel realm, int firstResult, int maxResults) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("searchForUser", UserEntity.class);
+        query.setParameter("realmId", realm.getId());
+        query.setParameter("search", "%" + search.toLowerCase() + "%");
+        if (firstResult != -1) {
+            query.setFirstResult(firstResult);
+        }
+        if (maxResults != -1) {
+            query.setMaxResults(maxResults);
+        }
+        List<UserEntity> results = query.getResultList();
+        List<UserModel> users = new ArrayList<UserModel>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm) {
+        return searchForUserByAttributes(attributes, realm, -1, -1);
+    }
+
+    @Override
+    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes, RealmModel realm, int firstResult, int maxResults) {
+        StringBuilder builder = new StringBuilder("select u from UserEntity u");
+        boolean first = true;
+        for (Map.Entry<String, String> entry : attributes.entrySet()) {
+            String attribute = null;
+            if (entry.getKey().equals(UserModel.USERNAME)) {
+                attribute = "lower(username)";
+            } else if (entry.getKey().equalsIgnoreCase(UserModel.FIRST_NAME)) {
+                attribute = "lower(firstName)";
+            } else if (entry.getKey().equalsIgnoreCase(UserModel.LAST_NAME)) {
+                attribute = "lower(lastName)";
+            } else if (entry.getKey().equalsIgnoreCase(UserModel.EMAIL)) {
+                attribute = "lower(email)";
+            }
+            if (attribute == null) continue;
+            if (first) {
+                first = false;
+                builder.append(" where realm = :realm");
+            } else {
+                builder.append(" and ");
+            }
+            builder.append(attribute).append(" like '%").append(entry.getValue().toLowerCase()).append("%'");
+        }
+        builder.append(" order by u.username");
+        String q = builder.toString();
+        TypedQuery<UserEntity> query = em.createQuery(q, UserEntity.class);
+        query.setParameter("realmId", realm.getId());
+        if (firstResult != -1) {
+            query.setFirstResult(firstResult);
+        }
+        if (maxResults != -1) {
+            query.setMaxResults(maxResults);
+        }
+        List<UserEntity> results = query.getResultList();
+        List<UserModel> users = new ArrayList<UserModel>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    private SocialLinkEntity findSocialLink(UserModel user, String socialProvider) {
+        TypedQuery<SocialLinkEntity> query = em.createNamedQuery("findSocialLinkByUserAndProvider", SocialLinkEntity.class);
+        UserEntity userEntity = em.getReference(UserEntity.class, user.getId());
+        query.setParameter("user", userEntity);
+        query.setParameter("socialProvider", socialProvider);
+        List<SocialLinkEntity> results = query.getResultList();
+        return results.size() > 0 ? results.get(0) : null;
+    }
+
+
+    @Override
+    public Set<SocialLinkModel> getSocialLinks(UserModel user, RealmModel realm) {
+        TypedQuery<SocialLinkEntity> query = em.createNamedQuery("findSocialLinkByUser", SocialLinkEntity.class);
+        UserEntity userEntity = em.getReference(UserEntity.class, user.getId());
+        query.setParameter("user", userEntity);
+        List<SocialLinkEntity> results = query.getResultList();
+        Set<SocialLinkModel> set = new HashSet<SocialLinkModel>();
+        for (SocialLinkEntity entity : results) {
+            set.add(new SocialLinkModel(entity.getSocialProvider(), entity.getSocialUserId(), entity.getSocialUsername()));
+        }
+        return set;
+    }
+
+    @Override
+    public SocialLinkModel getSocialLink(UserModel user, String socialProvider, RealmModel realm) {
+        SocialLinkEntity entity = findSocialLink(user, socialProvider);
+        return (entity != null) ? new SocialLinkModel(entity.getSocialProvider(), entity.getSocialUserId(), entity.getSocialUsername()) : null;
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
+        return CredentialValidation.validCredentials(realm, user, input);
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
+        return CredentialValidation.validCredentials(realm, user, input);
+    }
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProviderFactory.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProviderFactory.java
new file mode 100755
index 0000000..3a52f12
--- /dev/null
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProviderFactory.java
@@ -0,0 +1,36 @@
+package org.keycloak.models.jpa;
+
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserProvider;
+import org.keycloak.models.UserProviderFactory;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaUserProviderFactory implements UserProviderFactory {
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public String getId() {
+        return "jpa";
+    }
+
+    @Override
+    public UserProvider create(KeycloakSession session) {
+        EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        return new JpaUserProvider(session, em);
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/OAuthClientAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/OAuthClientAdapter.java
index c890c9f..2279163 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/OAuthClientAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/OAuthClientAdapter.java
@@ -1,14 +1,10 @@
 package org.keycloak.models.jpa;
 
-import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.UserModel;
 import org.keycloak.models.jpa.entities.OAuthClientEntity;
 
 import javax.persistence.EntityManager;
-import java.util.HashSet;
-import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/PersistenceExceptionConverter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/PersistenceExceptionConverter.java
old mode 100644
new mode 100755
index dfa5053..62a9426
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/PersistenceExceptionConverter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/PersistenceExceptionConverter.java
@@ -1,12 +1,11 @@
 package org.keycloak.models.jpa;
 
 import org.hibernate.exception.ConstraintViolationException;
-import org.keycloak.models.ModelException;
 import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
 
 import javax.persistence.EntityExistsException;
 import javax.persistence.EntityManager;
-import javax.persistence.PersistenceException;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
index a985f3d..e65e377 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/RealmAdapter.java
@@ -1,44 +1,26 @@
 package org.keycloak.models.jpa;
 
-import org.keycloak.models.AuthenticationLinkModel;
+import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationProviderModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.jpa.entities.FederationProviderEntity;
 import org.keycloak.models.KeycloakSession;
-import org.keycloak.models.ModelDuplicateException;
-import org.keycloak.models.RoleContainerModel;
-import org.keycloak.models.UserCredentialValueModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredCredentialModel;
+import org.keycloak.models.RoleModel;
 import org.keycloak.models.jpa.entities.ApplicationEntity;
-import org.keycloak.models.jpa.entities.AuthenticationLinkEntity;
 import org.keycloak.models.jpa.entities.AuthenticationProviderEntity;
 import org.keycloak.models.jpa.entities.OAuthClientEntity;
 import org.keycloak.models.jpa.entities.RealmEntity;
 import org.keycloak.models.jpa.entities.RequiredCredentialEntity;
 import org.keycloak.models.jpa.entities.RoleEntity;
-import org.keycloak.models.jpa.entities.ScopeMappingEntity;
-import org.keycloak.models.jpa.entities.SocialLinkEntity;
-import org.keycloak.models.jpa.entities.UserEntity;
-import org.keycloak.models.jpa.entities.UserSessionEntity;
-import org.keycloak.models.jpa.entities.UserRoleMappingEntity;
-import org.keycloak.models.jpa.entities.UsernameLoginFailureEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
-import org.keycloak.models.ApplicationModel;
-import org.keycloak.models.OAuthClientModel;
-import org.keycloak.models.PasswordPolicy;
-import org.keycloak.models.RealmModel;
-import org.keycloak.models.RequiredCredentialModel;
-import org.keycloak.models.RoleModel;
-import org.keycloak.models.SocialLinkModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.utils.TimeBasedOTP;
-import org.keycloak.util.Time;
 
 import javax.persistence.EntityManager;
 import javax.persistence.TypedQuery;
-
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.util.ArrayList;
@@ -48,13 +30,10 @@ import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import static org.keycloak.models.utils.Pbkdf2PasswordEncoder.*;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $
@@ -370,6 +349,7 @@ public class RealmAdapter implements RealmModel {
 
     public void addRequiredCredential(RequiredCredentialModel model) {
         RequiredCredentialEntity entity = new RequiredCredentialEntity();
+        entity.setRealm(realm);
         entity.setInput(model.isInput());
         entity.setSecret(model.isSecret());
         entity.setType(model.getType());
@@ -424,87 +404,6 @@ public class RealmAdapter implements RealmModel {
 
 
     @Override
-    public UserModel getUser(String name) {
-        return session.getUserByUsername(name, this);
-    }
-
-    @Override
-    public UsernameLoginFailureModel getUserLoginFailure(String username) {
-        return session.getUserLoginFailure(username, this);
-    }
-
-    @Override
-    public UsernameLoginFailureModel addUserLoginFailure(String username) {
-        return session.addUserLoginFailure(username, this);
-    }
-
-    @Override
-    public List<UsernameLoginFailureModel> getAllUserLoginFailures() {
-        return session.getAllUserLoginFailures(this);
-    }
-
-    @Override
-    public UserModel getUserByEmail(String email) {
-        return session.getUserByEmail(email, this);
-    }
-
-    @Override
-    public UserModel getUserById(String id) {
-        return session.getUserById(id, this);
-    }
-
-    @Override
-    public UserModel addUser(String username) {
-        return this.addUser(KeycloakModelUtils.generateId(), username);
-    }
-
-    @Override
-    public UserModel addUser(String id, String username) {
-        UserEntity entity = new UserEntity();
-        entity.setId(id);
-        entity.setLoginName(username);
-        entity.setRealm(realm);
-        em.persist(entity);
-        em.flush();
-        UserModel userModel = new UserAdapter(this, em, entity);
-
-        for (String r : getDefaultRoles()) {
-            userModel.grantRole(getRole(r));
-        }
-
-        for (ApplicationModel application : getApplications()) {
-            for (String r : application.getDefaultRoles()) {
-                userModel.grantRole(application.getRole(r));
-            }
-        }
-
-        return userModel;
-    }
-
-    @Override
-    public boolean removeUser(String name) {
-        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByLoginName", UserEntity.class);
-        query.setParameter("loginName", name);
-        query.setParameter("realm", realm);
-        List<UserEntity> results = query.getResultList();
-        if (results.size() == 0) return false;
-        removeUser(results.get(0));
-        return true;
-    }
-
-    private void removeUser(UserEntity user) {
-        em.createNamedQuery("removeClientUserSessionByUser").setParameter("userId", user.getId()).executeUpdate();
-        em.createNamedQuery("removeUserSessionByUser").setParameter("userId", user.getId()).executeUpdate();
-
-        em.createQuery("delete from " + UserRoleMappingEntity.class.getSimpleName() + " where user = :user").setParameter("user", user).executeUpdate();
-        em.createQuery("delete from " + SocialLinkEntity.class.getSimpleName() + " where user = :user").setParameter("user", user).executeUpdate();
-        if (user.getAuthenticationLink() != null) {
-            em.remove(user.getAuthenticationLink());
-        }
-        em.remove(user);
-    }
-
-    @Override
     public List<String> getDefaultRoles() {
         Collection<RoleEntity> entities = realm.getDefaultRoles();
         List<String> roles = new ArrayList<String>();
@@ -591,7 +490,7 @@ public class RealmAdapter implements RealmModel {
         List<ApplicationModel> list = new ArrayList<ApplicationModel>();
         if (realm.getApplications() == null) return list;
         for (ApplicationEntity entity : realm.getApplications()) {
-            list.add(new ApplicationAdapter(this, em, entity));
+            list.add(new ApplicationAdapter(this, em, session, entity));
         }
         return list;
     }
@@ -611,7 +510,7 @@ public class RealmAdapter implements RealmModel {
         realm.getApplications().add(applicationData);
         em.persist(applicationData);
         em.flush();
-        ApplicationModel resource = new ApplicationAdapter(this, em, applicationData);
+        ApplicationModel resource = new ApplicationAdapter(this, em, session, applicationData);
         em.flush();
         return resource;
     }
@@ -622,7 +521,6 @@ public class RealmAdapter implements RealmModel {
         ApplicationModel application = getApplicationById(id);
         if (application == null) return false;
 
-        ((ApplicationAdapter)application).deleteUserSessionAssociation();
         for (RoleModel role : application.getRoles()) {
             application.removeRole(role);
         }
@@ -646,14 +544,15 @@ public class RealmAdapter implements RealmModel {
             return false;
         }
         em.remove(applicationEntity);
-        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where client = :client").setParameter("client", applicationEntity).executeUpdate();
+        em.createNamedQuery("deleteScopeMappingByClient").setParameter("client", applicationEntity).executeUpdate();
+        em.flush();
 
         return true;
     }
 
     @Override
     public ApplicationModel getApplicationById(String id) {
-        return session.getApplicationById(id, this);
+        return session.realms().getApplicationById(id, this);
     }
 
     @Override
@@ -662,57 +561,6 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
-    public UserModel getUserBySocialLink(SocialLinkModel socialLink) {
-        return session.getUserBySocialLink(socialLink, this);
-    }
-
-    @Override
-    public Set<SocialLinkModel> getSocialLinks(UserModel user) {
-        return session.getSocialLinks(user, this);
-    }
-
-    @Override
-    public SocialLinkModel getSocialLink(UserModel user, String socialProvider) {
-        return session.getSocialLink(user, socialProvider, this);
-    }
-
-    @Override
-    public void addSocialLink(UserModel user, SocialLinkModel socialLink) {
-        SocialLinkEntity entity = new SocialLinkEntity();
-        entity.setRealm(realm);
-        entity.setSocialProvider(socialLink.getSocialProvider());
-        entity.setSocialUserId(socialLink.getSocialUserId());
-        entity.setSocialUsername(socialLink.getSocialUsername());
-        UserEntity userEntity = em.getReference(UserEntity.class, user.getId());
-        entity.setUser(userEntity);
-        em.persist(entity);
-        em.flush();
-    }
-
-    private SocialLinkEntity findSocialLink(UserModel user, String socialProvider) {
-        TypedQuery<SocialLinkEntity> query = em.createNamedQuery("findSocialLinkByUserAndProvider", SocialLinkEntity.class);
-        UserEntity userEntity = em.getReference(UserEntity.class, user.getId());
-        query.setParameter("user", userEntity);
-        query.setParameter("socialProvider", socialProvider);
-        List<SocialLinkEntity> results = query.getResultList();
-        return results.size() > 0 ? results.get(0) : null;
-    }
-
-
-    @Override
-    public boolean removeSocialLink(UserModel user, String socialProvider) {
-        SocialLinkEntity entity = findSocialLink(user, socialProvider);
-        if (entity != null) {
-            em.remove(entity);
-            em.flush();
-            return true;
-        } else {
-            return false;
-        }
-    }
-
-
-    @Override
     public boolean isSocial() {
         return realm.isSocial();
     }
@@ -735,21 +583,6 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
-    public List<UserModel> getUsers() {
-        return session.getUsers(this);
-    }
-
-    @Override
-    public List<UserModel> searchForUser(String search) {
-        return session.searchForUser(search, this);
-    }
-
-    @Override
-    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes) {
-        return session.searchForUserByAttributes(attributes, this);
-    }
-
-    @Override
     public OAuthClientModel addOAuthClient(String name) {
         return this.addOAuthClient(KeycloakModelUtils.generateId(), name);
     }
@@ -770,9 +603,8 @@ public class RealmAdapter implements RealmModel {
     public boolean removeOAuthClient(String id) {
         OAuthClientModel oauth = getOAuthClientById(id);
         if (oauth == null) return false;
-        ((OAuthClientAdapter)oauth).deleteUserSessionAssociation();
-        OAuthClientEntity client = (OAuthClientEntity) ((OAuthClientAdapter) oauth).getEntity();
-        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where client = :client").setParameter("client", client).executeUpdate();
+        OAuthClientEntity client = em.getReference(OAuthClientEntity.class, oauth.getId());
+        em.createNamedQuery("deleteScopeMappingByClient").setParameter("client", client).executeUpdate();
         em.remove(client);
         return true;
     }
@@ -790,7 +622,7 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public OAuthClientModel getOAuthClientById(String id) {
-        return session.getOAuthClientById(id, this);
+        return session.realms().getOAuthClientById(id, this);
     }
 
 
@@ -867,6 +699,7 @@ public class RealmAdapter implements RealmModel {
         int counter = 1;
         for (AuthenticationProviderModel model : authenticationProviders) {
             AuthenticationProviderEntity entity = new AuthenticationProviderEntity();
+            entity.setRealm(realm);
             entity.setProviderName(model.getProviderName());
             entity.setPasswordUpdateSupported(model.isPasswordUpdateSupported());
             entity.setConfig(model.getConfig());
@@ -882,6 +715,8 @@ public class RealmAdapter implements RealmModel {
             em.remove(apToRemove);
         }
 
+        em.flush();
+
         // Now create all new providers
         for (AuthenticationProviderEntity apToAdd : newEntities) {
             existing.add(apToAdd);
@@ -892,6 +727,64 @@ public class RealmAdapter implements RealmModel {
     }
 
     @Override
+    public List<UserFederationProviderModel> getUserFederationProviders() {
+        List<FederationProviderEntity> entities = realm.getFederationProviders();
+        List<FederationProviderEntity> copy = new ArrayList<FederationProviderEntity>();
+        for (FederationProviderEntity entity : entities) {
+            copy.add(entity);
+
+        }
+        Collections.sort(copy, new Comparator<FederationProviderEntity>() {
+
+            @Override
+            public int compare(FederationProviderEntity o1, FederationProviderEntity o2) {
+                return o1.getPriority() - o2.getPriority();
+            }
+
+        });
+        List<UserFederationProviderModel> result = new ArrayList<UserFederationProviderModel>();
+        for (FederationProviderEntity entity : copy) {
+            result.add(new UserFederationProviderModel(entity.getId(), entity.getProviderName(), entity.getConfig()));
+        }
+
+        return result;
+    }
+
+    @Override
+    public void setUserFederationProviders(List<UserFederationProviderModel> providers) {
+        List<FederationProviderEntity> newEntities = new ArrayList<FederationProviderEntity>();
+        int counter = 1;
+        for (UserFederationProviderModel model : providers) {
+            FederationProviderEntity entity = new FederationProviderEntity();
+            entity.setId(KeycloakModelUtils.generateId());
+            entity.setRealm(realm);
+            entity.setProviderName(model.getProviderName());
+            entity.setConfig(model.getConfig());
+            entity.setPriority(counter++);
+            newEntities.add(entity);
+        }
+
+        // Remove all existing first
+        Collection<FederationProviderEntity> existing = realm.getFederationProviders();
+        Collection<FederationProviderEntity> copy = new ArrayList<FederationProviderEntity>(existing);
+        for (FederationProviderEntity apToRemove : copy) {
+            existing.remove(apToRemove);
+            em.remove(apToRemove);
+        }
+
+        em.flush();
+
+        // Now create all new providers
+        for (FederationProviderEntity apToAdd : newEntities) {
+            existing.add(apToAdd);
+            em.persist(apToAdd);
+        }
+
+        em.flush();
+    }
+
+
+    @Override
     public RoleModel getRole(String name) {
         TypedQuery<RoleEntity> query = em.createNamedQuery("getRealmRoleByName", RoleEntity.class);
         query.setParameter("name", name);
@@ -925,14 +818,13 @@ public class RealmAdapter implements RealmModel {
             return false;
         }
         if (!role.getContainer().equals(this)) return false;
-
+        session.users().preRemove(this, role);
         RoleEntity roleEntity = RoleAdapter.toRoleEntity(role, em);
         realm.getRoles().remove(role);
         realm.getDefaultRoles().remove(role);
 
-        em.createNativeQuery("delete from CompositeRole where childRole = :role").setParameter("role", roleEntity).executeUpdate();
-        em.createQuery("delete from " + UserRoleMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", roleEntity).executeUpdate();
-        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", roleEntity).executeUpdate();
+        em.createNativeQuery("delete from COMPOSITE_ROLE where CHILD_ROLE = :role").setParameter("role", roleEntity).executeUpdate();
+        em.createNamedQuery("deleteScopeMappingByRole").setParameter("role", roleEntity).executeUpdate();
 
         em.remove(roleEntity);
 
@@ -952,7 +844,7 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public RoleModel getRoleById(String id) {
-        return session.getRoleById(id, this);
+        return session.realms().getRoleById(id, this);
     }
 
     @Override
@@ -962,32 +854,6 @@ public class RealmAdapter implements RealmModel {
         return role.getContainer().removeRole(role);
     }
 
-
-
-
-
-    @Override
-    public boolean validatePassword(UserModel user, String password) {
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
-                return new Pbkdf2PasswordEncoder(cred.getSalt()).verify(password, cred.getValue());
-
-            }
-        }
-        return false;
-    }
-
-    @Override
-    public boolean validateTOTP(UserModel user, String password, String token) {
-        if (!validatePassword(user, password)) return false;
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.TOTP)) {
-                return new TimeBasedOTP().validate(token, cred.getValue().getBytes());
-            }
-        }
-        return false;
-    }
-
     @Override
     public PasswordPolicy getPasswordPolicy() {
         if (passwordPolicy == null) {
@@ -1096,49 +962,14 @@ public class RealmAdapter implements RealmModel {
 
     @Override
     public ApplicationModel getMasterAdminApp() {
-        return new ApplicationAdapter(this, em, realm.getMasterAdminApp());
+        return new ApplicationAdapter(this, em, session, realm.getMasterAdminApp());
     }
 
     @Override
     public void setMasterAdminApp(ApplicationModel app) {
-        realm.setMasterAdminApp(((ApplicationAdapter) app).getJpaEntity());
+        ApplicationEntity appEntity = app!=null ? em.getReference(ApplicationEntity.class, app.getId()) : null;
+        realm.setMasterAdminApp(appEntity);
         em.flush();
     }
 
-    @Override
-    public UserSessionModel createUserSession(UserModel user, String ipAddress) {
-        return session.createUserSession(this, user, ipAddress);
-    }
-
-    @Override
-    public UserSessionModel getUserSession(String id) {
-        return session.getUserSession(id, this);
-    }
-
-    @Override
-    public List<UserSessionModel> getUserSessions(UserModel user) {
-        return session.getUserSessions(user, this);
-    }
-
-    @Override
-    public void removeUserSession(UserSessionModel session) {
-        this.session.removeUserSession(session);
-    }
-
-    @Override
-    public void removeUserSessions() {
-        session.removeUserSessions(this);
-
-    }
-
-    @Override
-    public void removeUserSessions(UserModel user) {
-        session.removeUserSessions(this, user);
-    }
-
-    @Override
-    public void removeExpiredUserSessions() {
-        session.removeExpiredUserSessions(this);
-    }
-
 }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java b/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
index e86b42f..949efba 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/UserAdapter.java
@@ -2,7 +2,7 @@ package org.keycloak.models.jpa;
 
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationLinkModel;
-import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
@@ -11,16 +11,21 @@ import org.keycloak.models.UserCredentialValueModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.jpa.entities.AuthenticationLinkEntity;
 import org.keycloak.models.jpa.entities.CredentialEntity;
-import org.keycloak.models.jpa.entities.RoleEntity;
+import org.keycloak.models.jpa.entities.UserAttributeEntity;
 import org.keycloak.models.jpa.entities.UserEntity;
+import org.keycloak.models.jpa.entities.UserRequiredActionEntity;
 import org.keycloak.models.jpa.entities.UserRoleMappingEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
 import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
 
 import javax.persistence.EntityManager;
 import javax.persistence.TypedQuery;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
+import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -53,13 +58,13 @@ public class UserAdapter implements UserModel {
     }
 
     @Override
-    public String getLoginName() {
-        return user.getLoginName();
+    public String getUsername() {
+        return user.getUsername();
     }
 
     @Override
-    public void setLoginName(String loginName) {
-        user.setLoginName(loginName);
+    public void setUsername(String username) {
+        user.setUsername(username);
     }
 
     @Override
@@ -79,52 +84,84 @@ public class UserAdapter implements UserModel {
 
     @Override
     public void setAttribute(String name, String value) {
-        Map<String, String> attributes = user.getAttributes();
-        if (attributes == null) {
-            attributes = new HashMap<String, String>();
+        for (UserAttributeEntity attr : user.getAttributes()) {
+            if (attr.getName().equals(name)) {
+                attr.setValue(value);
+                return;
+            }
         }
-        attributes.put(name, value);
-        user.setAttributes(attributes);
+        UserAttributeEntity attr = new UserAttributeEntity();
+        attr.setName(name);
+        attr.setValue(value);
+        attr.setUser(user);
+        em.persist(attr);
+        user.getAttributes().add(attr);
     }
 
     @Override
     public void removeAttribute(String name) {
-        Map<String, String> attributes = user.getAttributes();
-        if (attributes == null) {
-            attributes = new HashMap<String, String>();
+        Iterator<UserAttributeEntity> it = user.getAttributes().iterator();
+        while (it.hasNext()) {
+            UserAttributeEntity attr = it.next();
+            if (attr.getName().equals(name)) {
+                it.remove();
+                em.remove(attr);
+            }
         }
-        attributes.remove(name);
-        user.setAttributes(attributes);
     }
 
     @Override
     public String getAttribute(String name) {
-        if (user.getAttributes() == null) return null;
-        return user.getAttributes().get(name);
+        for (UserAttributeEntity attr : user.getAttributes()) {
+            if (attr.getName().equals(name)) {
+                return attr.getValue();
+            }
+        }
+        return null;
     }
 
     @Override
     public Map<String, String> getAttributes() {
         Map<String, String> result = new HashMap<String, String>();
-        result.putAll(user.getAttributes());
+        for (UserAttributeEntity attr : user.getAttributes()) {
+            result.put(attr.getName(), attr.getValue());
+        }
         return result;
     }
 
     @Override
     public Set<RequiredAction> getRequiredActions() {
         Set<RequiredAction> result = new HashSet<RequiredAction>();
-        result.addAll(user.getRequiredActions());
+        for (UserRequiredActionEntity attr : user.getRequiredActions()) {
+            result.add(attr.getAction());
+        }
         return result;
     }
 
     @Override
     public void addRequiredAction(RequiredAction action) {
-        user.getRequiredActions().add(action);
+        for (UserRequiredActionEntity attr : user.getRequiredActions()) {
+            if (attr.getAction().equals(action)) {
+                return;
+            }
+        }
+        UserRequiredActionEntity attr = new UserRequiredActionEntity();
+        attr.setAction(action);
+        attr.setUser(user);
+        em.persist(attr);
+        user.getRequiredActions().add(attr);
     }
 
     @Override
     public void removeRequiredAction(RequiredAction action) {
-        user.getRequiredActions().remove(action);
+        Iterator<UserRequiredActionEntity> it = user.getRequiredActions().iterator();
+        while (it.hasNext()) {
+            UserRequiredActionEntity attr = it.next();
+            if (attr.getAction().equals(action)) {
+                it.remove();
+                em.remove(attr);
+            }
+        }
     }
 
 
@@ -174,21 +211,12 @@ public class UserAdapter implements UserModel {
     }
 
     @Override
-    public int getNotBefore() {
-        return user.getNotBefore();
-    }
-
-    @Override
-    public void setNotBefore(int notBefore) {
-        user.setNotBefore(notBefore);
-    }
-
-    @Override
     public void updateCredential(UserCredentialModel cred) {
         CredentialEntity credentialEntity = getCredentialEntity(user, cred.getType());
 
         if (credentialEntity == null) {
             credentialEntity = new CredentialEntity();
+            credentialEntity.setId(KeycloakModelUtils.generateId());
             credentialEntity.setType(cred.getType());
             credentialEntity.setDevice(cred.getDevice());
             credentialEntity.setUser(user);
@@ -197,8 +225,15 @@ public class UserAdapter implements UserModel {
         }
         if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
             byte[] salt = getSalt();
-            credentialEntity.setValue(new Pbkdf2PasswordEncoder(salt).encode(cred.getValue()));
+            int hashIterations = 1;
+            PasswordPolicy policy = realm.getPasswordPolicy();
+            if (policy != null) {
+                hashIterations = policy.getHashIterations();
+                if (hashIterations == -1) hashIterations = 1;
+            }
+            credentialEntity.setValue(new Pbkdf2PasswordEncoder(salt).encode(cred.getValue(), hashIterations));
             credentialEntity.setSalt(salt);
+            credentialEntity.setHashIterations(hashIterations);
         } else {
             credentialEntity.setValue(cred.getValue());
         }
@@ -228,6 +263,7 @@ public class UserAdapter implements UserModel {
                 credModel.setDevice(credEntity.getDevice());
                 credModel.setValue(credEntity.getValue());
                 credModel.setSalt(credEntity.getSalt());
+                credModel.setHashIterations(credEntity.getHashIterations());
 
                 result.add(credModel);
             }
@@ -242,6 +278,7 @@ public class UserAdapter implements UserModel {
 
         if (credentialEntity == null) {
             credentialEntity = new CredentialEntity();
+            credentialEntity.setId(KeycloakModelUtils.generateId());
             credentialEntity.setType(credModel.getType());
             credentialEntity.setUser(user);
             em.persist(credentialEntity);
@@ -251,6 +288,7 @@ public class UserAdapter implements UserModel {
         credentialEntity.setValue(credModel.getValue());
         credentialEntity.setSalt(credModel.getSalt());
         credentialEntity.setDevice(credModel.getDevice());
+        credentialEntity.setHashIterations(credModel.getHashIterations());
 
         em.flush();
     }
@@ -269,8 +307,7 @@ public class UserAdapter implements UserModel {
     protected TypedQuery<UserRoleMappingEntity> getUserRoleMappingEntityTypedQuery(RoleModel role) {
         TypedQuery<UserRoleMappingEntity> query = em.createNamedQuery("userHasRole", UserRoleMappingEntity.class);
         query.setParameter("user", getUser());
-        RoleEntity roleEntity = em.getReference(RoleEntity.class, role.getId());
-        query.setParameter("role", roleEntity);
+        query.setParameter("roleId", role.getId());
         return query;
     }
 
@@ -279,8 +316,7 @@ public class UserAdapter implements UserModel {
         if (hasRole(role)) return;
         UserRoleMappingEntity entity = new UserRoleMappingEntity();
         entity.setUser(getUser());
-        RoleEntity roleEntity = em.getReference(RoleEntity.class, role.getId());
-        entity.setRole(roleEntity);
+        entity.setRoleId(role.getId());
         em.persist(entity);
         em.flush();
         em.detach(entity);
@@ -349,8 +385,12 @@ public class UserAdapter implements UserModel {
 
     @Override
     public AuthenticationLinkModel getAuthenticationLink() {
-        AuthenticationLinkEntity authLinkEntity = user.getAuthenticationLink();
-        return authLinkEntity == null ? null : new AuthenticationLinkModel(authLinkEntity.getAuthProvider(), authLinkEntity.getAuthUserId());
+        Collection<AuthenticationLinkEntity> col = user.getAuthenticationLink();
+        if (col == null || col.isEmpty()) {
+            return null;
+        }
+        AuthenticationLinkEntity authLinkEntity = col.iterator().next();
+        return new AuthenticationLinkModel(authLinkEntity.getAuthProvider(), authLinkEntity.getAuthUserId());
     }
 
     @Override
@@ -358,14 +398,32 @@ public class UserAdapter implements UserModel {
         AuthenticationLinkEntity entity = new AuthenticationLinkEntity();
         entity.setAuthProvider(authenticationLink.getAuthProvider());
         entity.setAuthUserId(authenticationLink.getAuthUserId());
+        entity.setUser(user);
+
+        if (user.getAuthenticationLink() == null) {
+            user.setAuthenticationLink(new LinkedList<AuthenticationLinkEntity>());
+        } else if (!user.getAuthenticationLink().isEmpty()) {
+            AuthenticationLinkEntity old = user.getAuthenticationLink().iterator().next();
+            user.getAuthenticationLink().clear();
+            em.remove(old);
+        }
 
-        user.setAuthenticationLink(entity);
+        user.getAuthenticationLink().add(entity);
         em.persist(entity);
-        em.persist(user);
         em.flush();
     }
 
     @Override
+    public String getFederationLink() {
+        return user.getFederationLink();
+    }
+
+    @Override
+    public void setFederationLink(String link) {
+        user.setFederationLink(link);
+    }
+
+    @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || !(o instanceof UserModel)) return false;

diff --git a/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory b/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory
new file mode 100755
index 0000000..8c7cf39
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.jpa.JpaRealmProviderFactory
\ No newline at end of file

diff --git a/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory b/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory
new file mode 100755
index 0000000..6c80343
--- /dev/null
+++ b/model/jpa/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.jpa.JpaUserProviderFactory
\ No newline at end of file

diff --git a/model/mongo/pom.xml b/model/mongo/pom.xml
index 31d513d..c239f07 100755
--- a/model/mongo/pom.xml
+++ b/model/mongo/pom.xml
@@ -39,9 +39,9 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-invalidation-cache-model</artifactId>
+            <artifactId>keycloak-connections-mongo</artifactId>
             <version>${project.version}</version>
-            <scope>test</scope>
+            <scope>provided</scope>
         </dependency>
         <dependency>
             <groupId>org.jboss.logging</groupId>
@@ -53,122 +53,5 @@
             <artifactId>mongo-java-driver</artifactId>
             <scope>provided</scope>
         </dependency>
-
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-model-tests</artifactId>
-            <version>${project.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-jaxrs</artifactId>
-            <scope>test</scope>
-            <exclusions>
-                <exclusion>
-                    <groupId>log4j</groupId>
-                    <artifactId>log4j</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-simple</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-
-        <dependency>
-            <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-model-tests</artifactId>
-            <version>${project.version}</version>
-            <classifier>tests</classifier>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
-
-    <properties>
-        <keycloak.model.mongo.host>localhost</keycloak.model.mongo.host>
-        <keycloak.model.mongo.port>27018</keycloak.model.mongo.port>
-        <keycloak.model.mongo.db>keycloak</keycloak.model.mongo.db>
-        <keycloak.model.mongo.clearOnStartup>true</keycloak.model.mongo.clearOnStartup>
-        <keycloak.model.mongo.bindIp>127.0.0.1</keycloak.model.mongo.bindIp>
-    </properties>
-
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-                <configuration>
-                    <source>${maven.compiler.source}</source>
-                    <target>${maven.compiler.target}</target>
-                </configuration>
-            </plugin>
-
-            <!-- Postpone tests to "integration-test" phase, so that we can bootstrap embedded mongo on 27018 before running tests -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>test</id>
-                        <phase>integration-test</phase>
-                        <goals>
-                            <goal>test</goal>
-                        </goals>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <keycloak.model.mongo.host>${keycloak.model.mongo.host}</keycloak.model.mongo.host>
-                                <keycloak.model.mongo.port>${keycloak.model.mongo.port}</keycloak.model.mongo.port>
-                                <keycloak.model.mongo.db>${keycloak.model.mongo.db}</keycloak.model.mongo.db>
-                                <keycloak.model.mongo.clearOnStartup>${keycloak.model.mongo.clearOnStartup}</keycloak.model.mongo.clearOnStartup>
-                                <keycloak.model.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.model.mongo.bindIp>
-                            </systemPropertyVariables>
-                            <dependenciesToScan>
-                                <dependency>org.keycloak:keycloak-model-tests</dependency>
-                            </dependenciesToScan>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>default-test</id>
-                        <configuration>
-                            <skip>true</skip>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
-            <!-- Embedded mongo -->
-            <plugin>
-                <groupId>com.github.joelittlejohn.embedmongo</groupId>
-                <artifactId>embedmongo-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>start-mongodb</id>
-                        <phase>pre-integration-test</phase>
-                        <goals>
-                            <goal>start</goal>
-                        </goals>
-                        <configuration>
-                            <port>${keycloak.model.mongo.port}</port>
-                            <logging>file</logging>
-                            <logFile>${project.build.directory}/mongodb.log</logFile>
-                            <bindIp>${keycloak.model.mongo.bindIp}</bindIp>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>stop-mongodb</id>
-                        <phase>post-integration-test</phase>
-                        <goals>
-                            <goal>stop</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-
-        </plugins>
-    </build>
 </project>
\ No newline at end of file

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/AbstractMongoAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/AbstractMongoAdapter.java
index 42b10cd..f922e76 100644
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/AbstractMongoAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/AbstractMongoAdapter.java
@@ -1,8 +1,8 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ApplicationAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ApplicationAdapter.java
index d2ab912..2b6ef4c 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ApplicationAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ApplicationAdapter.java
@@ -2,14 +2,12 @@ package org.keycloak.models.mongo.keycloak.adapters;
 
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
 import org.keycloak.models.mongo.utils.MongoModelUtils;
@@ -143,6 +141,7 @@ public class ApplicationAdapter extends ClientAdapter<MongoApplicationEntity> im
 
     @Override
     public boolean removeRole(RoleModel role) {
+        session.users().preRemove(getRealm(), role);
         return getMongoStore().removeEntity(MongoRoleEntity.class, role.getId(), invocationContext);
     }
 
@@ -162,6 +161,20 @@ public class ApplicationAdapter extends ClientAdapter<MongoApplicationEntity> im
     }
 
     @Override
+    public boolean hasScope(RoleModel role) {
+        if (super.hasScope(role)) {
+            return true;
+        }
+        Set<RoleModel> roles = getRoles();
+        if (roles.contains(role)) return true;
+
+        for (RoleModel mapping : roles) {
+            if (mapping.hasRole(role)) return true;
+        }
+        return false;
+    }
+
+    @Override
     public Set<RoleModel> getApplicationScopeMappings(ClientModel client) {
         Set<RoleModel> result = new HashSet<RoleModel>();
         List<MongoRoleEntity> roles = MongoModelUtils.getAllScopesOfClient(client, invocationContext);
@@ -205,6 +218,7 @@ public class ApplicationAdapter extends ClientAdapter<MongoApplicationEntity> im
         updateMongoEntity();
     }
 
+
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java
index 614204b..1e468bc 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/ClientAdapter.java
@@ -1,24 +1,21 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-import com.mongodb.DBObject;
-import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.UserSessionModel;
 import org.keycloak.models.entities.ClientEntity;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
-import org.keycloak.models.mongo.keycloak.entities.MongoUserSessionEntity;
 import org.keycloak.models.mongo.utils.MongoModelUtils;
 
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
@@ -27,12 +24,14 @@ public abstract class ClientAdapter<T extends MongoIdentifiableEntity> extends A
     protected final T clientEntity;
     private final RealmModel realm;
     protected  KeycloakSession session;
+    private final RealmProvider model;
 
     public ClientAdapter(KeycloakSession session, RealmModel realm, T clientEntity, MongoStoreInvocationContext invContext) {
         super(invContext);
         this.clientEntity = clientEntity;
         this.realm = realm;
         this.session = session;
+        this.model = session.realms();
     }
 
     @Override
@@ -175,16 +174,6 @@ public abstract class ClientAdapter<T extends MongoIdentifiableEntity> extends A
     }
 
     @Override
-    public Set<UserSessionModel> getUserSessions() {
-        return session.getUserSessions(realm, this);
-    }
-
-    @Override
-    public int getActiveUserSessions() {
-        return session.getActiveUserSessions(realm, this);
-    }
-
-    @Override
     public Set<RoleModel> getScopeMappings() {
         Set<RoleModel> result = new HashSet<RoleModel>();
         List<MongoRoleEntity> roles = MongoModelUtils.getAllScopesOfClient(this, invocationContext);

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java
new file mode 100755
index 0000000..a025e89
--- /dev/null
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java
@@ -0,0 +1,131 @@
+package org.keycloak.models.mongo.keycloak.adapters;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBObject;
+import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.OAuthClientModel;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity;
+import org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity;
+import org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity;
+import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MongoRealmProvider implements RealmProvider {
+
+    private final MongoStoreInvocationContext invocationContext;
+    private final KeycloakSession session;
+    private final MongoStore mongoStore;
+
+    public MongoRealmProvider(KeycloakSession session, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.session = session;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public void close() {
+        // TODO
+    }
+
+    @Override
+    public RealmModel createRealm(String name) {
+        return createRealm(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public RealmModel createRealm(String id, String name) {
+        MongoRealmEntity newRealm = new MongoRealmEntity();
+        newRealm.setId(id);
+        newRealm.setName(name);
+
+        getMongoStore().insertEntity(newRealm, invocationContext);
+
+        return new RealmAdapter(session, newRealm, invocationContext);
+    }
+
+    @Override
+    public RealmModel getRealm(String id) {
+        MongoRealmEntity realmEntity = getMongoStore().loadEntity(MongoRealmEntity.class, id, invocationContext);
+        return realmEntity != null ? new RealmAdapter(session, realmEntity, invocationContext) : null;
+    }
+
+    @Override
+    public List<RealmModel> getRealms() {
+        DBObject query = new BasicDBObject();
+        List<MongoRealmEntity> realms = getMongoStore().loadEntities(MongoRealmEntity.class, query, invocationContext);
+
+        List<RealmModel> results = new ArrayList<RealmModel>();
+        for (MongoRealmEntity realmEntity : realms) {
+            results.add(new RealmAdapter(session, realmEntity, invocationContext));
+        }
+        return results;
+    }
+
+    @Override
+    public RealmModel getRealmByName(String name) {
+        DBObject query = new QueryBuilder()
+                .and("name").is(name)
+                .get();
+        MongoRealmEntity realm = getMongoStore().loadSingleEntity(MongoRealmEntity.class, query, invocationContext);
+
+        if (realm == null) return null;
+        return new RealmAdapter(session, realm, invocationContext);
+    }
+
+    @Override
+    public boolean removeRealm(String id) {
+        RealmModel realm = getRealm(id);
+        if (realm == null) return false;
+        session.users().preRemove(realm);
+        return getMongoStore().removeEntity(MongoRealmEntity.class, id, invocationContext);
+    }
+
+    protected MongoStore getMongoStore() {
+        return invocationContext.getMongoStore();
+    }
+
+    @Override
+    public RoleModel getRoleById(String id, RealmModel realm) {
+        MongoRoleEntity role = getMongoStore().loadEntity(MongoRoleEntity.class, id, invocationContext);
+        if (role == null) return null;
+        if (role.getRealmId() != null && !role.getRealmId().equals(realm.getId())) return null;
+        if (role.getApplicationId() != null && realm.getApplicationById(role.getApplicationId()) == null) return null;
+        return new RoleAdapter(session, realm, role, null, invocationContext);
+    }
+
+    @Override
+    public ApplicationModel getApplicationById(String id, RealmModel realm) {
+        MongoApplicationEntity appData = getMongoStore().loadEntity(MongoApplicationEntity.class, id, invocationContext);
+
+        // Check if application belongs to this realm
+        if (appData == null || !realm.getId().equals(appData.getRealmId())) {
+            return null;
+        }
+
+        return new ApplicationAdapter(session, realm, appData, invocationContext);
+    }
+
+    @Override
+    public OAuthClientModel getOAuthClientById(String id, RealmModel realm) {
+        MongoOAuthClientEntity clientEntity = getMongoStore().loadEntity(MongoOAuthClientEntity.class, id, invocationContext);
+
+        // Check if client belongs to this realm
+        if (clientEntity == null || !realm.getId().equals(clientEntity.getRealmId())) return null;
+
+        return new OAuthClientAdapter(session, realm, clientEntity, invocationContext);
+    }
+
+}

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java
new file mode 100755
index 0000000..fceeb82
--- /dev/null
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java
@@ -0,0 +1,38 @@
+package org.keycloak.models.mongo.keycloak.adapters;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.MongoConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
+import org.keycloak.models.RealmProviderFactory;
+
+/**
+ * KeycloakSessionFactory implementation based on MongoDB
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MongoRealmProviderFactory implements RealmProviderFactory {
+    protected static final Logger logger = Logger.getLogger(MongoRealmProviderFactory.class);
+
+    @Override
+    public String getId() {
+        return "mongo";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public RealmProvider create(KeycloakSession session) {
+        MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
+        return new MongoRealmProvider(session, connection.getMongoStore(), connection.getInvocationContext());
+    }
+
+    @Override
+    public void close() {
+    }
+
+}
+

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java
new file mode 100755
index 0000000..083d0c0
--- /dev/null
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java
@@ -0,0 +1,38 @@
+package org.keycloak.models.mongo.keycloak.adapters;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.MongoConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserProvider;
+import org.keycloak.models.UserProviderFactory;
+
+/**
+ * KeycloakSessionFactory implementation based on MongoDB
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class MongoUserProviderFactory implements UserProviderFactory {
+    protected static final Logger logger = Logger.getLogger(MongoUserProviderFactory.class);
+
+    @Override
+    public String getId() {
+        return "mongo";
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public UserProvider create(KeycloakSession session) {
+        MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
+        return new MongoUserProvider(session, connection.getMongoStore(), connection.getInvocationContext());
+    }
+
+    @Override
+    public void close() {
+    }
+
+}
+

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/OAuthClientAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/OAuthClientAdapter.java
index 0ebd713..71b73ce 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/OAuthClientAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/OAuthClientAdapter.java
@@ -1,10 +1,9 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
-import org.keycloak.models.ApplicationModel;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.RealmModel;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity;
 
 /**

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java
index 2602222..2e563f5 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RealmAdapter.java
@@ -1,43 +1,28 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
-import com.mongodb.BasicDBObject;
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
 import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ApplicationModel;
-import org.keycloak.models.AuthenticationLinkModel;
 import org.keycloak.models.AuthenticationProviderModel;
 import org.keycloak.models.ClientModel;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.entities.FederationProviderEntity;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmProvider;
 import org.keycloak.models.OAuthClientModel;
 import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RequiredCredentialModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.SocialLinkModel;
-import org.keycloak.models.UserCredentialModel;
-import org.keycloak.models.UserCredentialValueModel;
-import org.keycloak.models.UserModel;
-import org.keycloak.models.UserSessionModel;
-import org.keycloak.models.UsernameLoginFailureModel;
-import org.keycloak.models.entities.AuthenticationLinkEntity;
 import org.keycloak.models.entities.AuthenticationProviderEntity;
-import org.keycloak.models.entities.CredentialEntity;
 import org.keycloak.models.entities.RequiredCredentialEntity;
-import org.keycloak.models.entities.SocialLinkEntity;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoOAuthClientEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
-import org.keycloak.models.mongo.keycloak.entities.MongoUserEntity;
-import org.keycloak.models.mongo.keycloak.entities.MongoUserSessionEntity;
-import org.keycloak.models.mongo.keycloak.entities.MongoUsernameLoginFailureEntity;
-import org.keycloak.models.mongo.utils.MongoModelUtils;
 import org.keycloak.models.utils.KeycloakModelUtils;
-import org.keycloak.models.utils.Pbkdf2PasswordEncoder;
-import org.keycloak.models.utils.TimeBasedOTP;
-import org.keycloak.util.Time;
 
 import java.security.PrivateKey;
 import java.security.PublicKey;
@@ -46,11 +31,9 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.regex.Pattern;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -60,6 +43,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
     private static final Logger logger = Logger.getLogger(RealmAdapter.class);
 
     private final MongoRealmEntity realm;
+    private final RealmProvider model;
 
     protected volatile transient PublicKey publicKey;
     protected volatile transient PrivateKey privateKey;
@@ -71,6 +55,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
         super(invocationContext);
         this.realm = realmEntity;
         this.session = session;
+        this.model = session.realms();
     }
 
     @Override
@@ -448,80 +433,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
     }
 
     @Override
-    public UserModel getUser(String name) {
-        return session.getUserByUsername(name, this);
-    }
-
-    @Override
-    public UsernameLoginFailureModel getUserLoginFailure(String name) {
-        return session.getUserLoginFailure(name, this);
-    }
-
-    @Override
-    public UsernameLoginFailureModel addUserLoginFailure(String username) {
-        return session.addUserLoginFailure(username, this);
-    }
-
-
-    @Override
-    public List<UsernameLoginFailureModel> getAllUserLoginFailures() {
-        return session.getAllUserLoginFailures(this);
-    }
-
-    @Override
-    public UserModel getUserByEmail(String email) {
-        return session.getUserByEmail(email, this);
-    }
-
-    @Override
-    public UserModel getUserById(String id) {
-        return session.getUserById(id, this);
-    }
-
-    @Override
-    public UserAdapter addUser(String username) {
-        return this.addUser(null, username);
-    }
-
-    @Override
-    public UserAdapter addUser(String id, String username) {
-        UserAdapter userModel = addUserEntity(id, username);
-
-        for (String r : getDefaultRoles()) {
-           userModel.grantRole(getRole(r));
-        }
-
-        for (ApplicationModel application : getApplications()) {
-            for (String r : application.getDefaultRoles()) {
-                userModel.grantRole(application.getRole(r));
-            }
-        }
-
-        return userModel;
-    }
-
-    protected UserAdapter addUserEntity(String id, String username) {
-        MongoUserEntity userEntity = new MongoUserEntity();
-        userEntity.setId(id);
-        userEntity.setLoginName(username);
-        // Compatibility with JPA model, which has user disabled by default
-        // userEntity.setEnabled(true);
-        userEntity.setRealmId(getId());
-
-        getMongoStore().insertEntity(userEntity, invocationContext);
-        return new UserAdapter(session, this, userEntity, invocationContext);
-    }
-
-    @Override
-    public boolean removeUser(String name) {
-        DBObject query = new QueryBuilder()
-                .and("loginName").is(name)
-                .and("realmId").is(getId())
-                .get();
-        return getMongoStore().removeEntities(MongoUserEntity.class, query, invocationContext);
-    }
-
-    @Override
     public RoleAdapter getRole(String name) {
         DBObject query = new QueryBuilder()
                 .and("name").is(name)
@@ -559,6 +470,9 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
 
     @Override
     public boolean removeRoleById(String id) {
+        RoleModel role = getRoleById(id);
+        if (role == null) return false;
+        session.users().preRemove(this, role);
         return getMongoStore().removeEntity(MongoRoleEntity.class, id, invocationContext);
     }
 
@@ -581,7 +495,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
 
     @Override
     public RoleModel getRoleById(String id) {
-        return session.getRoleById(id, this);
+        return model.getRoleById(id, this);
     }
 
     @Override
@@ -633,7 +547,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
 
     @Override
     public ApplicationModel getApplicationById(String id) {
-        return session.getApplicationById(id, this);
+        return model.getApplicationById(id, this);
     }
 
     @Override
@@ -724,7 +638,7 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
 
     @Override
     public OAuthClientModel getOAuthClientById(String id) {
-        return session.getOAuthClientById(id, this);
+        return model.getOAuthClientById(id, this);
     }
 
     @Override
@@ -806,81 +720,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
         return result;
     }
 
-    @Override
-    public boolean validatePassword(UserModel user, String password) {
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
-                return new Pbkdf2PasswordEncoder(cred.getSalt()).verify(password, cred.getValue());
-            }
-        }
-        return false;
-    }
-
-    @Override
-    public boolean validateTOTP(UserModel user, String password, String token) {
-        if (!validatePassword(user, password)) return false;
-        for (UserCredentialValueModel cred : user.getCredentialsDirectly()) {
-            if (cred.getType().equals(UserCredentialModel.TOTP)) {
-                return new TimeBasedOTP().validate(token, cred.getValue().getBytes());
-            }
-        }
-        return false;
-    }
-
-
-
-
-    @Override
-    public UserModel getUserBySocialLink(SocialLinkModel socialLink) {
-        return session.getUserBySocialLink(socialLink, this);
-    }
-
-    @Override
-    public Set<SocialLinkModel> getSocialLinks(UserModel user) {
-        return session.getSocialLinks(user, this);
-    }
-
-    @Override
-    public SocialLinkModel getSocialLink(UserModel user, String socialProvider) {
-        return session.getSocialLink(user, socialProvider, this);
-    }
-
-    @Override
-    public void addSocialLink(UserModel user, SocialLinkModel socialLink) {
-        MongoUserEntity userEntity = ((UserAdapter) user).getUser();
-        SocialLinkEntity socialLinkEntity = new SocialLinkEntity();
-        socialLinkEntity.setSocialProvider(socialLink.getSocialProvider());
-        socialLinkEntity.setSocialUserId(socialLink.getSocialUserId());
-        socialLinkEntity.setSocialUsername(socialLink.getSocialUsername());
-
-        getMongoStore().pushItemToList(userEntity, "socialLinks", socialLinkEntity, true, invocationContext);
-    }
-
-    @Override
-    public boolean removeSocialLink(UserModel userModel, String socialProvider) {
-        UserModel user = getUserById(userModel.getId());
-        MongoUserEntity userEntity = ((UserAdapter) user).getUser();
-        SocialLinkEntity socialLinkEntity = findSocialLink(userEntity, socialProvider);
-        if (socialLinkEntity == null) {
-            return false;
-        }
-        return getMongoStore().pullItemFromList(userEntity, "socialLinks", socialLinkEntity, invocationContext);
-    }
-
-    private SocialLinkEntity findSocialLink(MongoUserEntity userEntity, String socialProvider) {
-        List<SocialLinkEntity> linkEntities = userEntity.getSocialLinks();
-        if (linkEntities == null) {
-            return null;
-        }
-
-        for (SocialLinkEntity socialLinkEntity : linkEntities) {
-            if (socialLinkEntity.getSocialProvider().equals(socialProvider)) {
-                return socialLinkEntity;
-            }
-        }
-        return null;
-    }
-
     protected void updateRealm() {
         super.updateMongoEntity();
     }
@@ -894,23 +733,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
     }
 
     @Override
-    public List<UserModel> getUsers() {
-        return session.getUsers(this);
-    }
-
-    @Override
-    public List<UserModel> searchForUser(String search) {
-        return session.searchForUser(search, this);
-
-    }
-
-    @Override
-    public List<UserModel> searchForUserByAttributes(Map<String, String> attributes) {
-        return session.searchForUserByAttributes(attributes, this);
-    }
-
-
-    @Override
     public Map<String, String> getSmtpConfig() {
         return realm.getSmtpConfig();
     }
@@ -968,6 +790,31 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
         realm.setAuthenticationProviders(entities);
         updateRealm();
     }
+    @Override
+    public List<UserFederationProviderModel> getUserFederationProviders() {
+        List<FederationProviderEntity> entities = realm.getFederationProviders();
+        List<UserFederationProviderModel> result = new ArrayList<UserFederationProviderModel>();
+        for (FederationProviderEntity entity : entities) {
+            result.add(new UserFederationProviderModel(entity.getId(), entity.getProviderName(), entity.getConfig()));
+        }
+
+        return result;
+    }
+
+    @Override
+    public void setUserFederationProviders(List<UserFederationProviderModel> providers) {
+        List<FederationProviderEntity> entities = new ArrayList<FederationProviderEntity>();
+        for (UserFederationProviderModel model : providers) {
+            FederationProviderEntity entity = new FederationProviderEntity();
+            entity.setId(KeycloakModelUtils.generateId());
+            entity.setProviderName(model.getProviderName());
+            entity.setConfig(model.getConfig());
+            entities.add(entity);
+        }
+
+        realm.setFederationProviders(entities);
+        updateRealm();
+    }
 
     @Override
     public boolean isAuditEnabled() {
@@ -1014,7 +861,8 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
 
     @Override
     public void setMasterAdminApp(ApplicationModel app) {
-        realm.setAdminAppId(app.getId());
+        String adminAppId = app != null ? app.getId() : null;
+        realm.setAdminAppId(adminAppId);
         updateRealm();
     }
 
@@ -1024,41 +872,6 @@ public class RealmAdapter extends AbstractMongoAdapter<MongoRealmEntity> impleme
     }
 
     @Override
-    public UserSessionModel createUserSession(UserModel user, String ipAddress) {
-        return session.createUserSession(this, user, ipAddress);
-    }
-
-    @Override
-    public UserSessionModel getUserSession(String id) {
-        return session.getUserSession(id, this);
-    }
-
-    @Override
-    public List<UserSessionModel> getUserSessions(UserModel user) {
-        return session.getUserSessions(user, this);
-    }
-
-    @Override
-    public void removeUserSession(UserSessionModel session) {
-        this.session.removeUserSession(session);
-    }
-
-    @Override
-    public void removeUserSessions(UserModel user) {
-        this.session.removeUserSessions(this, user);
-    }
-
-    @Override
-    public void removeUserSessions() {
-        this.session.removeUserSessions(this);
-    }
-
-    @Override
-    public void removeExpiredUserSessions() {
-        this.session.removeExpiredUserSessions(this);
-    }
-
-    @Override
     public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || !(o instanceof RealmModel)) return false;

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RoleAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RoleAdapter.java
index 3eb9f0c..c2a8317 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RoleAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/RoleAdapter.java
@@ -1,22 +1,22 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleContainerModel;
 import org.keycloak.models.RoleModel;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoApplicationEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoRealmEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
 import org.keycloak.models.utils.KeycloakModelUtils;
 
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
 /**
  * Wrapper around RoleData object, which will persist wrapped object after each set operation (compatibility with picketlink based idm)
  *

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
index e582b93..1d30a5b 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/UserAdapter.java
@@ -1,9 +1,10 @@
 package org.keycloak.models.mongo.keycloak.adapters;
 
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.AuthenticationLinkModel;
-import org.keycloak.models.ClientModel;
 import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.PasswordPolicy;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserCredentialModel;
@@ -11,7 +12,6 @@ import org.keycloak.models.UserCredentialValueModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.entities.AuthenticationLinkEntity;
 import org.keycloak.models.entities.CredentialEntity;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoUserEntity;
 import org.keycloak.models.mongo.utils.MongoModelUtils;
@@ -49,13 +49,13 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
     }
 
     @Override
-    public String getLoginName() {
-        return user.getLoginName();
+    public String getUsername() {
+        return user.getUsername();
     }
 
     @Override
-    public void setLoginName(String loginName) {
-        user.setLoginName(loginName);
+    public void setUsername(String username) {
+        user.setUsername(username);
         updateUser();
     }
 
@@ -71,16 +71,6 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
     }
 
     @Override
-    public int getNotBefore() {
-        return user.getNotBefore();
-    }
-
-    @Override
-    public void setNotBefore(int notBefore) {
-        user.setNotBefore(notBefore);
-    }
-
-    @Override
     public String getFirstName() {
         return user.getFirstName();
     }
@@ -199,8 +189,15 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
         }
         if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
             byte[] salt = Pbkdf2PasswordEncoder.getSalt();
-            credentialEntity.setValue(new Pbkdf2PasswordEncoder(salt).encode(cred.getValue()));
+            int hashIterations = 1;
+            PasswordPolicy policy = realm.getPasswordPolicy();
+            if (policy != null) {
+                hashIterations = policy.getHashIterations();
+                if (hashIterations == -1) hashIterations = 1;
+            }
+            credentialEntity.setValue(new Pbkdf2PasswordEncoder(salt).encode(cred.getValue(), hashIterations));
             credentialEntity.setSalt(salt);
+            credentialEntity.setHashIterations(hashIterations);
         } else {
             credentialEntity.setValue(cred.getValue());
         }
@@ -229,6 +226,7 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
             credModel.setDevice(credEntity.getDevice());
             credModel.setValue(credEntity.getValue());
             credModel.setSalt(credEntity.getSalt());
+            credModel.setHashIterations(credEntity.getHashIterations());
 
             result.add(credModel);
         }
@@ -249,6 +247,8 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
         credentialEntity.setValue(credModel.getValue());
         credentialEntity.setSalt(credModel.getSalt());
         credentialEntity.setDevice(credModel.getDevice());
+        credentialEntity.setHashIterations(credModel.getHashIterations());
+
 
         getMongoStore().updateEntity(user, invocationContext);
     }
@@ -331,6 +331,17 @@ public class UserAdapter extends AbstractMongoAdapter<MongoUserEntity> implement
     }
 
     @Override
+    public String getFederationLink() {
+        return user.getFederationLink();
+    }
+
+    @Override
+    public void setFederationLink(String link) {
+        user.setFederationLink(link);
+
+    }
+
+    @Override
     public AuthenticationLinkModel getAuthenticationLink() {
         AuthenticationLinkEntity authLinkEntity = user.getAuthenticationLink();
 

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoApplicationEntity.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoApplicationEntity.java
index c8dd6da..9000d37 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoApplicationEntity.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoApplicationEntity.java
@@ -1,15 +1,12 @@
 package org.keycloak.models.mongo.keycloak.entities;
 
-import java.util.List;
-
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
-import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.entities.ApplicationEntity;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -25,14 +22,5 @@ public class MongoApplicationEntity extends ApplicationEntity implements MongoId
                 .and("applicationId").is(getId())
                 .get();
         context.getMongoStore().removeEntities(MongoRoleEntity.class, query, context);
-
-        // Remove all session associations
-        query = new QueryBuilder()
-                .and("associatedClientIds").is(getId())
-                .get();
-        List<MongoUserSessionEntity> sessions = context.getMongoStore().loadEntities(MongoUserSessionEntity.class, query, context);
-        for (MongoUserSessionEntity session : sessions) {
-            context.getMongoStore().pullItemFromList(session, "associatedClientIds", getId(), context);
-        }
     }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoOAuthClientEntity.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoOAuthClientEntity.java
index 8950292..bf07f91 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoOAuthClientEntity.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoOAuthClientEntity.java
@@ -1,14 +1,12 @@
 package org.keycloak.models.mongo.keycloak.entities;
 
-import java.util.List;
-
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.entities.OAuthClientEntity;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -23,9 +21,5 @@ public class MongoOAuthClientEntity extends OAuthClientEntity implements MongoId
         DBObject query = new QueryBuilder()
                 .and("associatedClientIds").is(getId())
                 .get();
-        List<MongoUserSessionEntity> sessions = context.getMongoStore().loadEntities(MongoUserSessionEntity.class, query, context);
-        for (MongoUserSessionEntity session : sessions) {
-            context.getMongoStore().pullItemFromList(session, "associatedClientIds", getId(), context);
-        }
     }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRealmEntity.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRealmEntity.java
index d091619..c1a4267 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRealmEntity.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRealmEntity.java
@@ -2,11 +2,11 @@ package org.keycloak.models.mongo.keycloak.entities;
 
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.entities.RealmEntity;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
@@ -32,8 +32,5 @@ public class MongoRealmEntity extends RealmEntity implements MongoIdentifiableEn
 
         // Remove all clients of this realm
         context.getMongoStore().removeEntities(MongoOAuthClientEntity.class, query, context);
-
-        // Remove all sessions of this realm
-        context.getMongoStore().removeEntities(MongoUserSessionEntity.class, query, context);
     }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRoleEntity.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRoleEntity.java
index f931a91..be034da 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRoleEntity.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoRoleEntity.java
@@ -3,13 +3,13 @@ package org.keycloak.models.mongo.keycloak.entities;
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
 import org.jboss.logging.Logger;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoField;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.entities.RoleEntity;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoField;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.MongoStore;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 
 import java.util.List;
 
@@ -50,7 +50,7 @@ public class MongoRoleEntity extends RoleEntity implements MongoIdentifiableEnti
 
         List<MongoUserEntity> users = mongoStore.loadEntities(MongoUserEntity.class, query, invContext);
         for (MongoUserEntity user : users) {
-            logger.info("Removing role " + getName() + " from user " + user.getLoginName());
+            logger.info("Removing role " + getName() + " from user " + user.getUsername());
             mongoStore.pullItemFromList(user, "roleIds", getId(), invContext);
         }
 
@@ -61,7 +61,7 @@ public class MongoRoleEntity extends RoleEntity implements MongoIdentifiableEnti
 
         users = mongoStore.loadEntities(MongoUserEntity.class, query, invContext);
         for (MongoUserEntity user : users) {
-            logger.info("Removing scope " + getName() + " from user " + user.getLoginName());
+            logger.info("Removing scope " + getName() + " from user " + user.getUsername());
             mongoStore.pullItemFromList(user, "scopeIds", getId(), invContext);
         }
 

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserEntity.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserEntity.java
index 084a153..a0c16bf 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserEntity.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/entities/MongoUserEntity.java
@@ -1,20 +1,18 @@
 package org.keycloak.models.mongo.keycloak.entities;
 
-import com.mongodb.DBObject;
-import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoCollection;
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoIndex;
+import org.keycloak.connections.mongo.api.MongoIndexes;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.entities.UserEntity;
-import org.keycloak.models.mongo.api.MongoCollection;
-import org.keycloak.models.mongo.api.MongoIdentifiableEntity;
-import org.keycloak.models.mongo.api.MongoIndex;
-import org.keycloak.models.mongo.api.MongoIndexes;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 @MongoCollection(collectionName = "users")
 @MongoIndexes({
-        @MongoIndex(fields = { "realmId", "loginName" }, unique = true),
+        @MongoIndex(fields = { "realmId", "username" }, unique = true),
         @MongoIndex(fields = { "emailIndex" }, unique = true, sparse = true),
 })
 public class MongoUserEntity extends UserEntity implements MongoIdentifiableEntity {
@@ -29,10 +27,5 @@ public class MongoUserEntity extends UserEntity implements MongoIdentifiableEnti
 
     @Override
     public void afterRemove(MongoStoreInvocationContext invocationContext) {
-        DBObject query = new QueryBuilder()
-                .and("userId").is(getId())
-                .get();
-
-        invocationContext.getMongoStore().removeEntities(MongoUserSessionEntity.class, query, invocationContext);
     }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/utils/MongoModelUtils.java b/model/mongo/src/main/java/org/keycloak/models/mongo/utils/MongoModelUtils.java
index a6d40b9..63f0bfd 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/utils/MongoModelUtils.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/utils/MongoModelUtils.java
@@ -1,19 +1,19 @@
 package org.keycloak.models.mongo.utils;
 
-import java.util.Collections;
-import java.util.List;
-
 import com.mongodb.DBObject;
 import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ClientModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.entities.ClientEntity;
-import org.keycloak.models.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.mongo.keycloak.adapters.ClientAdapter;
 import org.keycloak.models.mongo.keycloak.adapters.UserAdapter;
 import org.keycloak.models.mongo.keycloak.entities.MongoRoleEntity;
 import org.keycloak.models.mongo.keycloak.entities.MongoUserEntity;
 
+import java.util.Collections;
+import java.util.List;
+
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */

diff --git a/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory b/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory
new file mode 100755
index 0000000..deffafa
--- /dev/null
+++ b/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.RealmProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.mongo.keycloak.adapters.MongoRealmProviderFactory
\ No newline at end of file

diff --git a/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory b/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory
new file mode 100755
index 0000000..ddc04d8
--- /dev/null
+++ b/model/mongo/src/main/resources/META-INF/services/org.keycloak.models.UserProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.mongo.keycloak.adapters.MongoUserProviderFactory
\ No newline at end of file

diff --git a/model/picketlink/src/main/java/org/keycloak/models/picketlink/ApplicationAdapter.java b/model/picketlink/src/main/java/org/keycloak/models/picketlink/ApplicationAdapter.java
index 9fa72d0..9b02e14 100755
--- a/model/picketlink/src/main/java/org/keycloak/models/picketlink/ApplicationAdapter.java
+++ b/model/picketlink/src/main/java/org/keycloak/models/picketlink/ApplicationAdapter.java
@@ -16,7 +16,12 @@ import org.picketlink.idm.model.sample.SampleModel;
 import org.picketlink.idm.query.IdentityQuery;
 import org.picketlink.idm.query.RelationshipQuery;
 
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

diff --git a/model/picketlink/src/main/java/org/keycloak/models/picketlink/RealmAdapter.java b/model/picketlink/src/main/java/org/keycloak/models/picketlink/RealmAdapter.java
index 36d7098..bb1b564 100755
--- a/model/picketlink/src/main/java/org/keycloak/models/picketlink/RealmAdapter.java
+++ b/model/picketlink/src/main/java/org/keycloak/models/picketlink/RealmAdapter.java
@@ -1,7 +1,6 @@
 package org.keycloak.models.picketlink;
 
 import org.bouncycastle.openssl.PEMWriter;
-import org.keycloak.util.PemUtils;
 import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.IdGenerator;
 import org.keycloak.models.KeycloakSession;
@@ -22,6 +21,7 @@ import org.keycloak.models.picketlink.relationships.RequiredApplicationCredentia
 import org.keycloak.models.picketlink.relationships.RequiredCredentialRelationship;
 import org.keycloak.models.picketlink.relationships.ScopeRelationship;
 import org.keycloak.models.picketlink.relationships.SocialLinkRelationship;
+import org.keycloak.util.PemUtils;
 import org.picketlink.idm.IdentityManagementException;
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.PartitionManager;
@@ -46,7 +46,14 @@ import java.io.StringWriter;
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.security.cert.X509Certificate;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 /**
  * Meant to be a per-request object

diff --git a/model/pom.xml b/model/pom.xml
index 850a21f..bfb162d 100755
--- a/model/pom.xml
+++ b/model/pom.xml
@@ -27,9 +27,10 @@
     <modules>
         <module>api</module>
         <module>invalidation-cache</module>
-        <!-- <module>picketlink</module> -->
         <module>jpa</module>
         <module>mongo</module>
-        <module>tests</module>
+        <module>sessions-jpa</module>
+        <module>sessions-mem</module>
+        <module>sessions-mongo</module>
     </modules>
 </project>

diff --git a/model/realms-jpa/pom.xml b/model/realms-jpa/pom.xml
new file mode 100755
index 0000000..09413e8
--- /dev/null
+++ b/model/realms-jpa/pom.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-model-realms-jpa</artifactId>
+    <name>Keycloak Model Realms JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-hybrid</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ApplicationAdapter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ApplicationAdapter.java
new file mode 100755
index 0000000..16c2500
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ApplicationAdapter.java
@@ -0,0 +1,258 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.Client;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.realms.RoleContainer;
+import org.keycloak.models.realms.jpa.entities.ApplicationEntity;
+import org.keycloak.models.realms.jpa.entities.RoleEntity;
+import org.keycloak.models.realms.jpa.entities.ScopeMappingEntity;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class ApplicationAdapter extends ClientAdapter implements Application {
+
+    protected EntityManager em;
+    protected ApplicationEntity applicationEntity;
+
+    public ApplicationAdapter(RealmProvider provider, EntityManager em, ApplicationEntity applicationEntity) {
+        super(provider, applicationEntity, em);
+        this.em = em;
+        this.applicationEntity = applicationEntity;
+    }
+
+    @Override
+    public void updateApplication() {
+        em.flush();
+    }
+
+    @Override
+    public String getName() {
+        return entity.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        entity.setName(name);
+    }
+
+    @Override
+    public boolean isSurrogateAuthRequired() {
+        return applicationEntity.isSurrogateAuthRequired();
+    }
+
+    @Override
+    public void setSurrogateAuthRequired(boolean surrogateAuthRequired) {
+        applicationEntity.setSurrogateAuthRequired(surrogateAuthRequired);
+    }
+
+    @Override
+    public String getManagementUrl() {
+        return applicationEntity.getManagementUrl();
+    }
+
+    @Override
+    public void setManagementUrl(String url) {
+        applicationEntity.setManagementUrl(url);
+    }
+
+    @Override
+    public String getBaseUrl() {
+        return applicationEntity.getBaseUrl();
+    }
+
+    @Override
+    public void setBaseUrl(String url) {
+        applicationEntity.setBaseUrl(url);
+    }
+
+    @Override
+    public boolean isBearerOnly() {
+        return applicationEntity.isBearerOnly();
+    }
+
+    @Override
+    public void setBearerOnly(boolean only) {
+        applicationEntity.setBearerOnly(only);
+    }
+
+    @Override
+    public boolean isDirectGrantsOnly() {
+        return false;  // applications can't be grant only
+    }
+
+    @Override
+    public void setDirectGrantsOnly(boolean flag) {
+        // applications can't be grant only
+    }
+
+    @Override
+    public Role getRole(String name) {
+        TypedQuery<RoleEntity> query = em.createNamedQuery("getAppRoleByName", RoleEntity.class);
+        query.setParameter("name", name);
+        query.setParameter("application", entity);
+        List<RoleEntity> roles = query.getResultList();
+        if (roles.size() == 0) return null;
+        return new RoleAdapter(provider, em, roles.get(0));
+    }
+
+    @Override
+    public Role addRole(String id, String name) {
+        RoleEntity roleEntity = new RoleEntity();
+        roleEntity.setId(id);
+        roleEntity.setName(name);
+        roleEntity.setApplication(applicationEntity);
+        roleEntity.setApplicationRole(true);
+        roleEntity.setRealmId(entity.getRealm().getId());
+        em.persist(roleEntity);
+        applicationEntity.getRoles().add(roleEntity);
+        em.flush();
+        return new RoleAdapter(provider, em, roleEntity);
+    }
+
+    @Override
+    public boolean removeRole(Role Role) {
+        RoleAdapter roleAdapter = (RoleAdapter) Role;
+        if (Role == null) {
+            return false;
+        }
+        if (!roleAdapter.getContainer().equals(this)) return false;
+
+        if (!roleAdapter.getRole().isApplicationRole()) return false;
+
+        RoleEntity role = roleAdapter.getRole();
+
+        applicationEntity.getRoles().remove(role);
+        applicationEntity.getDefaultRoles().remove(role);
+        em.createNativeQuery("delete from CompositeRole where childRole = :role").setParameter("role", role).executeUpdate();
+        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", role).executeUpdate();
+        role.setApplication(null);
+        em.flush();
+        em.remove(role);
+        em.flush();
+
+        return true;
+    }
+
+    @Override
+    public Set<Role> getRoles() {
+        Set<Role> list = new HashSet<Role>();
+        Collection<RoleEntity> roles = applicationEntity.getRoles();
+        if (roles == null) return list;
+        for (RoleEntity entity : roles) {
+            list.add(new RoleAdapter(provider, em, entity));
+        }
+        return list;
+    }
+
+    @Override
+    public Set<Role> getApplicationScopeMappings(Client client) {
+        Set<Role> roleMappings = client.getScopeMappings();
+
+        Set<Role> appRoles = new HashSet<Role>();
+        for (Role role : roleMappings) {
+            RoleContainer container = role.getContainer();
+            if (container instanceof Realm) {
+            } else {
+                Application app = (Application)container;
+                if (app.getId().equals(getId())) {
+                    appRoles.add(role);
+                }
+            }
+        }
+
+        return appRoles;
+    }
+
+
+
+
+    @Override
+    public List<String> getDefaultRoles() {
+        Collection<RoleEntity> entities = applicationEntity.getDefaultRoles();
+        List<String> roles = new ArrayList<String>();
+        if (entities == null) return roles;
+        for (RoleEntity entity : entities) {
+            roles.add(entity.getName());
+        }
+        return roles;
+    }
+
+    @Override
+    public void addDefaultRole(String name) {
+        Role role = getRole(name);
+        Collection<RoleEntity> entities = applicationEntity.getDefaultRoles();
+        for (RoleEntity entity : entities) {
+            if (entity.getId().equals(role.getId())) {
+                return;
+            }
+        }
+        entities.add(((RoleAdapter) role).getRole());
+        em.flush();
+    }
+
+    public static boolean contains(String str, String[] array) {
+        for (String s : array) {
+            if (str.equals(s)) return true;
+        }
+        return false;
+    }
+
+    @Override
+    public void updateDefaultRoles(String[] defaultRoles) {
+        Collection<RoleEntity> entities = applicationEntity.getDefaultRoles();
+        Set<String> already = new HashSet<String>();
+        List<RoleEntity> remove = new ArrayList<RoleEntity>();
+        for (RoleEntity rel : entities) {
+            if (!contains(rel.getName(), defaultRoles)) {
+                remove.add(rel);
+            } else {
+                already.add(rel.getName());
+            }
+        }
+        for (RoleEntity entity : remove) {
+            entities.remove(entity);
+        }
+        em.flush();
+        for (String roleName : defaultRoles) {
+            if (!already.contains(roleName)) {
+                addDefaultRole(roleName);
+            }
+        }
+        em.flush();
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof Application)) return false;
+
+        Application that = (Application) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+
+    public String toString() {
+        return getName();
+    }
+
+    ApplicationEntity getJpaEntity() {
+        return applicationEntity;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ClientAdapter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ClientAdapter.java
new file mode 100755
index 0000000..147a4aa
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/ClientAdapter.java
@@ -0,0 +1,225 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.realms.Client;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.realms.RoleContainer;
+import org.keycloak.models.realms.jpa.entities.ClientEntity;
+import org.keycloak.models.realms.jpa.entities.ScopeMappingEntity;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public abstract class ClientAdapter implements Client {
+    protected RealmProvider provider;
+    protected ClientEntity entity;
+    protected EntityManager em;
+
+    public ClientAdapter(RealmProvider provider, ClientEntity entity, EntityManager em) {
+        this.provider = provider;
+        this.entity = entity;
+        this.em = em;
+    }
+
+    public ClientEntity getEntity() {
+        return entity;
+    }
+
+    @Override
+    public String getId() {
+        return entity.getId();
+    }
+
+    @Override
+    public Realm getRealm() {
+        return new RealmAdapter(provider, em, entity.getRealm());
+    }
+
+    @Override
+    public String getClientId() {
+        return entity.getName();
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return entity.isEnabled();
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        entity.setEnabled(enabled);
+    }
+
+    @Override
+    public long getAllowedClaimsMask() {
+        return entity.getAllowedClaimsMask();
+    }
+
+    @Override
+    public void setAllowedClaimsMask(long mask) {
+        entity.setAllowedClaimsMask(mask);
+    }
+
+    @Override
+    public boolean isPublicClient() {
+        return entity.isPublicClient();
+    }
+
+    @Override
+    public void setPublicClient(boolean flag) {
+        entity.setPublicClient(flag);
+    }
+
+    @Override
+    public Set<String> getWebOrigins() {
+        Set<String> result = new HashSet<String>();
+        result.addAll(entity.getWebOrigins());
+        return result;
+    }
+
+
+
+    @Override
+    public void setWebOrigins(Set<String> webOrigins) {
+        entity.setWebOrigins(webOrigins);
+    }
+
+    @Override
+    public void addWebOrigin(String webOrigin) {
+        entity.getWebOrigins().add(webOrigin);
+    }
+
+    @Override
+    public void removeWebOrigin(String webOrigin) {
+        entity.getWebOrigins().remove(webOrigin);
+    }
+
+    @Override
+    public Set<String> getRedirectUris() {
+        Set<String> result = new HashSet<String>();
+        result.addAll(entity.getRedirectUris());
+        return result;
+    }
+
+    @Override
+    public void setRedirectUris(Set<String> redirectUris) {
+        entity.setRedirectUris(redirectUris);
+    }
+
+    @Override
+    public void addRedirectUri(String redirectUri) {
+        entity.getRedirectUris().add(redirectUri);
+    }
+
+    @Override
+    public void removeRedirectUri(String redirectUri) {
+        entity.getRedirectUris().remove(redirectUri);
+    }
+
+    @Override
+    public String getSecret() {
+        return entity.getSecret();
+    }
+
+    @Override
+    public void setSecret(String secret) {
+        entity.setSecret(secret);
+    }
+
+    @Override
+    public boolean validateSecret(String secret) {
+        return secret.equals(entity.getSecret());
+    }
+
+    @Override
+    public int getNotBefore() {
+        return entity.getNotBefore();
+    }
+
+    @Override
+    public void setNotBefore(int notBefore) {
+        entity.setNotBefore(notBefore);
+    }
+
+    @Override
+    public Set<Role> getRealmScopeMappings() {
+        Set<Role> roleMappings = getScopeMappings();
+
+        Set<Role> appRoles = new HashSet<Role>();
+        for (Role role : roleMappings) {
+            RoleContainer container = role.getContainer();
+            if (container instanceof Realm) {
+                if (((Realm) container).getId().equals(entity.getRealm().getId())) {
+                    appRoles.add(role);
+                }
+            }
+        }
+
+        return appRoles;
+    }
+
+
+
+    @Override
+    public Set<Role> getScopeMappings() {
+        TypedQuery<String> query = em.createNamedQuery("clientScopeMappingIds", String.class);
+        query.setParameter("client", getEntity());
+        List<String> ids = query.getResultList();
+        Set<Role> roles = new HashSet<Role>();
+        for (String roleId : ids) {
+            Role role = provider.getRoleById(roleId, entity.getRealm().getId());
+            if (role == null) continue;
+            roles.add(role);
+        }
+        return roles;
+    }
+
+    @Override
+    public void addScopeMapping(Role role) {
+        ScopeMappingEntity entity = new ScopeMappingEntity();
+        entity.setClient(getEntity());
+        entity.setRole(((RoleAdapter) role).getRole());
+        em.persist(entity);
+        em.flush();
+        em.detach(entity);
+    }
+
+    @Override
+    public void deleteScopeMapping(Role role) {
+        TypedQuery<ScopeMappingEntity> query = getRealmScopeMappingQuery((RoleAdapter) role);
+        List<ScopeMappingEntity> results = query.getResultList();
+        if (results.size() == 0) return;
+        for (ScopeMappingEntity entity : results) {
+            em.remove(entity);
+        }
+    }
+
+    protected TypedQuery<ScopeMappingEntity> getRealmScopeMappingQuery(RoleAdapter role) {
+        TypedQuery<ScopeMappingEntity> query = em.createNamedQuery("hasScope", ScopeMappingEntity.class);
+        query.setParameter("client", getEntity());
+        query.setParameter("role", role.getRole());
+        return query;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (!this.getClass().equals(o.getClass())) return false;
+
+        ClientAdapter that = (ClientAdapter) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return entity.getId().hashCode();
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ApplicationEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ApplicationEntity.java
new file mode 100755
index 0000000..6093fbc
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ApplicationEntity.java
@@ -0,0 +1,77 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import javax.persistence.CascadeType;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.JoinTable;
+import javax.persistence.OneToMany;
+import java.util.ArrayList;
+import java.util.Collection;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+public class ApplicationEntity extends ClientEntity {
+
+    private boolean surrogateAuthRequired;
+    private String baseUrl;
+    private String managementUrl;
+    private boolean bearerOnly;
+
+    @OneToMany(fetch = FetchType.EAGER, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "application")
+    Collection<RoleEntity> roles = new ArrayList<RoleEntity>();
+
+    @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="ApplicationDefaultRoles")
+    Collection<RoleEntity> defaultRoles = new ArrayList<RoleEntity>();
+
+    public boolean isSurrogateAuthRequired() {
+        return surrogateAuthRequired;
+    }
+
+    public void setSurrogateAuthRequired(boolean surrogateAuthRequired) {
+        this.surrogateAuthRequired = surrogateAuthRequired;
+    }
+
+    public String getBaseUrl() {
+        return baseUrl;
+    }
+
+    public void setBaseUrl(String baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+
+    public String getManagementUrl() {
+        return managementUrl;
+    }
+
+    public void setManagementUrl(String managementUrl) {
+        this.managementUrl = managementUrl;
+    }
+
+    public Collection<RoleEntity> getRoles() {
+        return roles;
+    }
+
+    public void setRoles(Collection<RoleEntity> roles) {
+        this.roles = roles;
+    }
+
+    public Collection<RoleEntity> getDefaultRoles() {
+        return defaultRoles;
+    }
+
+    public void setDefaultRoles(Collection<RoleEntity> defaultRoles) {
+        this.defaultRoles = defaultRoles;
+    }
+
+    public boolean isBearerOnly() {
+        return bearerOnly;
+    }
+
+    public void setBearerOnly(boolean bearerOnly) {
+        this.bearerOnly = bearerOnly;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/AuthenticationProviderEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/AuthenticationProviderEntity.java
new file mode 100644
index 0000000..261a10b
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/AuthenticationProviderEntity.java
@@ -0,0 +1,79 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import org.hibernate.annotations.GenericGenerator;
+
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.Table;
+import java.util.Map;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+@Entity
+@Table(name="AuthProviderEntity")
+public class AuthenticationProviderEntity {
+
+    @Id
+    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.realms.jpa.utils.JpaIdGenerator")
+    @GeneratedValue(generator = "keycloak_generator")
+    protected String id;
+
+    private String providerName;
+    private boolean passwordUpdateSupported;
+    private int priority;
+
+    @ElementCollection
+    @MapKeyColumn(name="name")
+    @Column(name="value")
+    @CollectionTable(name="AuthProviderEntity_cfg", joinColumns = {
+            @JoinColumn(name = "AuthProviderEntity_id")
+    })
+    private Map<String, String> config;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    public void setProviderName(String providerName) {
+        this.providerName = providerName;
+    }
+
+    public boolean isPasswordUpdateSupported() {
+        return passwordUpdateSupported;
+    }
+
+    public void setPasswordUpdateSupported(boolean passwordUpdateSupported) {
+        this.passwordUpdateSupported = passwordUpdateSupported;
+    }
+
+    public int getPriority() {
+        return priority;
+    }
+
+    public void setPriority(int priority) {
+        this.priority = priority;
+    }
+
+    public Map<String, String> getConfig() {
+        return config;
+    }
+
+    public void setConfig(Map<String, String> config) {
+        this.config = config;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ClientEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ClientEntity.java
new file mode 100755
index 0000000..05eb5e0
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/ClientEntity.java
@@ -0,0 +1,126 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.Inheritance;
+import javax.persistence.InheritanceType;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.Table;
+import javax.persistence.UniqueConstraint;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+@Inheritance(strategy = InheritanceType.SINGLE_TABLE)
+@Table(uniqueConstraints = {@UniqueConstraint(columnNames = {"realm", "name"})})
+public abstract class ClientEntity {
+    @Id
+    private String id;
+    @Column(name = "name")
+    private String name;
+    private boolean enabled;
+    private String secret;
+    private long allowedClaimsMask;
+    private int notBefore;
+    private boolean publicClient;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "realm")
+    protected RealmEntity realm;
+
+    @ElementCollection
+    @CollectionTable
+    protected Set<String> webOrigins = new HashSet<String>();
+    @ElementCollection
+    @CollectionTable
+    protected Set<String> redirectUris = new HashSet<String>();
+
+    public RealmEntity getRealm() {
+        return realm;
+    }
+
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public long getAllowedClaimsMask() {
+        return allowedClaimsMask;
+    }
+
+    public void setAllowedClaimsMask(long allowedClaimsMask) {
+        this.allowedClaimsMask = allowedClaimsMask;
+    }
+
+    public Set<String> getWebOrigins() {
+        return webOrigins;
+    }
+
+    public void setWebOrigins(Set<String> webOrigins) {
+        this.webOrigins = webOrigins;
+    }
+
+    public Set<String> getRedirectUris() {
+        return redirectUris;
+    }
+
+    public void setRedirectUris(Set<String> redirectUris) {
+        this.redirectUris = redirectUris;
+    }
+
+    public String getSecret() {
+        return secret;
+    }
+
+    public void setSecret(String secret) {
+        this.secret = secret;
+    }
+
+    public int getNotBefore() {
+        return notBefore;
+    }
+
+    public void setNotBefore(int notBefore) {
+        this.notBefore = notBefore;
+    }
+
+    public boolean isPublicClient() {
+        return publicClient;
+    }
+
+    public void setPublicClient(boolean publicClient) {
+        this.publicClient = publicClient;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/OAuthClientEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/OAuthClientEntity.java
new file mode 100755
index 0000000..55e351a
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/OAuthClientEntity.java
@@ -0,0 +1,27 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import javax.persistence.Entity;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@NamedQueries({
+        @NamedQuery(name="findOAuthClientByName", query="select o from OAuthClientEntity o where o.name=:name and o.realm = :realm"),
+        @NamedQuery(name="findOAuthClientByRealm", query="select o from OAuthClientEntity o where o.realm = :realm")
+
+})
+@Entity
+public class OAuthClientEntity extends ClientEntity {
+    protected boolean directGrantsOnly;
+
+    public boolean isDirectGrantsOnly() {
+        return directGrantsOnly;
+    }
+
+    public void setDirectGrantsOnly(boolean directGrantsOnly) {
+        this.directGrantsOnly = directGrantsOnly;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RealmEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RealmEntity.java
new file mode 100755
index 0000000..78c36d4
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RealmEntity.java
@@ -0,0 +1,479 @@
+package org.keycloak.models.realms.jpa.entities;
+
+
+import javax.persistence.CascadeType;
+import javax.persistence.CollectionTable;
+import javax.persistence.Column;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.JoinTable;
+import javax.persistence.MapKeyColumn;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.OneToMany;
+import javax.persistence.OneToOne;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+@NamedQueries({
+        @NamedQuery(name="getAllRealms", query="select realm from RealmEntity realm"),
+        @NamedQuery(name="getRealmByName", query="select realm from RealmEntity realm where realm.name = :name"),
+})
+public class RealmEntity {
+    @Id
+    protected String id;
+
+    @Column(unique = true)
+    protected String name;
+
+    protected boolean enabled;
+    protected boolean sslNotRequired;
+    protected boolean registrationAllowed;
+    protected boolean passwordCredentialGrantAllowed;
+    protected boolean verifyEmail;
+    protected boolean resetPasswordAllowed;
+    protected boolean social;
+    protected boolean rememberMe;
+    //--- brute force settings
+    protected boolean bruteForceProtected;
+    protected int maxFailureWaitSeconds;
+    protected int minimumQuickLoginWaitSeconds;
+    protected int waitIncrementSeconds;
+    protected long quickLoginCheckMilliSeconds;
+    protected int maxDeltaTimeSeconds;
+    protected int failureFactor;
+    //--- end brute force settings
+
+
+    @Column(name="updateProfileOnInitSocLogin")
+    protected boolean updateProfileOnInitialSocialLogin;
+    protected String passwordPolicy;
+
+    private int ssoSessionIdleTimeout;
+    private int ssoSessionMaxLifespan;
+    protected int accessTokenLifespan;
+    protected int accessCodeLifespan;
+    protected int accessCodeLifespanUserAction;
+    protected int notBefore;
+
+    @Column(length = 2048)
+    protected String publicKeyPem;
+    @Column(length = 2048)
+    protected String privateKeyPem;
+
+    protected String loginTheme;
+    protected String accountTheme;
+    protected String adminTheme;
+    protected String emailTheme;
+
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="User_RequiredCreds")
+    Collection<RequiredCredentialEntity> requiredCredentials = new ArrayList<RequiredCredentialEntity>();
+
+
+    @OneToMany(cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="AuthProviders")
+    List<AuthenticationProviderEntity> authenticationProviders = new ArrayList<AuthenticationProviderEntity>();
+
+    @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    Collection<ApplicationEntity> applications = new ArrayList<ApplicationEntity>();
+
+    @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true, mappedBy = "realm")
+    Collection<RoleEntity> roles = new ArrayList<RoleEntity>();
+
+    @ElementCollection
+    @MapKeyColumn(name="name")
+    @Column(name="value")
+    @CollectionTable
+    protected Map<String, String> smtpConfig = new HashMap<String, String>();
+
+    @ElementCollection
+    @MapKeyColumn(name="name")
+    @Column(name="value")
+    @CollectionTable
+    protected Map<String, String> socialConfig = new HashMap<String, String>();
+
+    @ElementCollection
+    @MapKeyColumn(name="name")
+    @Column(name="value")
+    @CollectionTable
+    protected Map<String, String> ldapServerConfig = new HashMap<String, String>();
+
+    @OneToMany(fetch = FetchType.LAZY, cascade ={CascadeType.REMOVE}, orphanRemoval = true)
+    @JoinTable(name="RealmDefaultRoles")
+    protected Collection<RoleEntity> defaultRoles = new ArrayList<RoleEntity>();
+
+    protected boolean auditEnabled;
+    protected long auditExpiration;
+
+    @ElementCollection
+    protected Set<String> auditListeners= new HashSet<String>();
+
+    @OneToOne
+    protected ApplicationEntity masterAdminApp;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public boolean isSslNotRequired() {
+        return sslNotRequired;
+    }
+
+    public void setSslNotRequired(boolean sslNotRequired) {
+        this.sslNotRequired = sslNotRequired;
+    }
+
+    public boolean isPasswordCredentialGrantAllowed() {
+        return passwordCredentialGrantAllowed;
+    }
+
+    public void setPasswordCredentialGrantAllowed(boolean passwordCredentialGrantAllowed) {
+        this.passwordCredentialGrantAllowed = passwordCredentialGrantAllowed;
+    }
+
+    public boolean isRegistrationAllowed() {
+        return registrationAllowed;
+    }
+
+    public void setRegistrationAllowed(boolean registrationAllowed) {
+        this.registrationAllowed = registrationAllowed;
+    }
+
+    public boolean isRememberMe() {
+        return rememberMe;
+    }
+
+    public void setRememberMe(boolean rememberMe) {
+        this.rememberMe = rememberMe;
+    }
+
+    public boolean isVerifyEmail() {
+        return verifyEmail;
+    }
+
+    public void setVerifyEmail(boolean verifyEmail) {
+        this.verifyEmail = verifyEmail;
+    }
+
+    public boolean isResetPasswordAllowed() {
+        return resetPasswordAllowed;
+    }
+
+    public void setResetPasswordAllowed(boolean resetPasswordAllowed) {
+        this.resetPasswordAllowed = resetPasswordAllowed;
+    }
+
+    public boolean isSocial() {
+        return social;
+    }
+
+    public void setSocial(boolean social) {
+        this.social = social;
+    }
+
+    public boolean isUpdateProfileOnInitialSocialLogin() {
+        return updateProfileOnInitialSocialLogin;
+    }
+
+    public void setUpdateProfileOnInitialSocialLogin(boolean updateProfileOnInitialSocialLogin) {
+        this.updateProfileOnInitialSocialLogin = updateProfileOnInitialSocialLogin;
+    }
+
+    public int getSsoSessionIdleTimeout() {
+        return ssoSessionIdleTimeout;
+    }
+
+    public void setSsoSessionIdleTimeout(int ssoSessionIdleTimeout) {
+        this.ssoSessionIdleTimeout = ssoSessionIdleTimeout;
+    }
+
+    public int getSsoSessionMaxLifespan() {
+        return ssoSessionMaxLifespan;
+    }
+
+    public void setSsoSessionMaxLifespan(int ssoSessionMaxLifespan) {
+        this.ssoSessionMaxLifespan = ssoSessionMaxLifespan;
+    }
+
+    public int getAccessTokenLifespan() {
+        return accessTokenLifespan;
+    }
+
+    public void setAccessTokenLifespan(int accessTokenLifespan) {
+        this.accessTokenLifespan = accessTokenLifespan;
+    }
+
+    public int getAccessCodeLifespan() {
+        return accessCodeLifespan;
+    }
+
+    public void setAccessCodeLifespan(int accessCodeLifespan) {
+        this.accessCodeLifespan = accessCodeLifespan;
+    }
+
+    public int getAccessCodeLifespanUserAction() {
+        return accessCodeLifespanUserAction;
+    }
+
+    public void setAccessCodeLifespanUserAction(int accessCodeLifespanUserAction) {
+        this.accessCodeLifespanUserAction = accessCodeLifespanUserAction;
+    }
+
+    public String getPublicKeyPem() {
+        return publicKeyPem;
+    }
+
+    public void setPublicKeyPem(String publicKeyPem) {
+        this.publicKeyPem = publicKeyPem;
+    }
+
+    public String getPrivateKeyPem() {
+        return privateKeyPem;
+    }
+
+    public void setPrivateKeyPem(String privateKeyPem) {
+        this.privateKeyPem = privateKeyPem;
+    }
+
+    public Collection<RequiredCredentialEntity> getRequiredCredentials() {
+        return requiredCredentials;
+    }
+
+    public void setRequiredCredentials(Collection<RequiredCredentialEntity> requiredCredentials) {
+        this.requiredCredentials = requiredCredentials;
+    }
+
+    public List<AuthenticationProviderEntity> getAuthenticationProviders() {
+        return authenticationProviders;
+    }
+
+    public void setAuthenticationProviders(List<AuthenticationProviderEntity> authenticationProviders) {
+        this.authenticationProviders = authenticationProviders;
+    }
+
+    public Collection<ApplicationEntity> getApplications() {
+        return applications;
+    }
+
+    public void setApplications(Collection<ApplicationEntity> applications) {
+        this.applications = applications;
+    }
+
+    public Collection<RoleEntity> getRoles() {
+        return roles;
+    }
+
+    public void setRoles(Collection<RoleEntity> roles) {
+        this.roles = roles;
+    }
+
+    public void addRole(RoleEntity role) {
+        if (roles == null) {
+            roles = new ArrayList<RoleEntity>();
+        }
+        roles.add(role);
+    }
+
+    public Map<String, String> getSmtpConfig() {
+        return smtpConfig;
+    }
+
+    public void setSmtpConfig(Map<String, String> smtpConfig) {
+        this.smtpConfig = smtpConfig;
+    }
+
+    public Map<String, String> getSocialConfig() {
+        return socialConfig;
+    }
+
+    public void setSocialConfig(Map<String, String> socialConfig) {
+        this.socialConfig = socialConfig;
+    }
+
+    public Map<String, String> getLdapServerConfig() {
+        return ldapServerConfig;
+    }
+
+    public void setLdapServerConfig(Map<String, String> ldapServerConfig) {
+        this.ldapServerConfig = ldapServerConfig;
+    }
+
+    public Collection<RoleEntity> getDefaultRoles() {
+        return defaultRoles;
+    }
+
+    public void setDefaultRoles(Collection<RoleEntity> defaultRoles) {
+        this.defaultRoles = defaultRoles;
+    }
+
+    public String getPasswordPolicy() {
+        return passwordPolicy;
+    }
+
+    public void setPasswordPolicy(String passwordPolicy) {
+        this.passwordPolicy = passwordPolicy;
+    }
+
+    public String getLoginTheme() {
+        return loginTheme;
+    }
+
+    public void setLoginTheme(String theme) {
+        this.loginTheme = theme;
+    }
+
+    public String getAccountTheme() {
+        return accountTheme;
+    }
+
+    public void setAccountTheme(String theme) {
+        this.accountTheme = theme;
+    }
+
+    public String getAdminTheme() {
+        return adminTheme;
+    }
+
+    public void setAdminTheme(String adminTheme) {
+        this.adminTheme = adminTheme;
+    }
+
+    public String getEmailTheme() {
+        return emailTheme;
+    }
+
+    public void setEmailTheme(String emailTheme) {
+        this.emailTheme = emailTheme;
+    }
+
+    public int getNotBefore() {
+        return notBefore;
+    }
+
+    public void setNotBefore(int notBefore) {
+        this.notBefore = notBefore;
+    }
+
+    public boolean isBruteForceProtected() {
+        return bruteForceProtected;
+    }
+
+    public void setBruteForceProtected(boolean bruteForceProtected) {
+        this.bruteForceProtected = bruteForceProtected;
+    }
+
+    public int getMaxFailureWaitSeconds() {
+        return maxFailureWaitSeconds;
+    }
+
+    public void setMaxFailureWaitSeconds(int maxFailureWaitSeconds) {
+        this.maxFailureWaitSeconds = maxFailureWaitSeconds;
+    }
+
+    public int getMinimumQuickLoginWaitSeconds() {
+        return minimumQuickLoginWaitSeconds;
+    }
+
+    public void setMinimumQuickLoginWaitSeconds(int minimumQuickLoginWaitSeconds) {
+        this.minimumQuickLoginWaitSeconds = minimumQuickLoginWaitSeconds;
+    }
+
+    public int getWaitIncrementSeconds() {
+        return waitIncrementSeconds;
+    }
+
+    public void setWaitIncrementSeconds(int waitIncrementSeconds) {
+        this.waitIncrementSeconds = waitIncrementSeconds;
+    }
+
+    public long getQuickLoginCheckMilliSeconds() {
+        return quickLoginCheckMilliSeconds;
+    }
+
+    public void setQuickLoginCheckMilliSeconds(long quickLoginCheckMilliSeconds) {
+        this.quickLoginCheckMilliSeconds = quickLoginCheckMilliSeconds;
+    }
+
+    public int getMaxDeltaTimeSeconds() {
+        return maxDeltaTimeSeconds;
+    }
+
+    public void setMaxDeltaTimeSeconds(int maxDeltaTimeSeconds) {
+        this.maxDeltaTimeSeconds = maxDeltaTimeSeconds;
+    }
+
+    public int getFailureFactor() {
+        return failureFactor;
+    }
+
+    public void setFailureFactor(int failureFactor) {
+        this.failureFactor = failureFactor;
+    }
+
+    public boolean isAuditEnabled() {
+        return auditEnabled;
+    }
+
+    public void setAuditEnabled(boolean auditEnabled) {
+        this.auditEnabled = auditEnabled;
+    }
+
+    public long getAuditExpiration() {
+        return auditExpiration;
+    }
+
+    public void setAuditExpiration(long auditExpiration) {
+        this.auditExpiration = auditExpiration;
+    }
+
+    public Set<String> getAuditListeners() {
+        return auditListeners;
+    }
+
+    public void setAuditListeners(Set<String> auditListeners) {
+        this.auditListeners = auditListeners;
+    }
+
+    public ApplicationEntity getMasterAdminApp() {
+        return masterAdminApp;
+    }
+
+    public void setMasterAdminApp(ApplicationEntity masterAdminApp) {
+        this.masterAdminApp = masterAdminApp;
+    }
+
+}
+

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RequiredCredentialEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RequiredCredentialEntity.java
new file mode 100755
index 0000000..6c14c86
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RequiredCredentialEntity.java
@@ -0,0 +1,64 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import org.hibernate.annotations.GenericGenerator;
+
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.Id;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+public class RequiredCredentialEntity {
+    @Id
+    @GenericGenerator(name="keycloak_generator", strategy="org.keycloak.models.realms.jpa.utils.JpaIdGenerator")
+    @GeneratedValue(generator = "keycloak_generator")
+    protected String id;
+
+    protected String type;
+    protected boolean input;
+    protected boolean secret;
+    protected String formLabel;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public boolean isInput() {
+        return input;
+    }
+
+    public void setInput(boolean input) {
+        this.input = input;
+    }
+
+    public boolean isSecret() {
+        return secret;
+    }
+
+    public void setSecret(boolean secret) {
+        this.secret = secret;
+    }
+
+    public String getFormLabel() {
+        return formLabel;
+    }
+
+    public void setFormLabel(String formLabel) {
+        this.formLabel = formLabel;
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RoleEntity.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RoleEntity.java
new file mode 100755
index 0000000..36775ad
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/entities/RoleEntity.java
@@ -0,0 +1,152 @@
+package org.keycloak.models.realms.jpa.entities;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.JoinTable;
+import javax.persistence.ManyToMany;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+import javax.persistence.UniqueConstraint;
+import java.util.ArrayList;
+import java.util.Collection;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+@Table(uniqueConstraints = {
+        @UniqueConstraint(columnNames = { "name", "appRealmConstraint" })
+})
+@NamedQueries({
+        @NamedQuery(name="getAppRoleByName", query="select role from RoleEntity role where role.name = :name and role.application = :application"),
+        @NamedQuery(name="getRealmRoleByName", query="select role from RoleEntity role where role.applicationRole = false and role.name = :name and role.realm = :realm")
+})
+
+public class RoleEntity {
+    @Id
+    @Column(name="id")
+    private String id;
+
+    private String name;
+    private String description;
+
+    // hax! couldn't get constraint to work properly
+    private String realmId;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "realm")
+    private RealmEntity realm;
+
+    @Column(name="applicationRole")
+    private boolean applicationRole;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "application")
+    private ApplicationEntity application;
+
+    // Hack to ensure that either name+application or name+realm are unique. Needed due to MS-SQL as it don't allow multiple NULL values in the column, which is part of constraint
+    private String appRealmConstraint;
+
+    @ManyToMany(fetch = FetchType.LAZY, cascade = {})
+    @JoinTable(name = "CompositeRole", joinColumns = @JoinColumn(name = "composite"), inverseJoinColumns = @JoinColumn(name = "childRole"))
+    private Collection<RoleEntity> compositeRoles = new ArrayList<RoleEntity>();
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getRealmId() {
+        return realmId;
+    }
+
+    public void setRealmId(String realmId) {
+        this.realmId = realmId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Collection<RoleEntity> getCompositeRoles() {
+        return compositeRoles;
+    }
+
+    public void setCompositeRoles(Collection<RoleEntity> compositeRoles) {
+        this.compositeRoles = compositeRoles;
+    }
+
+    public boolean isApplicationRole() {
+        return applicationRole;
+    }
+
+    public void setApplicationRole(boolean applicationRole) {
+        this.applicationRole = applicationRole;
+    }
+
+    public RealmEntity getRealm() {
+        return realm;
+    }
+
+    public void setRealm(RealmEntity realm) {
+        this.realm = realm;
+        this.appRealmConstraint = realm.getId();
+    }
+
+    public ApplicationEntity getApplication() {
+        return application;
+    }
+
+    public void setApplication(ApplicationEntity application) {
+        this.application = application;
+        if (application != null) {
+            this.appRealmConstraint = application.getId();
+        }
+    }
+
+    public String getAppRealmConstraint() {
+        return appRealmConstraint;
+    }
+
+    public void setAppRealmConstraint(String appRealmConstraint) {
+        this.appRealmConstraint = appRealmConstraint;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        RoleEntity that = (RoleEntity) o;
+
+        if (!id.equals(that.id)) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        return id.hashCode();
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaKeycloakTransaction.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaKeycloakTransaction.java
new file mode 100755
index 0000000..fd41714
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaKeycloakTransaction.java
@@ -0,0 +1,53 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaRealmProvider.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaRealmProvider.java
new file mode 100755
index 0000000..00c833c
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/JpaRealmProvider.java
@@ -0,0 +1,135 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.OAuthClient;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.realms.jpa.entities.ApplicationEntity;
+import org.keycloak.models.realms.jpa.entities.OAuthClientEntity;
+import org.keycloak.models.realms.jpa.entities.RealmEntity;
+import org.keycloak.models.realms.jpa.entities.RoleEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaRealmProvider implements RealmProvider {
+
+    protected final EntityManager em;
+
+    public JpaRealmProvider(EntityManager em) {
+        this.em = PersistenceExceptionConverter.create(em);
+    }
+
+    @Override
+    public KeycloakTransaction getTransaction() {
+        return new JpaKeycloakTransaction(em);
+    }
+
+    @Override
+    public Realm createRealm(String name) {
+        return createRealm(KeycloakModelUtils.generateId(), name);
+    }
+
+    @Override
+    public Realm createRealm(String id, String name) {
+        RealmEntity realm = new RealmEntity();
+        realm.setName(name);
+        realm.setId(id);
+        em.persist(realm);
+        em.flush();
+        return new RealmAdapter(this, em, realm);
+    }
+
+    @Override
+    public Realm getRealm(String id) {
+        RealmEntity realm = em.find(RealmEntity.class, id);
+        if (realm == null) return null;
+        return new RealmAdapter(this, em, realm);
+    }
+
+    @Override
+    public List<Realm> getRealms() {
+        TypedQuery<RealmEntity> query = em.createNamedQuery("getAllRealms", RealmEntity.class);
+        List<RealmEntity> entities = query.getResultList();
+        List<Realm> realms = new ArrayList<Realm>();
+        for (RealmEntity entity : entities) {
+            realms.add(new RealmAdapter(this, em, entity));
+        }
+        return realms;
+    }
+
+    @Override
+    public Realm getRealmByName(String name) {
+        TypedQuery<RealmEntity> query = em.createNamedQuery("getRealmByName", RealmEntity.class);
+        query.setParameter("name", name);
+        List<RealmEntity> entities = query.getResultList();
+        if (entities.size() == 0) return null;
+        if (entities.size() > 1) throw new IllegalStateException("Should not be more than one realm with same name");
+        RealmEntity realm = query.getResultList().get(0);
+        if (realm == null) return null;
+        return new RealmAdapter(this, em, realm);
+    }
+
+    @Override
+    public boolean removeRealm(String id) {
+        RealmEntity realm = em.find(RealmEntity.class, id);
+        if (realm == null) {
+            return false;
+        }
+
+        RealmAdapter adapter = new RealmAdapter(this, em, realm);
+        for (Application a : adapter.getApplications()) {
+            adapter.removeApplication(a);
+        }
+
+        for (OAuthClient oauth : adapter.getOAuthClients()) {
+            adapter.removeOAuthClient(oauth);
+        }
+
+        em.remove(realm);
+
+        return true;
+    }
+
+    @Override
+    public void close() {
+        if (em.getTransaction().isActive()) em.getTransaction().rollback();
+        if (em.isOpen()) em.close();
+    }
+
+    @Override
+    public Role getRoleById(String id, String realm) {
+        RoleEntity entity = em.find(RoleEntity.class, id);
+        if (entity == null) return null;
+        if (!realm.equals(entity.getRealmId())) return null;
+        return new RoleAdapter(this, em, entity);
+    }
+
+    @Override
+    public Application getApplicationById(String id, String realm) {
+        ApplicationEntity app = em.find(ApplicationEntity.class, id);
+
+        // Check if application belongs to this realm
+        if (app == null || !realm.equals(app.getRealm().getId())) return null;
+        return new ApplicationAdapter(this, em, app);
+    }
+
+    @Override
+    public OAuthClient getOAuthClientById(String id, String realm) {
+        OAuthClientEntity client = em.find(OAuthClientEntity.class, id);
+
+        // Check if client belongs to this realm
+        if (client == null || !realm.equals(client.getRealm().getId())) return null;
+        return new OAuthClientAdapter(this, client, em);
+    }
+
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/OAuthClientAdapter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/OAuthClientAdapter.java
new file mode 100755
index 0000000..b792a7d
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/OAuthClientAdapter.java
@@ -0,0 +1,52 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.realms.OAuthClient;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.jpa.entities.OAuthClientEntity;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class OAuthClientAdapter extends ClientAdapter implements OAuthClient {
+
+    protected final OAuthClientEntity oAuthClientEntity;
+
+    public OAuthClientAdapter(RealmProvider provider, OAuthClientEntity entity, EntityManager em) {
+        super(provider, entity, em);
+        oAuthClientEntity = entity;
+    }
+
+    @Override
+    public void setClientId(String id) {
+        entity.setName(id);
+
+    }
+
+    @Override
+    public boolean isDirectGrantsOnly() {
+        return oAuthClientEntity.isDirectGrantsOnly();
+    }
+
+    @Override
+    public void setDirectGrantsOnly(boolean flag) {
+        oAuthClientEntity.setDirectGrantsOnly(flag);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof OAuthClient)) return false;
+
+        OAuthClient that = (OAuthClient) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/PersistenceExceptionConverter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/PersistenceExceptionConverter.java
new file mode 100644
index 0000000..f479939
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/PersistenceExceptionConverter.java
@@ -0,0 +1,48 @@
+package org.keycloak.models.realms.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RealmAdapter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RealmAdapter.java
new file mode 100755
index 0000000..ffbbacf
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RealmAdapter.java
@@ -0,0 +1,853 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.AuthenticationProviderModel;
+import org.keycloak.models.PasswordPolicy;
+import org.keycloak.models.RequiredCredentialModel;
+import org.keycloak.models.realms.Application;
+import org.keycloak.models.realms.Client;
+import org.keycloak.models.realms.OAuthClient;
+import org.keycloak.models.realms.Realm;
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.realms.jpa.entities.ApplicationEntity;
+import org.keycloak.models.realms.jpa.entities.AuthenticationProviderEntity;
+import org.keycloak.models.realms.jpa.entities.OAuthClientEntity;
+import org.keycloak.models.realms.jpa.entities.RealmEntity;
+import org.keycloak.models.realms.jpa.entities.RequiredCredentialEntity;
+import org.keycloak.models.realms.jpa.entities.RoleEntity;
+import org.keycloak.models.realms.jpa.entities.ScopeMappingEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class RealmAdapter implements Realm {
+    protected RealmEntity realm;
+    protected RealmProvider provider;
+    protected EntityManager em;
+    protected volatile transient PublicKey publicKey;
+    protected volatile transient PrivateKey privateKey;
+    protected PasswordPolicy passwordPolicy;
+
+    public RealmAdapter(RealmProvider provider, EntityManager em, RealmEntity realm) {
+        this.provider = provider;
+        this.em = em;
+        this.realm = realm;
+    }
+
+    public RealmEntity getEntity() {
+        return realm;
+    }
+
+    @Override
+    public String getId() {
+        return realm.getId();
+    }
+
+    @Override
+    public String getName() {
+        return realm.getName();
+    }
+
+    @Override
+    public void setName(String name) {
+        realm.setName(name);
+        em.flush();
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return realm.isEnabled();
+    }
+
+    @Override
+    public void setEnabled(boolean enabled) {
+        realm.setEnabled(enabled);
+        em.flush();
+    }
+
+    @Override
+    public boolean isSslNotRequired() {
+        return realm.isSslNotRequired();
+    }
+
+    @Override
+    public void setSslNotRequired(boolean sslNotRequired) {
+        realm.setSslNotRequired(sslNotRequired);
+        em.flush();
+    }
+
+    @Override
+    public boolean isPasswordCredentialGrantAllowed() {
+        return realm.isPasswordCredentialGrantAllowed();
+    }
+
+    @Override
+    public void setPasswordCredentialGrantAllowed(boolean passwordCredentialGrantAllowed) {
+        realm.setPasswordCredentialGrantAllowed(passwordCredentialGrantAllowed);
+        em.flush();
+    }
+
+    @Override
+    public boolean isRegistrationAllowed() {
+        return realm.isRegistrationAllowed();
+    }
+
+    @Override
+    public void setRegistrationAllowed(boolean registrationAllowed) {
+        realm.setRegistrationAllowed(registrationAllowed);
+        em.flush();
+    }
+
+    @Override
+    public boolean isRememberMe() {
+        return realm.isRememberMe();
+    }
+
+    @Override
+    public void setRememberMe(boolean rememberMe) {
+        realm.setRememberMe(rememberMe);
+        em.flush();
+    }
+
+    @Override
+    public boolean isBruteForceProtected() {
+        return realm.isBruteForceProtected();
+    }
+
+    @Override
+    public void setBruteForceProtected(boolean value) {
+        realm.setBruteForceProtected(value);
+    }
+
+    @Override
+    public int getMaxFailureWaitSeconds() {
+        return realm.getMaxFailureWaitSeconds();
+    }
+
+    @Override
+    public void setMaxFailureWaitSeconds(int val) {
+        realm.setMaxFailureWaitSeconds(val);
+    }
+
+    @Override
+    public int getWaitIncrementSeconds() {
+        return realm.getWaitIncrementSeconds();
+    }
+
+    @Override
+    public void setWaitIncrementSeconds(int val) {
+        realm.setWaitIncrementSeconds(val);
+    }
+
+    @Override
+    public long getQuickLoginCheckMilliSeconds() {
+        return realm.getQuickLoginCheckMilliSeconds();
+    }
+
+    @Override
+    public void setQuickLoginCheckMilliSeconds(long val) {
+        realm.setQuickLoginCheckMilliSeconds(val);
+    }
+
+    @Override
+    public int getMinimumQuickLoginWaitSeconds() {
+        return realm.getMinimumQuickLoginWaitSeconds();
+    }
+
+    @Override
+    public void setMinimumQuickLoginWaitSeconds(int val) {
+        realm.setMinimumQuickLoginWaitSeconds(val);
+    }
+
+    @Override
+    public int getMaxDeltaTimeSeconds() {
+        return realm.getMaxDeltaTimeSeconds();
+    }
+
+    @Override
+    public void setMaxDeltaTimeSeconds(int val) {
+        realm.setMaxDeltaTimeSeconds(val);
+    }
+
+    @Override
+    public int getFailureFactor() {
+        return realm.getFailureFactor();
+    }
+
+    @Override
+    public void setFailureFactor(int failureFactor) {
+        realm.setFailureFactor(failureFactor);
+    }
+
+    @Override
+    public boolean isVerifyEmail() {
+        return realm.isVerifyEmail();
+    }
+
+    @Override
+    public void setVerifyEmail(boolean verifyEmail) {
+        realm.setVerifyEmail(verifyEmail);
+        em.flush();
+    }
+
+    @Override
+    public boolean isResetPasswordAllowed() {
+        return realm.isResetPasswordAllowed();
+    }
+
+    @Override
+    public void setResetPasswordAllowed(boolean resetPasswordAllowed) {
+        realm.setResetPasswordAllowed(resetPasswordAllowed);
+        em.flush();
+    }
+
+    @Override
+    public int getNotBefore() {
+        return realm.getNotBefore();
+    }
+
+    @Override
+    public void setNotBefore(int notBefore) {
+        realm.setNotBefore(notBefore);
+    }
+
+    @Override
+    public int getAccessTokenLifespan() {
+        return realm.getAccessTokenLifespan();
+    }
+
+    @Override
+    public void setAccessTokenLifespan(int tokenLifespan) {
+        realm.setAccessTokenLifespan(tokenLifespan);
+        em.flush();
+    }
+
+    @Override
+    public int getSsoSessionIdleTimeout() {
+        return realm.getSsoSessionIdleTimeout();
+    }
+
+    @Override
+    public void setSsoSessionIdleTimeout(int seconds) {
+        realm.setSsoSessionIdleTimeout(seconds);
+    }
+
+    @Override
+    public int getSsoSessionMaxLifespan() {
+        return realm.getSsoSessionMaxLifespan();
+    }
+
+    @Override
+    public void setSsoSessionMaxLifespan(int seconds) {
+        realm.setSsoSessionMaxLifespan(seconds);
+    }
+
+    @Override
+    public int getAccessCodeLifespan() {
+        return realm.getAccessCodeLifespan();
+    }
+
+    @Override
+    public void setAccessCodeLifespan(int accessCodeLifespan) {
+        realm.setAccessCodeLifespan(accessCodeLifespan);
+        em.flush();
+    }
+
+    @Override
+    public int getAccessCodeLifespanUserAction() {
+        return realm.getAccessCodeLifespanUserAction();
+    }
+
+    @Override
+    public void setAccessCodeLifespanUserAction(int accessCodeLifespanUserAction) {
+        realm.setAccessCodeLifespanUserAction(accessCodeLifespanUserAction);
+        em.flush();
+    }
+
+    @Override
+    public String getPublicKeyPem() {
+        return realm.getPublicKeyPem();
+    }
+
+    @Override
+    public void setPublicKeyPem(String publicKeyPem) {
+        realm.setPublicKeyPem(publicKeyPem);
+        em.flush();
+    }
+
+    @Override
+    public String getPrivateKeyPem() {
+        return realm.getPrivateKeyPem();
+    }
+
+    @Override
+    public void setPrivateKeyPem(String privateKeyPem) {
+        realm.setPrivateKeyPem(privateKeyPem);
+        em.flush();
+    }
+
+    @Override
+    public PublicKey getPublicKey() {
+        if (publicKey != null) return publicKey;
+        publicKey = KeycloakModelUtils.getPublicKey(getPublicKeyPem());
+        return publicKey;
+    }
+
+    @Override
+    public void setPublicKey(PublicKey publicKey) {
+        this.publicKey = publicKey;
+        String publicKeyPem = KeycloakModelUtils.getPemFromKey(publicKey);
+        setPublicKeyPem(publicKeyPem);
+    }
+
+    @Override
+    public PrivateKey getPrivateKey() {
+        if (privateKey != null) return privateKey;
+        privateKey = KeycloakModelUtils.getPrivateKey(getPrivateKeyPem());
+        return privateKey;
+    }
+
+    @Override
+    public void setPrivateKey(PrivateKey privateKey) {
+        this.privateKey = privateKey;
+        String privateKeyPem = KeycloakModelUtils.getPemFromKey(privateKey);
+        setPrivateKeyPem(privateKeyPem);
+    }
+
+    protected RequiredCredentialModel initRequiredCredentialModel(String type) {
+        RequiredCredentialModel model = RequiredCredentialModel.BUILT_IN.get(type);
+        if (model == null) {
+            throw new RuntimeException("Unknown credential type " + type);
+        }
+        return model;
+    }
+
+    @Override
+    public void addRequiredCredential(String type) {
+        RequiredCredentialModel model = initRequiredCredentialModel(type);
+        addRequiredCredential(model);
+        em.flush();
+    }
+
+    public void addRequiredCredential(RequiredCredentialModel model) {
+        RequiredCredentialEntity entity = new RequiredCredentialEntity();
+        entity.setInput(model.isInput());
+        entity.setSecret(model.isSecret());
+        entity.setType(model.getType());
+        entity.setFormLabel(model.getFormLabel());
+        em.persist(entity);
+        realm.getRequiredCredentials().add(entity);
+        em.flush();
+    }
+
+    @Override
+    public void updateRequiredCredentials(Set<String> creds) {
+        Collection<RequiredCredentialEntity> relationships = realm.getRequiredCredentials();
+        if (relationships == null) relationships = new ArrayList<RequiredCredentialEntity>();
+
+        Set<String> already = new HashSet<String>();
+        List<RequiredCredentialEntity> remove = new ArrayList<RequiredCredentialEntity>();
+        for (RequiredCredentialEntity rel : relationships) {
+            if (!creds.contains(rel.getType())) {
+                remove.add(rel);
+            } else {
+                already.add(rel.getType());
+            }
+        }
+        for (RequiredCredentialEntity entity : remove) {
+            relationships.remove(entity);
+            em.remove(entity);
+        }
+        for (String cred : creds) {
+            if (!already.contains(cred)) {
+                addRequiredCredential(cred);
+            }
+        }
+        em.flush();
+    }
+
+
+    @Override
+    public List<RequiredCredentialModel> getRequiredCredentials() {
+        List<RequiredCredentialModel> requiredCredentialModels = new ArrayList<RequiredCredentialModel>();
+        Collection<RequiredCredentialEntity> entities = realm.getRequiredCredentials();
+        if (entities == null) return requiredCredentialModels;
+        for (RequiredCredentialEntity entity : entities) {
+            RequiredCredentialModel model = new RequiredCredentialModel();
+            model.setFormLabel(entity.getFormLabel());
+            model.setType(entity.getType());
+            model.setSecret(entity.isSecret());
+            model.setInput(entity.isInput());
+            requiredCredentialModels.add(model);
+        }
+        return requiredCredentialModels;  //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public List<String> getDefaultRoles() {
+        Collection<RoleEntity> entities = realm.getDefaultRoles();
+        List<String> roles = new ArrayList<String>();
+        if (entities == null) return roles;
+        for (RoleEntity entity : entities) {
+            roles.add(entity.getName());
+        }
+        return roles;
+    }
+
+    @Override
+    public void addDefaultRole(String name) {
+        Role role = getRole(name);
+        Collection<RoleEntity> entities = realm.getDefaultRoles();
+        for (RoleEntity entity : entities) {
+            if (entity.getId().equals(role.getId())) {
+                return;
+            }
+        }
+        realm.getDefaultRoles().add(((RoleAdapter) role).getRole());
+        em.flush();
+    }
+
+    public static boolean contains(String str, String[] array) {
+        for (String s : array) {
+            if (str.equals(s)) return true;
+        }
+        return false;
+    }
+
+    @Override
+    public void updateDefaultRoles(String[] defaultRoles) {
+        Collection<RoleEntity> entities = realm.getDefaultRoles();
+        Set<String> already = new HashSet<String>();
+        List<RoleEntity> remove = new ArrayList<RoleEntity>();
+        for (RoleEntity rel : entities) {
+            if (!contains(rel.getName(), defaultRoles)) {
+                remove.add(rel);
+            } else {
+                already.add(rel.getName());
+            }
+        }
+        for (RoleEntity entity : remove) {
+            entities.remove(entity);
+        }
+        em.flush();
+        for (String roleName : defaultRoles) {
+            if (!already.contains(roleName)) {
+                addDefaultRole(roleName);
+            }
+        }
+        em.flush();
+    }
+
+    @Override
+    public Client findClient(String clientId) {
+        Client model = getApplicationByName(clientId);
+        if (model != null) return model;
+        return getOAuthClient(clientId);
+    }
+
+    @Override
+    public Map<String, Application> getApplicationNameMap() {
+        Map<String, Application> map = new HashMap<String, Application>();
+        for (Application app : getApplications()) {
+            map.put(app.getName(), app);
+        }
+        return map;  //To change body of implemented methods use File | Settings | File Templates.
+    }
+
+    @Override
+    public List<Application> getApplications() {
+        List<Application> list = new ArrayList<Application>();
+        if (realm.getApplications() == null) return list;
+        for (ApplicationEntity entity : realm.getApplications()) {
+            list.add(new ApplicationAdapter(provider, em, entity));
+        }
+        return list;
+    }
+
+    @Override
+    public Application addApplication(String id, String name) {
+        ApplicationEntity applicationData = new ApplicationEntity();
+        applicationData.setId(id);
+        applicationData.setName(name);
+        applicationData.setEnabled(true);
+        applicationData.setRealm(realm);
+        realm.getApplications().add(applicationData);
+        em.persist(applicationData);
+        em.flush();
+        Application resource = new ApplicationAdapter(provider, em, applicationData);
+        em.flush();
+        return resource;
+    }
+
+    @Override
+    public boolean removeApplication(Application application) {
+        for (Role role : application.getRoles()) {
+            application.removeRole(role);
+        }
+
+        ApplicationEntity applicationEntity = null;
+        Iterator<ApplicationEntity> it = realm.getApplications().iterator();
+        while (it.hasNext()) {
+            ApplicationEntity ae = it.next();
+            if (ae.getId().equals(application.getId())) {
+                applicationEntity = ae;
+                it.remove();
+                break;
+            }
+        }
+        for (ApplicationEntity a : realm.getApplications()) {
+            if (a.getId().equals(application.getId())) {
+                applicationEntity = a;
+            }
+        }
+        if (application == null) {
+            return false;
+        }
+        em.remove(applicationEntity);
+        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where client = :client").setParameter("client", applicationEntity).executeUpdate();
+
+        return true;
+    }
+
+    @Override
+    public Application getApplicationByName(String name) {
+        return getApplicationNameMap().get(name);
+    }
+
+    @Override
+    public boolean isSocial() {
+        return realm.isSocial();
+    }
+
+    @Override
+    public void setSocial(boolean social) {
+        realm.setSocial(social);
+        em.flush();
+    }
+
+    @Override
+    public boolean isUpdateProfileOnInitialSocialLogin() {
+        return realm.isUpdateProfileOnInitialSocialLogin();
+    }
+
+    @Override
+    public void setUpdateProfileOnInitialSocialLogin(boolean updateProfileOnInitialSocialLogin) {
+        realm.setUpdateProfileOnInitialSocialLogin(updateProfileOnInitialSocialLogin);
+        em.flush();
+    }
+
+    @Override
+    public OAuthClient addOAuthClient(String id, String name) {
+        OAuthClientEntity data = new OAuthClientEntity();
+        data.setId(id);
+        data.setEnabled(true);
+        data.setName(name);
+        data.setRealm(realm);
+        em.persist(data);
+        em.flush();
+        return new OAuthClientAdapter(provider, data, em);
+    }
+
+    @Override
+    public boolean removeOAuthClient(OAuthClient client) {
+        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where client = :client").setParameter("client", client).executeUpdate();
+        em.remove(client);
+        return true;
+    }
+
+
+    @Override
+    public OAuthClient getOAuthClient(String name) {
+        TypedQuery<OAuthClientEntity> query = em.createNamedQuery("findOAuthClientByName", OAuthClientEntity.class);
+        query.setParameter("name", name);
+        query.setParameter("realm", realm);
+        List<OAuthClientEntity> entities = query.getResultList();
+        if (entities.size() == 0) return null;
+        return new OAuthClientAdapter(provider, entities.get(0), em);
+    }
+
+    @Override
+    public List<OAuthClient> getOAuthClients() {
+        TypedQuery<OAuthClientEntity> query = em.createNamedQuery("findOAuthClientByRealm", OAuthClientEntity.class);
+        query.setParameter("realm", realm);
+        List<OAuthClientEntity> entities = query.getResultList();
+        List<OAuthClient> list = new ArrayList<OAuthClient>();
+        for (OAuthClientEntity entity : entities) list.add(new OAuthClientAdapter(provider, entity, em));
+        return list;
+    }
+
+    @Override
+    public Map<String, String> getSmtpConfig() {
+        return realm.getSmtpConfig();
+    }
+
+    @Override
+    public void setSmtpConfig(Map<String, String> smtpConfig) {
+        realm.setSmtpConfig(smtpConfig);
+        em.flush();
+    }
+
+    @Override
+    public Map<String, String> getSocialConfig() {
+        return realm.getSocialConfig();
+    }
+
+    @Override
+    public void setSocialConfig(Map<String, String> socialConfig) {
+        realm.setSocialConfig(socialConfig);
+        em.flush();
+    }
+
+    @Override
+    public Map<String, String> getLdapServerConfig() {
+        return realm.getLdapServerConfig();
+    }
+
+    @Override
+    public void setLdapServerConfig(Map<String, String> ldapServerConfig) {
+        realm.setLdapServerConfig(ldapServerConfig);
+        em.flush();
+    }
+
+    @Override
+    public List<AuthenticationProviderModel> getAuthenticationProviders() {
+        List<AuthenticationProviderEntity> entities = realm.getAuthenticationProviders();
+        List<AuthenticationProviderEntity> copy = new ArrayList<AuthenticationProviderEntity>();
+        for (AuthenticationProviderEntity entity : entities) {
+            copy.add(entity);
+
+        }
+        Collections.sort(copy, new Comparator<AuthenticationProviderEntity>() {
+
+            @Override
+            public int compare(AuthenticationProviderEntity o1, AuthenticationProviderEntity o2) {
+                return o1.getPriority() - o2.getPriority();
+            }
+
+        });
+        List<AuthenticationProviderModel> result = new ArrayList<AuthenticationProviderModel>();
+        for (AuthenticationProviderEntity entity : copy) {
+            result.add(new AuthenticationProviderModel(entity.getProviderName(), entity.isPasswordUpdateSupported(), entity.getConfig()));
+        }
+
+        return result;
+    }
+
+    @Override
+    public void setAuthenticationProviders(List<AuthenticationProviderModel> authenticationProviders) {
+        List<AuthenticationProviderEntity> newEntities = new ArrayList<AuthenticationProviderEntity>();
+        int counter = 1;
+        for (AuthenticationProviderModel model : authenticationProviders) {
+            AuthenticationProviderEntity entity = new AuthenticationProviderEntity();
+            entity.setProviderName(model.getProviderName());
+            entity.setPasswordUpdateSupported(model.isPasswordUpdateSupported());
+            entity.setConfig(model.getConfig());
+            entity.setPriority(counter++);
+            newEntities.add(entity);
+        }
+
+        // Remove all existing first
+        Collection<AuthenticationProviderEntity> existing = realm.getAuthenticationProviders();
+        Collection<AuthenticationProviderEntity> copy = new ArrayList<AuthenticationProviderEntity>(existing);
+        for (AuthenticationProviderEntity apToRemove : copy) {
+            existing.remove(apToRemove);
+            em.remove(apToRemove);
+        }
+
+        // Now create all new providers
+        for (AuthenticationProviderEntity apToAdd : newEntities) {
+            existing.add(apToAdd);
+            em.persist(apToAdd);
+        }
+
+        em.flush();
+    }
+
+    @Override
+    public Role getRole(String name) {
+        TypedQuery<RoleEntity> query = em.createNamedQuery("getRealmRoleByName", RoleEntity.class);
+        query.setParameter("name", name);
+        query.setParameter("realm", realm);
+        List<RoleEntity> roles = query.getResultList();
+        if (roles.size() == 0) return null;
+        return new RoleAdapter(provider, em, roles.get(0));
+    }
+
+    @Override
+    public Role addRole(String id, String name) {
+        RoleEntity entity = new RoleEntity();
+        entity.setId(id);
+        entity.setName(name);
+        entity.setRealm(realm);
+        entity.setRealmId(realm.getId());
+        em.persist(entity);
+        realm.getRoles().add(entity);
+        em.flush();
+        return new RoleAdapter(provider, em, entity);
+    }
+
+    @Override
+    public boolean removeRole(Role role) {
+        if (role == null) {
+            return false;
+        }
+        if (!role.getContainer().equals(this)) return false;
+
+        RoleEntity roleEntity = ((RoleAdapter) role).getRole();
+        realm.getRoles().remove(role);
+        realm.getDefaultRoles().remove(role);
+
+        em.createNativeQuery("delete from CompositeRole where childRole = :role").setParameter("role", roleEntity).executeUpdate();
+        em.createQuery("delete from " + ScopeMappingEntity.class.getSimpleName() + " where role = :role").setParameter("role", roleEntity).executeUpdate();
+
+        em.remove(roleEntity);
+
+        return true;
+    }
+
+    @Override
+    public Set<Role> getRoles() {
+        Set<Role> list = new HashSet<Role>();
+        Collection<RoleEntity> roles = realm.getRoles();
+        if (roles == null) return list;
+        for (RoleEntity entity : roles) {
+            list.add(new RoleAdapter(provider, em, entity));
+        }
+        return list;
+    }
+
+    @Override
+    public PasswordPolicy getPasswordPolicy() {
+        if (passwordPolicy == null) {
+            passwordPolicy = new PasswordPolicy(realm.getPasswordPolicy());
+        }
+        return passwordPolicy;
+    }
+
+    @Override
+    public void setPasswordPolicy(PasswordPolicy policy) {
+        this.passwordPolicy = policy;
+        realm.setPasswordPolicy(policy.toString());
+        em.flush();
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof Realm)) return false;
+
+        Realm that = (Realm) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+
+    @Override
+    public String getLoginTheme() {
+        return realm.getLoginTheme();
+    }
+
+    @Override
+    public void setLoginTheme(String name) {
+        realm.setLoginTheme(name);
+        em.flush();
+    }
+
+    @Override
+    public String getAccountTheme() {
+        return realm.getAccountTheme();
+    }
+
+    @Override
+    public void setAccountTheme(String name) {
+        realm.setAccountTheme(name);
+        em.flush();
+    }
+
+    @Override
+    public String getAdminTheme() {
+        return realm.getAdminTheme();
+    }
+
+    @Override
+    public void setAdminTheme(String name) {
+        realm.setAdminTheme(name);
+        em.flush();
+    }
+
+    @Override
+    public String getEmailTheme() {
+        return realm.getEmailTheme();
+    }
+
+    @Override
+    public void setEmailTheme(String name) {
+        realm.setEmailTheme(name);
+        em.flush();
+    }
+
+    @Override
+    public boolean isAuditEnabled() {
+        return realm.isAuditEnabled();
+    }
+
+    @Override
+    public void setAuditEnabled(boolean enabled) {
+        realm.setAuditEnabled(enabled);
+        em.flush();
+    }
+
+    @Override
+    public long getAuditExpiration() {
+        return realm.getAuditExpiration();
+    }
+
+    @Override
+    public void setAuditExpiration(long expiration) {
+        realm.setAuditExpiration(expiration);
+        em.flush();
+    }
+
+    @Override
+    public Set<String> getAuditListeners() {
+        return realm.getAuditListeners();
+    }
+
+    @Override
+    public void setAuditListeners(Set<String> listeners) {
+        realm.setAuditListeners(listeners);
+        em.flush();
+    }
+
+    @Override
+    public Application getMasterAdminApp() {
+        return new ApplicationAdapter(provider, em, realm.getMasterAdminApp());
+    }
+
+    @Override
+    public void setMasterAdminApp(Application app) {
+        realm.setMasterAdminApp(((ApplicationAdapter) app).getJpaEntity());
+        em.flush();
+    }
+
+}

diff --git a/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RoleAdapter.java b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RoleAdapter.java
new file mode 100755
index 0000000..0063794
--- /dev/null
+++ b/model/realms-jpa/src/main/java/org/keycloak/models/realms/jpa/RoleAdapter.java
@@ -0,0 +1,117 @@
+package org.keycloak.models.realms.jpa;
+
+import org.keycloak.models.realms.RealmProvider;
+import org.keycloak.models.realms.Role;
+import org.keycloak.models.realms.RoleContainer;
+import org.keycloak.models.realms.jpa.entities.RoleEntity;
+
+import javax.persistence.EntityManager;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class RoleAdapter implements Role {
+    protected RoleEntity role;
+    protected RealmProvider provider;
+    protected EntityManager em;
+
+    public RoleAdapter(RealmProvider provider, EntityManager em, RoleEntity role) {
+        this.provider = provider;
+        this.em = em;
+        this.role = role;
+    }
+
+    public RoleEntity getRole() {
+        return role;
+    }
+
+    public void setRole(RoleEntity role) {
+        this.role = role;
+    }
+
+    @Override
+    public String getName() {
+        return role.getName();
+    }
+
+    @Override
+    public String getDescription() {
+        return role.getDescription();
+    }
+
+    @Override
+    public void setDescription(String description) {
+        role.setDescription(description);
+    }
+
+    @Override
+    public String getId() {
+        return role.getId();
+    }
+
+    @Override
+    public void setName(String name) {
+        role.setName(name);
+    }
+
+    @Override
+    public boolean isComposite() {
+        return getComposites().size() > 0;
+    }
+
+    @Override
+    public void addCompositeRole(Role role) {
+        RoleEntity entity = ((RoleAdapter)role).getRole();
+        for (RoleEntity composite : getRole().getCompositeRoles()) {
+            if (composite.equals(entity)) return;
+        }
+        getRole().getCompositeRoles().add(entity);
+        em.flush();
+    }
+
+    @Override
+    public void removeCompositeRole(Role role) {
+        RoleEntity entity = ((RoleAdapter)role).getRole();
+        Iterator<RoleEntity> it = getRole().getCompositeRoles().iterator();
+        while (it.hasNext()) {
+            if (it.next().equals(entity)) it.remove();
+        }
+    }
+
+    @Override
+    public Set<Role> getComposites() {
+        Set<Role> set = new HashSet<Role>();
+
+        for (RoleEntity composite : getRole().getCompositeRoles()) {
+           set.add(new RoleAdapter(provider, em, composite));
+        }
+        return set;
+    }
+
+    @Override
+    public RoleContainer getContainer() {
+        if (role.isApplicationRole()) {
+            return provider.getApplicationById(role.getApplication().getId(), role.getApplication().getRealm().getId());
+        } else {
+            return provider.getRealm(role.getRealm().getId());
+        }
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof Role)) return false;
+
+        Role that = (Role) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+}

diff --git a/model/realms-jpa/src/main/resources/META-INF/services/org.keycloak.models.realms.RealmProviderFactory b/model/realms-jpa/src/main/resources/META-INF/services/org.keycloak.models.realms.RealmProviderFactory
new file mode 100644
index 0000000..81ec90a
--- /dev/null
+++ b/model/realms-jpa/src/main/resources/META-INF/services/org.keycloak.models.realms.RealmProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.realms.jpa.JpaRealmProviderFactory
\ No newline at end of file

diff --git a/model/sessions-jpa/pom.xml b/model/sessions-jpa/pom.xml
new file mode 100755
index 0000000..65007be
--- /dev/null
+++ b/model/sessions-jpa/pom.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-model-sessions-jpa</artifactId>
+    <name>Keycloak Model Sessions JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-connections-jpa</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+</project>

diff --git a/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/entities/ClientUserSessionAssociationEntity.java b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/entities/ClientUserSessionAssociationEntity.java
new file mode 100755
index 0000000..99eb40e
--- /dev/null
+++ b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/entities/ClientUserSessionAssociationEntity.java
@@ -0,0 +1,97 @@
+package org.keycloak.models.sessions.jpa.entities;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.Table;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+@Table(name = "CLIENT_USERSESSION")
+@NamedQueries({
+        @NamedQuery(name = "removeClientUserSessionByRealm", query = "delete from ClientUserSessionAssociationEntity a where a.session IN (select s from UserSessionEntity s where s.realmId = :realmId)"),
+        @NamedQuery(name = "removeClientUserSessionByUser", query = "delete from ClientUserSessionAssociationEntity a where a.session IN (select s from UserSessionEntity s where s.realmId = :realmId and s.userId = :userId)"),
+        @NamedQuery(name = "removeClientUserSessionByClient", query = "delete from ClientUserSessionAssociationEntity a where a.clientId = :clientId and a.session IN (select s from UserSessionEntity s where s.realmId = :realmId)"),
+        @NamedQuery(name = "removeClientUserSessionByExpired", query = "delete from ClientUserSessionAssociationEntity a where a.session IN (select s from UserSessionEntity s where s.realmId = :realmId and (s.started < :maxTime or s.lastSessionRefresh < :idleTime))")
+})
+@IdClass(ClientUserSessionAssociationEntity.Key.class)
+public class ClientUserSessionAssociationEntity {
+
+    @Id
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "SESSION_ID")
+    protected UserSessionEntity session;
+
+    @Id
+    @Column(name="CLIENT_ID",length = 36)
+    protected String clientId;
+
+    public UserSessionEntity getSession() {
+        return session;
+    }
+
+    public void setSession(UserSessionEntity session) {
+        this.session = session;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public static class Key implements Serializable {
+
+        private String clientId;
+        private UserSessionEntity session;
+
+        public Key() {
+        }
+
+        public Key(String clientId, UserSessionEntity session) {
+            this.clientId = clientId;
+            this.session = session;
+        }
+
+        public String getClientId() {
+            return clientId;
+        }
+
+        public UserSessionEntity getSession() {
+            return session;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (clientId != null ? !clientId.equals(key.clientId) : key.clientId != null) return false;
+            if (session != null ? !session.getId().equals(key.session != null ? key.session.getId() : null) : key.session != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = clientId != null ? clientId.hashCode() : 0;
+            result = 31 * result + (session != null ? session.getId().hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaKeycloakTransaction.java b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaKeycloakTransaction.java
new file mode 100755
index 0000000..09f92c0
--- /dev/null
+++ b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaKeycloakTransaction.java
@@ -0,0 +1,53 @@
+package org.keycloak.models.sessions.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

diff --git a/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProvider.java b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProvider.java
new file mode 100644
index 0000000..640af99
--- /dev/null
+++ b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProvider.java
@@ -0,0 +1,198 @@
+package org.keycloak.models.sessions.jpa;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.sessions.jpa.entities.UserSessionEntity;
+import org.keycloak.models.sessions.jpa.entities.UsernameLoginFailureEntity;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.util.Time;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaUserSessionProvider implements UserSessionProvider {
+
+    protected final KeycloakSession session;
+
+    protected final EntityManager em;
+
+    public JpaUserSessionProvider(KeycloakSession session, EntityManager em) {
+        this.session = session;
+        this.em = em;
+    }
+
+    @Override
+    public UsernameLoginFailureModel getUserLoginFailure(RealmModel realm, String username) {
+        String id = username + "-" + realm;
+        UsernameLoginFailureEntity entity = em.find(UsernameLoginFailureEntity.class, id);
+        if (entity == null) return null;
+        return new UsernameLoginFailureAdapter(entity);
+    }
+
+    @Override
+    public UsernameLoginFailureModel addUserLoginFailure(RealmModel realm, String username) {
+        UsernameLoginFailureModel model = getUserLoginFailure(realm, username);
+        if (model != null) return model;
+        UsernameLoginFailureEntity entity = new UsernameLoginFailureEntity();
+        entity.setUsername(username);
+        entity.setRealmId(realm.getId());
+        em.persist(entity);
+        return new UsernameLoginFailureAdapter(entity);
+    }
+
+    @Override
+    public List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm) {
+        TypedQuery<UsernameLoginFailureEntity> query = em.createNamedQuery("getAllFailures", UsernameLoginFailureEntity.class);
+        List<UsernameLoginFailureEntity> entities = query.getResultList();
+        List<UsernameLoginFailureModel> models = new ArrayList<UsernameLoginFailureModel>();
+        for (UsernameLoginFailureEntity entity : entities) {
+            models.add(new UsernameLoginFailureAdapter(entity));
+        }
+        return models;
+    }
+
+    @Override
+    public UserSessionModel createUserSession(RealmModel realm, UserModel user, String loginUsername, String ipAddress, String authMethod, boolean rememberMe) {
+        UserSessionEntity entity = new UserSessionEntity();
+        entity.setId(KeycloakModelUtils.generateId());
+        entity.setRealmId(realm.getId());
+        entity.setUserId(user.getId());
+        entity.setLoginUsername(loginUsername);
+        entity.setIpAddress(ipAddress);
+        entity.setAuthMethod(authMethod);
+        entity.setRememberMe(rememberMe);
+
+        int currentTime = Time.currentTime();
+
+        entity.setStarted(currentTime);
+        entity.setLastSessionRefresh(currentTime);
+
+        em.persist(entity);
+        return new UserSessionAdapter(session, em, realm, entity);
+    }
+
+    @Override
+    public UserSessionModel getUserSession(RealmModel realm, String id) {
+        UserSessionEntity entity = em.find(UserSessionEntity.class, id);
+        return entity != null ? new UserSessionAdapter(session, em, realm, entity) : null;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, UserModel user) {
+        List<UserSessionModel> sessions = new LinkedList<UserSessionModel>();
+        TypedQuery<UserSessionEntity> query = em.createNamedQuery("getUserSessionByUser", UserSessionEntity.class)
+                .setParameter("realmId", realm.getId())
+                .setParameter("userId", user.getId());
+        for (UserSessionEntity e : query.getResultList()) {
+            sessions.add(new UserSessionAdapter(session, em, realm, e));
+        }
+        return sessions;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client) {
+        return getUserSessions(realm, client, -1, -1);
+    }
+
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client, int firstResult, int maxResults) {
+        List<UserSessionModel> list = new LinkedList<UserSessionModel>();
+        TypedQuery<UserSessionEntity> query = em.createNamedQuery("getUserSessionByClient", UserSessionEntity.class)
+                .setParameter("realmId", realm.getId())
+                .setParameter("clientId", client.getClientId());
+        if (firstResult != -1) {
+            query.setFirstResult(firstResult);
+        }
+        if (maxResults != -1) {
+            query.setMaxResults(maxResults);
+        }
+        for (UserSessionEntity entity : query.getResultList()) {
+            list.add(new UserSessionAdapter(session, em, realm, entity));
+        }
+        return list;
+    }
+
+    @Override
+    public int getActiveUserSessions(RealmModel realm, ClientModel client) {
+        Object count = em.createNamedQuery("getActiveUserSessionByClient")
+                .setParameter("realmId", realm.getId())
+                .setParameter("clientId", client.getClientId())
+                .getSingleResult();
+        return ((Number)count).intValue();
+    }
+
+    @Override
+    public void removeUserSession(RealmModel realm, UserSessionModel session) {
+        UserSessionEntity entity = em.find(UserSessionEntity.class, session.getId());
+        if (entity != null) {
+            em.remove(entity);
+        }
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm, UserModel user) {
+        em.createNamedQuery("removeClientUserSessionByUser")
+                .setParameter("realmId", realm.getId())
+                .setParameter("userId", user.getId())
+                .executeUpdate();
+        em.createNamedQuery("removeUserSessionByUser")
+                .setParameter("realmId", realm.getId())
+                .setParameter("userId", user.getId())
+                .executeUpdate();
+    }
+
+    @Override
+    public void removeExpiredUserSessions(RealmModel realm) {
+        int maxTime = Time.currentTime() - realm.getSsoSessionMaxLifespan();
+        int idleTime = Time.currentTime() - realm.getSsoSessionIdleTimeout();
+
+        em.createNamedQuery("removeClientUserSessionByExpired")
+                .setParameter("realmId", realm.getId())
+                .setParameter("maxTime", maxTime)
+                .setParameter("idleTime", idleTime)
+                .executeUpdate();
+        em.createNamedQuery("removeUserSessionByExpired")
+                .setParameter("realmId", realm.getId())
+                .setParameter("maxTime", maxTime)
+                .setParameter("idleTime", idleTime)
+                .executeUpdate();
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm) {
+        em.createNamedQuery("removeClientUserSessionByRealm").setParameter("realmId", realm.getId()).executeUpdate();
+        em.createNamedQuery("removeUserSessionByRealm").setParameter("realmId", realm.getId()).executeUpdate();
+    }
+
+    @Override
+    public void onRealmRemoved(RealmModel realm) {
+        removeUserSessions(realm);
+        em.createNamedQuery("removeLoginFailuresByRealm").setParameter("realmId", realm.getId()).executeUpdate();
+    }
+
+    @Override
+    public void onClientRemoved(RealmModel realm, ClientModel client) {
+        em.createNamedQuery("removeClientUserSessionByClient").setParameter("realmId", realm.getId()).setParameter("clientId", client.getClientId()).executeUpdate();
+    }
+
+    @Override
+    public void onUserRemoved(RealmModel realm, UserModel user) {
+        removeUserSessions(realm, user);
+        em.createNamedQuery("removeLoginFailuresByUser").setParameter("username", user.getUsername()).executeUpdate();
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProviderFactory.java b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProviderFactory.java
new file mode 100755
index 0000000..fca5ca1
--- /dev/null
+++ b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/JpaUserSessionProviderFactory.java
@@ -0,0 +1,37 @@
+package org.keycloak.models.sessions.jpa;
+
+import org.keycloak.Config;
+import org.keycloak.connections.jpa.JpaConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UserSessionProviderFactory;
+
+import javax.persistence.EntityManager;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class JpaUserSessionProviderFactory implements UserSessionProviderFactory {
+
+    public static final String ID = "jpa";
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+    @Override
+    public UserSessionProvider create(KeycloakSession session) {
+        EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();
+        return new JpaUserSessionProvider(session, em);
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/PersistenceExceptionConverter.java b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/PersistenceExceptionConverter.java
new file mode 100644
index 0000000..2d27df0
--- /dev/null
+++ b/model/sessions-jpa/src/main/java/org/keycloak/models/sessions/jpa/PersistenceExceptionConverter.java
@@ -0,0 +1,48 @@
+package org.keycloak.models.sessions.jpa;
+
+import org.hibernate.exception.ConstraintViolationException;
+import org.keycloak.models.ModelDuplicateException;
+import org.keycloak.models.ModelException;
+
+import javax.persistence.EntityExistsException;
+import javax.persistence.EntityManager;
+import java.lang.reflect.InvocationHandler;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Proxy;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class PersistenceExceptionConverter implements InvocationHandler {
+
+    private EntityManager em;
+
+    public static EntityManager create(EntityManager em) {
+        return (EntityManager) Proxy.newProxyInstance(EntityManager.class.getClassLoader(), new Class[]{EntityManager.class}, new PersistenceExceptionConverter(em));
+    }
+
+    private PersistenceExceptionConverter(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
+        try {
+            return method.invoke(em, args);
+        } catch (InvocationTargetException e) {
+            throw convert(e.getCause());
+        }
+    }
+
+    public static ModelException convert(Throwable t) {
+        if (t.getCause() != null && t.getCause() instanceof ConstraintViolationException) {
+            throw new ModelDuplicateException(t);
+        } if (t instanceof EntityExistsException) {
+            throw new ModelDuplicateException(t);
+        } else {
+            throw new ModelException(t);
+        }
+    }
+
+}

diff --git a/model/sessions-jpa/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory b/model/sessions-jpa/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
new file mode 100644
index 0000000..8dc16d6
--- /dev/null
+++ b/model/sessions-jpa/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.sessions.jpa.JpaUserSessionProviderFactory
\ No newline at end of file

diff --git a/model/sessions-mem/pom.xml b/model/sessions-mem/pom.xml
new file mode 100755
index 0000000..c3f40eb
--- /dev/null
+++ b/model/sessions-mem/pom.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-model-sessions-mem</artifactId>
+    <name>Keycloak Model Sessions Mem</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+</project>

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureEntity.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureEntity.java
new file mode 100644
index 0000000..b1788d2
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureEntity.java
@@ -0,0 +1,65 @@
+package org.keycloak.models.sessions.mem.entities;
+
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UsernameLoginFailureEntity {
+
+    private String username;
+    private String realm;
+
+    private AtomicInteger failedLoginNotBefore = new AtomicInteger();
+    private AtomicInteger numFailures = new AtomicInteger();
+    private AtomicLong lastFailure = new AtomicLong();
+    private AtomicReference<String> lastIpFailure = new AtomicReference<String>();
+
+    public UsernameLoginFailureEntity(String username, String realm) {
+        this.username = username;
+        this.realm = realm;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public AtomicInteger getFailedLoginNotBefore() {
+        return failedLoginNotBefore;
+    }
+
+    public void setFailedLoginNotBefore(AtomicInteger failedLoginNotBefore) {
+        this.failedLoginNotBefore = failedLoginNotBefore;
+    }
+
+    public AtomicInteger getNumFailures() {
+        return numFailures;
+    }
+
+    public void setNumFailures(AtomicInteger numFailures) {
+        this.numFailures = numFailures;
+    }
+
+    public AtomicLong getLastFailure() {
+        return lastFailure;
+    }
+
+    public void setLastFailure(AtomicLong lastFailure) {
+        this.lastFailure = lastFailure;
+    }
+
+    public AtomicReference<String> getLastIpFailure() {
+        return lastIpFailure;
+    }
+
+    public void setLastIpFailure(AtomicReference<String> lastIpFailure) {
+        this.lastIpFailure = lastIpFailure;
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureKey.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureKey.java
new file mode 100644
index 0000000..68c7a4b
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UsernameLoginFailureKey.java
@@ -0,0 +1,36 @@
+package org.keycloak.models.sessions.mem.entities;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UsernameLoginFailureKey {
+
+    private final String realm;
+    private final String username;
+
+    public UsernameLoginFailureKey(String realm, String username) {
+        this.realm = realm;
+        this.username = username;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        UsernameLoginFailureKey key = (UsernameLoginFailureKey) o;
+
+        if (realm != null ? !realm.equals(key.realm) : key.realm != null) return false;
+        if (username != null ? !username.equals(key.username) : key.username != null) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = realm != null ? realm.hashCode() : 0;
+        result = 31 * result + (username != null ? username.hashCode() : 0);
+        return result;
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionEntity.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionEntity.java
new file mode 100644
index 0000000..2596137
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionEntity.java
@@ -0,0 +1,102 @@
+package org.keycloak.models.sessions.mem.entities;
+
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSessionEntity {
+
+    private String id;
+    private String realm;
+    private String user;
+    private String loginUsername;
+    private String ipAddress;
+    private String authMethod;
+    private boolean rememberMe;
+    private int started;
+    private int lastSessionRefresh;
+    private List<String> clients = new LinkedList<String>();
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
+
+    public String getUser() {
+        return user;
+    }
+
+    public void setUser(String user) {
+        this.user = user;
+    }
+
+    public String getLoginUsername() {
+        return loginUsername;
+    }
+
+    public void setLoginUsername(String loginUsername) {
+        this.loginUsername = loginUsername;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public void setIpAddress(String ipAddress) {
+        this.ipAddress = ipAddress;
+    }
+
+    public String getAuthMethod() {
+        return authMethod;
+    }
+
+    public void setAuthMethod(String authMethod) {
+        this.authMethod = authMethod;
+    }
+
+    public boolean isRememberMe() {
+        return rememberMe;
+    }
+
+    public void setRememberMe(boolean rememberMe) {
+        this.rememberMe = rememberMe;
+    }
+
+    public int getStarted() {
+        return started;
+    }
+
+    public void setStarted(int started) {
+        this.started = started;
+    }
+
+    public int getLastSessionRefresh() {
+        return lastSessionRefresh;
+    }
+
+    public void setLastSessionRefresh(int lastSessionRefresh) {
+        this.lastSessionRefresh = lastSessionRefresh;
+    }
+
+    public List<String> getClients() {
+        return clients;
+    }
+
+    public void setClients(List<String> clients) {
+        this.clients = clients;
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionKey.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionKey.java
new file mode 100644
index 0000000..0fcb86c
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/entities/UserSessionKey.java
@@ -0,0 +1,36 @@
+package org.keycloak.models.sessions.mem.entities;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSessionKey {
+
+    private final String realm;
+    private final String id;
+
+    public UserSessionKey(String realm, String id) {
+        this.realm = realm;
+        this.id = id;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        UserSessionKey key = (UserSessionKey) o;
+
+        if (realm != null ? !realm.equals(key.realm) : key.realm != null) return false;
+        if (id != null ? !id.equals(key.id) : key.id != null) return false;
+
+        return true;
+    }
+
+    @Override
+    public int hashCode() {
+        int result = realm != null ? realm.hashCode() : 0;
+        result = 31 * result + (id != null ? id.hashCode() : 0);
+        return result;
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProvider.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProvider.java
new file mode 100755
index 0000000..7021046
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProvider.java
@@ -0,0 +1,227 @@
+package org.keycloak.models.sessions.mem;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.sessions.mem.entities.UserSessionEntity;
+import org.keycloak.models.sessions.mem.entities.UserSessionKey;
+import org.keycloak.models.sessions.mem.entities.UsernameLoginFailureEntity;
+import org.keycloak.models.sessions.mem.entities.UsernameLoginFailureKey;
+import org.keycloak.models.utils.KeycloakModelUtils;
+import org.keycloak.util.Time;
+
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MemUserSessionProvider implements UserSessionProvider {
+
+    private final KeycloakSession session;
+    private final ConcurrentHashMap<UserSessionKey, UserSessionEntity> sessions;
+    private final ConcurrentHashMap<UsernameLoginFailureKey, UsernameLoginFailureEntity> loginFailures;
+
+    public MemUserSessionProvider(KeycloakSession session, ConcurrentHashMap<UserSessionKey, UserSessionEntity> sessions, ConcurrentHashMap<UsernameLoginFailureKey, UsernameLoginFailureEntity> loginFailures) {
+        this.session = session;
+        this.sessions = sessions;
+        this.loginFailures = loginFailures;
+    }
+
+    @Override
+    public UserSessionModel createUserSession(RealmModel realm, UserModel user, String loginUsername, String ipAddress, String authMethod, boolean rememberMe) {
+        String id = KeycloakModelUtils.generateId();
+
+        UserSessionEntity entity = new UserSessionEntity();
+        entity.setId(id);
+        entity.setRealm(realm.getId());
+        entity.setUser(user.getId());
+        entity.setLoginUsername(loginUsername);
+        entity.setIpAddress(ipAddress);
+        entity.setAuthMethod(authMethod);
+        entity.setRememberMe(rememberMe);
+
+        int currentTime = Time.currentTime();
+
+        entity.setStarted(currentTime);
+        entity.setLastSessionRefresh(currentTime);
+
+        sessions.put(new UserSessionKey(realm.getId(), id), entity);
+
+        return new UserSessionAdapter(session, realm, entity);
+    }
+
+    @Override
+    public UserSessionModel getUserSession(RealmModel realm, String id) {
+        UserSessionEntity entity = sessions.get(new UserSessionKey(realm.getId(), id));
+        return entity != null ? new UserSessionAdapter(session, realm, entity) : null;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, UserModel user) {
+        List<UserSessionModel> userSessions = new LinkedList<UserSessionModel>();
+        for (UserSessionEntity s : sessions.values()) {
+            if (s.getRealm().equals(realm.getId()) && s.getUser().equals(user.getId())) {
+                userSessions.add(new UserSessionAdapter(session, realm, s));
+            }
+        }
+        return userSessions;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client) {
+        List<UserSessionModel> clientSessions = new LinkedList<UserSessionModel>();
+        for (UserSessionEntity s : sessions.values()) {
+            if (s.getRealm().equals(realm.getId()) && s.getClients().contains(client.getClientId())) {
+                clientSessions.add(new UserSessionAdapter(session, realm, s));
+            }
+        }
+        Collections.sort(clientSessions, new UserSessionSort());
+        return clientSessions;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client, int firstResult, int maxResults) {
+        List<UserSessionModel> userSessions = getUserSessions(realm, client);
+        if (firstResult > userSessions.size()) {
+            return Collections.emptyList();
+        }
+
+        int toIndex = (firstResult + maxResults) < userSessions.size() ? firstResult + maxResults : userSessions.size();
+        return userSessions.subList(firstResult, toIndex);
+    }
+
+    @Override
+    public int getActiveUserSessions(RealmModel realm, ClientModel client) {
+        int count = 0;
+        for (UserSessionEntity s : sessions.values()) {
+            if (s.getRealm().equals(realm.getId()) && s.getClients().contains(client.getClientId())) {
+                count++;
+            }
+        }
+        return count;
+    }
+
+    @Override
+    public void removeUserSession(RealmModel realm, UserSessionModel session) {
+        sessions.remove(new UserSessionKey(realm.getId(), session.getId()));
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm, UserModel user) {
+        Iterator<UserSessionEntity> itr = sessions.values().iterator();
+        while (itr.hasNext()) {
+            UserSessionEntity s = itr.next();
+            if (s.getRealm().equals(realm.getId()) && s.getUser().equals(user.getId())) {
+                itr.remove();
+            }
+        }
+    }
+
+    @Override
+    public void removeExpiredUserSessions(RealmModel realm) {
+        Iterator<UserSessionEntity> itr = sessions.values().iterator();
+        while (itr.hasNext()) {
+            UserSessionEntity s = itr.next();
+            if (s.getRealm().equals(realm.getId()) && (s.getLastSessionRefresh() < Time.currentTime() - realm.getSsoSessionIdleTimeout() || s.getStarted() < Time.currentTime() - realm.getSsoSessionMaxLifespan())) {
+                itr.remove();
+            }
+        }
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm) {
+        Iterator<UserSessionEntity> itr = sessions.values().iterator();
+        while (itr.hasNext()) {
+            UserSessionEntity s = itr.next();
+            if (s.getRealm().equals(realm.getId())) {
+                itr.remove();
+            }
+        }
+    }
+
+    @Override
+    public UsernameLoginFailureModel getUserLoginFailure(RealmModel realm, String username) {
+        UsernameLoginFailureEntity entity = loginFailures.get(new UsernameLoginFailureKey(username, realm.getId()));
+        return entity != null ? new UsernameLoginFailureAdapter(entity) : null;
+    }
+
+    @Override
+    public UsernameLoginFailureModel addUserLoginFailure(RealmModel realm, String username) {
+        UsernameLoginFailureKey key = new UsernameLoginFailureKey(username, realm.getId());
+        return new UsernameLoginFailureAdapter(loginFailures.putIfAbsent(key, new UsernameLoginFailureEntity(username, realm.getId())));
+    }
+
+    @Override
+    public List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm) {
+        List<UsernameLoginFailureModel> failures = new LinkedList<UsernameLoginFailureModel>();
+        for (UsernameLoginFailureEntity entity : loginFailures.values()) {
+            if (entity.getRealm().equals(realm.getId())) {
+                failures.add(new UsernameLoginFailureAdapter(entity));
+            }
+        }
+        return failures;
+    }
+
+    @Override
+    public void onRealmRemoved(RealmModel realm) {
+        removeUserSessions(realm);
+
+        Iterator<UsernameLoginFailureEntity> itr = loginFailures.values().iterator();
+        while (itr.hasNext()) {
+            if (itr.next().getRealm().equals(realm.getId())) {
+                itr.remove();
+            }
+        }
+    }
+
+    @Override
+    public void onClientRemoved(RealmModel realm, ClientModel client) {
+        Iterator<UserSessionEntity> itr = sessions.values().iterator();
+        while (itr.hasNext()) {
+            UserSessionEntity s = itr.next();
+            if (s.getRealm().equals(realm.getId())) {
+                itr.remove();
+            }
+        }
+
+        for (UserSessionEntity s : sessions.values()) {
+            if (s.getRealm().equals(realm.getId())) {
+                s.getClients().remove(client.getClientId());
+            }
+        }
+    }
+
+    @Override
+    public void onUserRemoved(RealmModel realm, UserModel user) {
+        removeUserSessions(realm, user);
+
+        loginFailures.remove(new UsernameLoginFailureKey(realm.getId(), user.getUsername()));
+    }
+
+    @Override
+    public void close() {
+    }
+
+    private class UserSessionSort implements Comparator<UserSessionModel> {
+
+        @Override
+        public int compare(UserSessionModel o1, UserSessionModel o2) {
+            int r = o1.getStarted() - o2.getStarted();
+            if (r == 0) {
+                return o1.getId().compareTo(o2.getId());
+            } else {
+                return r;
+            }
+        }
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProviderFactory.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProviderFactory.java
new file mode 100644
index 0000000..c1ae6a3
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/MemUserSessionProviderFactory.java
@@ -0,0 +1,45 @@
+package org.keycloak.models.sessions.mem;
+
+import org.keycloak.Config;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UserSessionProviderFactory;
+import org.keycloak.models.sessions.mem.entities.UserSessionEntity;
+import org.keycloak.models.sessions.mem.entities.UserSessionKey;
+import org.keycloak.models.sessions.mem.entities.UsernameLoginFailureEntity;
+import org.keycloak.models.sessions.mem.entities.UsernameLoginFailureKey;
+
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MemUserSessionProviderFactory implements UserSessionProviderFactory {
+
+    public static final String ID = "mem";
+
+    private ConcurrentHashMap<UserSessionKey, UserSessionEntity> sessions = new ConcurrentHashMap<UserSessionKey, UserSessionEntity>();
+
+    private ConcurrentHashMap<UsernameLoginFailureKey, UsernameLoginFailureEntity> loginFailures = new ConcurrentHashMap<UsernameLoginFailureKey, UsernameLoginFailureEntity>();
+
+    @Override
+    public UserSessionProvider create(KeycloakSession session) {
+        return new MemUserSessionProvider(session, sessions, loginFailures);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+        sessions.clear();
+        loginFailures.clear();
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UsernameLoginFailureAdapter.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UsernameLoginFailureAdapter.java
new file mode 100644
index 0000000..03dc558
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UsernameLoginFailureAdapter.java
@@ -0,0 +1,71 @@
+package org.keycloak.models.sessions.mem;
+
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.sessions.mem.entities.UsernameLoginFailureEntity;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UsernameLoginFailureAdapter implements UsernameLoginFailureModel {
+
+    private final UsernameLoginFailureEntity entity;
+
+    public UsernameLoginFailureAdapter(UsernameLoginFailureEntity entity) {
+        this.entity = entity;
+    }
+
+    @Override
+    public String getUsername() {
+        return entity.getUsername();
+    }
+
+    public String getRealm() {
+        return entity.getRealm();
+    }
+
+    @Override
+    public int getFailedLoginNotBefore() {
+        return entity.getFailedLoginNotBefore().get();
+    }
+
+    @Override
+    public void setFailedLoginNotBefore(int notBefore) {
+        entity.getFailedLoginNotBefore().set(notBefore);
+    }
+
+    @Override
+    public int getNumFailures() {
+        return entity.getNumFailures().get();
+    }
+
+    @Override
+    public void incrementFailures() {
+        entity.getNumFailures().incrementAndGet();
+    }
+
+    @Override
+    public void clearFailures() {
+        entity.getNumFailures().set(0);
+    }
+
+    @Override
+    public long getLastFailure() {
+        return entity.getLastFailure().get();
+    }
+
+    @Override
+    public void setLastFailure(long lastFailure) {
+        entity.getLastFailure().set(lastFailure);
+    }
+
+    @Override
+    public String getLastIPFailure() {
+        return entity.getLastIpFailure().get();
+    }
+
+    @Override
+    public void setLastIPFailure(String ip) {
+        entity.getLastIpFailure().set(ip);
+    }
+
+}

diff --git a/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UserSessionAdapter.java b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UserSessionAdapter.java
new file mode 100755
index 0000000..a9008cf
--- /dev/null
+++ b/model/sessions-mem/src/main/java/org/keycloak/models/sessions/mem/UserSessionAdapter.java
@@ -0,0 +1,135 @@
+package org.keycloak.models.sessions.mem;
+
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.sessions.mem.entities.UserSessionEntity;
+
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class UserSessionAdapter implements UserSessionModel {
+
+    private final KeycloakSession session;
+
+    private final RealmModel realm;
+
+    private final UserSessionEntity entity;
+
+    public UserSessionAdapter(KeycloakSession session, RealmModel realm, UserSessionEntity entity) {
+        this.session = session;
+        this.realm = realm;
+        this.entity = entity;
+    }
+
+    public String getId() {
+        return entity.getId();
+    }
+
+    public void setId(String id) {
+        entity.setId(id);
+    }
+
+    public UserModel getUser() {
+        return session.users().getUserById(entity.getUser(), realm);
+    }
+
+    public void setUser(UserModel user) {
+        entity.setUser(user.getId());
+    }
+
+    @Override
+    public String getLoginUsername() {
+        return entity.getLoginUsername();
+    }
+
+    @Override
+    public void setLoginUsername(String loginUsername) {
+        entity.setLoginUsername(loginUsername);
+    }
+
+    public String getIpAddress() {
+        return entity.getIpAddress();
+    }
+
+    public void setIpAddress(String ipAddress) {
+        entity.setIpAddress(ipAddress);
+    }
+
+    @Override
+    public String getAuthMethod() {
+        return entity.getAuthMethod();
+    }
+
+    @Override
+    public void setAuthMethod(String authMethod) {
+        entity.setAuthMethod(authMethod);
+    }
+
+    @Override
+    public boolean isRememberMe() {
+        return entity.isRememberMe();
+    }
+
+    @Override
+    public void setRememberMe(boolean rememberMe) {
+        entity.setRememberMe(rememberMe);
+    }
+
+    public int getStarted() {
+        return entity.getStarted();
+    }
+
+    public void setStarted(int started) {
+        entity.setStarted(started);
+    }
+
+    public int getLastSessionRefresh() {
+        return entity.getLastSessionRefresh();
+    }
+
+    public void setLastSessionRefresh(int lastSessionRefresh) {
+        entity.setLastSessionRefresh(lastSessionRefresh);
+    }
+
+    @Override
+    public void associateClient(ClientModel client) {
+        if (!entity.getClients().contains(client.getClientId())) {
+            entity.getClients().add(client.getClientId());
+        }
+    }
+
+    @Override
+    public List<ClientModel> getClientAssociations() {
+        List<ClientModel> models = new LinkedList<ClientModel>();
+        for (String clientId : entity.getClients()) {
+            models.add(realm.findClient(clientId));
+        }
+        return models;
+    }
+
+    @Override
+    public void removeAssociatedClient(ClientModel client) {
+        entity.getClients().remove(client.getClientId());
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || !(o instanceof UserSessionModel)) return false;
+
+        UserSessionModel that = (UserSessionModel) o;
+        return that.getId().equals(getId());
+    }
+
+    @Override
+    public int hashCode() {
+        return getId().hashCode();
+    }
+
+}

diff --git a/model/sessions-mem/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory b/model/sessions-mem/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
new file mode 100644
index 0000000..a869fa1
--- /dev/null
+++ b/model/sessions-mem/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.sessions.mem.MemUserSessionProviderFactory
\ No newline at end of file

diff --git a/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/AbstractMongoAdapter.java b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/AbstractMongoAdapter.java
new file mode 100644
index 0000000..3aea2c9
--- /dev/null
+++ b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/AbstractMongoAdapter.java
@@ -0,0 +1,44 @@
+package org.keycloak.models.sessions.mongo;
+
+import org.keycloak.connections.mongo.api.MongoIdentifiableEntity;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public abstract class AbstractMongoAdapter<T extends MongoIdentifiableEntity> {
+
+    protected final MongoStoreInvocationContext invocationContext;
+
+    public AbstractMongoAdapter(MongoStoreInvocationContext invocationContext) {
+        this.invocationContext = invocationContext;
+    }
+
+    protected abstract T getMongoEntity();
+
+    protected void updateMongoEntity() {
+        getMongoStore().updateEntity(getMongoEntity(), invocationContext);
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (o == this) return true;
+
+        if (o == null || getClass() != o.getClass()) return false;
+
+        AbstractMongoAdapter that = (AbstractMongoAdapter) o;
+
+        if (getMongoEntity() == null && that.getMongoEntity() == null) return true;
+        return getMongoEntity().equals(that.getMongoEntity());
+    }
+
+    @Override
+    public int hashCode() {
+        return getMongoEntity()!=null ? getMongoEntity().hashCode() : super.hashCode();
+    }
+
+    protected MongoStore getMongoStore() {
+        return invocationContext.getMongoStore();
+    }
+}

diff --git a/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProvider.java b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProvider.java
new file mode 100755
index 0000000..b555407
--- /dev/null
+++ b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProvider.java
@@ -0,0 +1,206 @@
+package org.keycloak.models.sessions.mongo;
+
+import com.mongodb.BasicDBObject;
+import com.mongodb.DBObject;
+import com.mongodb.QueryBuilder;
+import org.keycloak.connections.mongo.api.MongoStore;
+import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
+import org.keycloak.models.ClientModel;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UsernameLoginFailureModel;
+import org.keycloak.models.sessions.mongo.entities.MongoUserSessionEntity;
+import org.keycloak.models.sessions.mongo.entities.MongoUsernameLoginFailureEntity;
+import org.keycloak.util.Time;
+
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoUserSessionProvider implements UserSessionProvider {
+
+    private final KeycloakSession session;
+    private final MongoStore mongoStore;
+    private final MongoStoreInvocationContext invocationContext;
+
+    public MongoUserSessionProvider(KeycloakSession session, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+        this.session = session;
+        this.mongoStore = mongoStore;
+        this.invocationContext = invocationContext;
+    }
+
+    @Override
+    public UserSessionModel createUserSession(RealmModel realm, UserModel user, String loginUsername, String ipAddress, String authMethod, boolean rememberMe) {
+        MongoUserSessionEntity entity = new MongoUserSessionEntity();
+        entity.setRealmId(realm.getId());
+        entity.setUser(user.getId());
+        entity.setLoginUsername(loginUsername);
+        entity.setIpAddress(ipAddress);
+        entity.setAuthMethod(authMethod);
+        entity.setRememberMe(rememberMe);
+
+        int currentTime = Time.currentTime();
+
+        entity.setStarted(currentTime);
+        entity.setLastSessionRefresh(currentTime);
+
+        mongoStore.insertEntity(entity, invocationContext);
+        return new UserSessionAdapter(session, entity, realm, invocationContext);
+    }
+
+    @Override
+    public UserSessionModel getUserSession(RealmModel realm, String id) {
+        MongoUserSessionEntity entity = mongoStore.loadEntity(MongoUserSessionEntity.class, id, invocationContext);
+        if (entity == null) {
+            return null;
+        } else {
+            return new UserSessionAdapter(session, entity, realm, invocationContext);
+        }
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, UserModel user) {
+        DBObject query = new BasicDBObject("user", user.getId());
+        List<UserSessionModel> sessions = new LinkedList<UserSessionModel>();
+        for (MongoUserSessionEntity e : mongoStore.loadEntities(MongoUserSessionEntity.class, query, invocationContext)) {
+            sessions.add(new UserSessionAdapter(session, e, realm, invocationContext));
+        }
+        return sessions;
+    }
+
+    @Override
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client) {
+        return getUserSessions(realm, client, -1, -1);
+    }
+
+    public List<UserSessionModel> getUserSessions(RealmModel realm, ClientModel client, int firstResult, int maxResults) {
+        DBObject query = new QueryBuilder()
+                .and("associatedClientIds").is(client.getId())
+                .get();
+        DBObject sort = new BasicDBObject("started", 1).append("id", 1);
+
+        List<MongoUserSessionEntity> sessions = mongoStore.loadEntities(MongoUserSessionEntity.class, query, sort, firstResult, maxResults, invocationContext);
+        List<UserSessionModel> result = new LinkedList<UserSessionModel>();
+        for (MongoUserSessionEntity session : sessions) {
+            result.add(new UserSessionAdapter(this.session, session, realm, invocationContext));
+        }
+        return result;
+    }
+
+    @Override
+    public int getActiveUserSessions(RealmModel realm, ClientModel client) {
+        DBObject query = new QueryBuilder()
+                .and("associatedClientIds").is(client.getId())
+                .get();
+        return mongoStore.countEntities(MongoUserSessionEntity.class, query, invocationContext);
+    }
+
+    @Override
+    public void removeUserSession(RealmModel realm, UserSessionModel session) {
+        mongoStore.removeEntity(((UserSessionAdapter) session).getMongoEntity(), invocationContext);
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm, UserModel user) {
+        DBObject query = new BasicDBObject("user", user.getId());
+        mongoStore.removeEntities(MongoUserSessionEntity.class, query, invocationContext);
+    }
+
+    @Override
+    public void removeUserSessions(RealmModel realm) {
+        DBObject query = new BasicDBObject("realmId", realm.getId());
+        mongoStore.removeEntities(MongoUserSessionEntity.class, query, invocationContext);
+    }
+
+    @Override
+    public void removeExpiredUserSessions(RealmModel realm) {
+        int currentTime = Time.currentTime();
+        DBObject query = new QueryBuilder()
+                .and("started").lessThan(currentTime - realm.getSsoSessionMaxLifespan())
+                .get();
+
+        mongoStore.removeEntities(MongoUserSessionEntity.class, query, invocationContext);
+        query = new QueryBuilder()
+                .and("lastSessionRefresh").lessThan(currentTime - realm.getSsoSessionIdleTimeout())
+                .get();
+
+        mongoStore.removeEntities(MongoUserSessionEntity.class, query, invocationContext);
+    }
+
+    @Override
+    public UsernameLoginFailureModel getUserLoginFailure(RealmModel realm, String username) {
+        DBObject query = new QueryBuilder()
+                .and("username").is(username)
+                .and("realmId").is(realm.getId())
+                .get();
+        MongoUsernameLoginFailureEntity user = mongoStore.loadSingleEntity(MongoUsernameLoginFailureEntity.class, query, invocationContext);
+
+        if (user == null) {
+            return null;
+        } else {
+            return new UsernameLoginFailureAdapter(invocationContext, user);
+        }
+    }
+
+    @Override
+    public UsernameLoginFailureModel addUserLoginFailure(RealmModel realm, String username) {
+        UsernameLoginFailureModel userLoginFailure = getUserLoginFailure(realm, username);
+        if (userLoginFailure != null) {
+            return userLoginFailure;
+        }
+
+        MongoUsernameLoginFailureEntity userEntity = new MongoUsernameLoginFailureEntity();
+        userEntity.setUsername(username);
+        userEntity.setRealmId(realm.getId());
+
+        mongoStore.insertEntity(userEntity, invocationContext);
+        return new UsernameLoginFailureAdapter(invocationContext, userEntity);
+    }
+
+    @Override
+    public List<UsernameLoginFailureModel> getAllUserLoginFailures(RealmModel realm) {
+        DBObject query = new QueryBuilder()
+                .and("realmId").is(realm.getId())
+                .get();
+        List<MongoUsernameLoginFailureEntity> failures = mongoStore.loadEntities(MongoUsernameLoginFailureEntity.class, query, invocationContext);
+
+        List<UsernameLoginFailureModel> result = new LinkedList<UsernameLoginFailureModel>();
+        if (failures == null) return result;
+        for (MongoUsernameLoginFailureEntity failure : failures) {
+            result.add(new UsernameLoginFailureAdapter(invocationContext, failure));
+        }
+
+        return result;
+    }
+
+    @Override
+    public void onRealmRemoved(RealmModel realm) {
+        removeUserSessions(realm);
+    }
+
+    @Override
+    public void onClientRemoved(RealmModel realm, ClientModel client) {
+        DBObject query = new QueryBuilder()
+                .and("realmId").is(realm.getId())
+                .get();
+        List<MongoUserSessionEntity> sessions = invocationContext.getMongoStore().loadEntities(MongoUserSessionEntity.class, query, invocationContext);
+        for (MongoUserSessionEntity session : sessions) {
+            invocationContext.getMongoStore().pullItemFromList(session, "associatedClientIds", client.getClientId(), invocationContext);
+        }
+    }
+
+    @Override
+    public void onUserRemoved(RealmModel realm, UserModel user) {
+        removeUserSessions(realm, user);
+    }
+
+    @Override
+    public void close() {
+    }
+
+}

diff --git a/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProviderFactory.java b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProviderFactory.java
new file mode 100644
index 0000000..a6b22b7
--- /dev/null
+++ b/model/sessions-mongo/src/main/java/org/keycloak/models/sessions/mongo/MongoUserSessionProviderFactory.java
@@ -0,0 +1,35 @@
+package org.keycloak.models.sessions.mongo;
+
+import org.keycloak.Config;
+import org.keycloak.connections.mongo.MongoConnectionProvider;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.UserSessionProvider;
+import org.keycloak.models.UserSessionProviderFactory;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+public class MongoUserSessionProviderFactory implements UserSessionProviderFactory {
+
+    public static final String ID = "mongo";
+
+    @Override
+    public UserSessionProvider create(KeycloakSession session) {
+        MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
+        return new MongoUserSessionProvider(session, connection.getMongoStore(), connection.getInvocationContext());
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return ID;
+    }
+
+}

diff --git a/model/sessions-mongo/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory b/model/sessions-mongo/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
new file mode 100644
index 0000000..3766f43
--- /dev/null
+++ b/model/sessions-mongo/src/main/resources/META-INF/services/org.keycloak.models.UserSessionProviderFactory
@@ -0,0 +1 @@
+org.keycloak.models.sessions.mongo.MongoUserSessionProviderFactory
\ No newline at end of file

diff --git a/model/users-jpa/pom.xml b/model/users-jpa/pom.xml
new file mode 100755
index 0000000..46ca527
--- /dev/null
+++ b/model/users-jpa/pom.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.0-beta-4-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-model-users-jpa</artifactId>
+    <name>Keycloak Model Users JPA</name>
+    <description/>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-core</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-hybrid</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate.javax.persistence</groupId>
+            <artifactId>hibernate-jpa-2.0-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hibernate</groupId>
+            <artifactId>hibernate-entitymanager</artifactId>
+            <version>${hibernate.entitymanager.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-model-tests-hybrid</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk16</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>net.iharder</groupId>
+            <artifactId>base64</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
+

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserAttributeEntity.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserAttributeEntity.java
new file mode 100644
index 0000000..c888b55
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserAttributeEntity.java
@@ -0,0 +1,79 @@
+package org.keycloak.models.users.jpa.entities;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.ManyToOne;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Entity
+@IdClass(UserAttributeEntity.Key.class)
+public class UserAttributeEntity {
+
+    @Id
+    protected String name;
+
+    @Id
+    @ManyToOne
+    protected UserEntity user;
+
+    protected String value;
+
+    public UserAttributeEntity() {
+    }
+
+    public UserAttributeEntity(UserEntity user, String name, String value) {
+        this.user = user;
+        this.name = name;
+        this.value = value;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public static class Key implements Serializable {
+        private String name;
+        private UserEntity user;
+
+        public Key() {
+        }
+
+        public Key(String name, UserEntity user) {
+            this.name = name;
+            this.user = user;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (name != null ? !name.equals(key.name) : key.name != null) return false;
+            if (user != null ? !user.equals(key.user) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = name != null ? name.hashCode() : 0;
+            result = 31 * result + (user != null ? user.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserCredentialEntity.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserCredentialEntity.java
new file mode 100755
index 0000000..1da3606
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserCredentialEntity.java
@@ -0,0 +1,106 @@
+package org.keycloak.models.users.jpa.entities;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.ManyToOne;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@Entity
+@IdClass(UserCredentialEntity.Key.class)
+public class UserCredentialEntity {
+
+    @Id
+    protected String type;
+
+    protected String value;
+    protected String device;
+    protected byte[] salt;
+    protected int hashIterations;
+
+    @Id
+    @ManyToOne
+    protected UserEntity user;
+
+    public UserCredentialEntity() {
+    }
+
+    public UserCredentialEntity(UserEntity user, String type) {
+        this.user = user;
+        this.type = type;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public String getDevice() {
+        return device;
+    }
+
+    public void setDevice(String device) {
+        this.device = device;
+    }
+
+    public byte[] getSalt() {
+        return salt;
+    }
+
+    public void setSalt(byte[] salt) {
+        this.salt = salt;
+    }
+
+    public int getHashIterations() {
+        return hashIterations;
+    }
+
+    public void setHashIterations(int hashIterations) {
+        this.hashIterations = hashIterations;
+    }
+
+    public static class Key implements Serializable {
+        private String type;
+        private UserEntity user;
+
+        public Key() {
+        }
+
+        public Key(String type, UserEntity user) {
+            this.type = type;
+            this.user = user;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (type != null ? !type.equals(key.type) : key.type != null) return false;
+            if (user != null ? !user.equals(key.user) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = type != null ? type.hashCode() : 0;
+            result = 31 * result + (user != null ? user.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserEntity.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserEntity.java
new file mode 100755
index 0000000..09f8788
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserEntity.java
@@ -0,0 +1,179 @@
+package org.keycloak.models.users.jpa.entities;
+
+import javax.persistence.CascadeType;
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.NamedQueries;
+import javax.persistence.NamedQuery;
+import javax.persistence.OneToMany;
+import javax.persistence.Table;
+import javax.persistence.UniqueConstraint;
+import java.io.Serializable;
+import java.util.Collection;
+import java.util.LinkedList;
+import java.util.List;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+@NamedQueries({
+        @NamedQuery(name="getRealmUserByUsername", query="select u from UserEntity u where u.username = :username and u.realm = :realm"),
+        @NamedQuery(name="getRealmUserByEmail", query="select u from UserEntity u where u.email = :email and u.realm = :realm"),
+        @NamedQuery(name="getRealmUserByAttribute", query="select u from UserEntity u join u.attributes a where u.realm = :realm and a.name = :name and a.value = :value")
+})
+@Entity
+@Table(uniqueConstraints = {
+        @UniqueConstraint(columnNames = { "realm", "username" }),
+        @UniqueConstraint(columnNames = { "realm", "emailConstraint" })
+})
+@IdClass(UserEntity.Key.class)
+public class UserEntity {
+    @Id
+    protected String id;
+
+    protected boolean enabled;
+    protected String username;
+    protected String firstName;
+    protected String lastName;
+    protected String email;
+
+    // Hack just to workaround the fact that on MS-SQL you can't have unique constraint with multiple NULL values TODO: Find better solution (like unique index with 'where' but that's proprietary)
+    protected String emailConstraint;
+
+    @Id
+    protected String realm;
+
+    @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, mappedBy="user")
+    protected List<UserAttributeEntity> attributes = new LinkedList<UserAttributeEntity>();
+
+    @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, mappedBy="user")
+    protected List<UserCredentialEntity> credentials = new LinkedList<UserCredentialEntity>();
+
+    @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, mappedBy="user")
+    protected List<UserRoleMappingEntity> roles = new LinkedList<UserRoleMappingEntity>();
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getFirstName() {
+        return firstName;
+    }
+
+    public void setFirstName(String firstName) {
+        this.firstName = firstName;
+    }
+
+    public String getLastName() {
+        return lastName;
+    }
+
+    public void setLastName(String lastName) {
+        this.lastName = lastName;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+        this.emailConstraint = email != null ? email : id;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getEmailConstraint() {
+        return emailConstraint;
+    }
+
+    public void setEmailConstraint(String emailConstraint) {
+        this.emailConstraint = emailConstraint;
+    }
+
+    public List<UserAttributeEntity> getAttributes() {
+        return attributes;
+    }
+
+    public void setAttributes(List<UserAttributeEntity> attributes) {
+        this.attributes = attributes;
+    }
+
+    public String getRealm() {
+        return realm;
+    }
+
+    public void setRealm(String realm) {
+        this.realm = realm;
+    }
+
+    public Collection<UserCredentialEntity> getCredentials() {
+        return credentials;
+    }
+
+    public void setCredentials(List<UserCredentialEntity> credentials) {
+        this.credentials = credentials;
+    }
+
+    public List<UserRoleMappingEntity> getRoles() {
+        return roles;
+    }
+
+    public void setRoles(List<UserRoleMappingEntity> roles) {
+        this.roles = roles;
+    }
+
+    public static class Key implements Serializable {
+        private String id;
+        private String realm;
+
+        public Key() {
+        }
+
+        public Key(String id, String realm) {
+            this.id = id;
+            this.realm = realm;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (id != null ? !id.equals(key.id) : key.id != null) return false;
+            if (realm != null ? !realm.equals(key.realm) : key.realm != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = id != null ? id.hashCode() : 0;
+            result = 31 * result + (realm != null ? realm.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserRoleMappingEntity.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserRoleMappingEntity.java
new file mode 100644
index 0000000..513163e
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/entities/UserRoleMappingEntity.java
@@ -0,0 +1,68 @@
+package org.keycloak.models.users.jpa.entities;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+import javax.persistence.IdClass;
+import javax.persistence.ManyToOne;
+import java.io.Serializable;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ */
+@Entity
+@IdClass(UserRoleMappingEntity.Key.class)
+public class UserRoleMappingEntity {
+
+    @Id
+    protected String role;
+
+    @Id
+    @ManyToOne
+    protected UserEntity user;
+
+    public UserRoleMappingEntity() {
+    }
+
+    public UserRoleMappingEntity(UserEntity user, String role) {
+        this.user = user;
+        this.role = role;
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    public static class Key implements Serializable {
+        private String role;
+        private UserEntity user;
+
+        public Key() {
+        }
+
+        public Key(String role, UserEntity user) {
+            this.role = role;
+            this.user = user;
+        }
+
+        @Override
+        public boolean equals(Object o) {
+            if (this == o) return true;
+            if (o == null || getClass() != o.getClass()) return false;
+
+            Key key = (Key) o;
+
+            if (role != null ? !role.equals(key.role) : key.role != null) return false;
+            if (user != null ? !user.equals(key.user) : key.user != null) return false;
+
+            return true;
+        }
+
+        @Override
+        public int hashCode() {
+            int result = role != null ? role.hashCode() : 0;
+            result = 31 * result + (user != null ? user.hashCode() : 0);
+            return result;
+        }
+    }
+
+}

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaKeycloakTransaction.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaKeycloakTransaction.java
new file mode 100755
index 0000000..2d1ab13
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaKeycloakTransaction.java
@@ -0,0 +1,53 @@
+package org.keycloak.models.users.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+
+import javax.persistence.EntityManager;
+import javax.persistence.PersistenceException;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaKeycloakTransaction implements KeycloakTransaction {
+
+    protected EntityManager em;
+
+    public JpaKeycloakTransaction(EntityManager em) {
+        this.em = em;
+    }
+
+    @Override
+    public void begin() {
+        em.getTransaction().begin();
+    }
+
+    @Override
+    public void commit() {
+        try {
+            em.getTransaction().commit();
+        } catch (PersistenceException e) {
+            throw PersistenceExceptionConverter.convert(e.getCause() != null ? e.getCause() : e);
+        }
+    }
+
+    @Override
+    public void rollback() {
+        em.getTransaction().rollback();
+    }
+
+    @Override
+    public void setRollbackOnly() {
+        em.getTransaction().setRollbackOnly();
+    }
+
+    @Override
+    public boolean getRollbackOnly() {
+        return  em.getTransaction().getRollbackOnly();
+    }
+
+    @Override
+    public boolean isActive() {
+        return em.getTransaction().isActive();
+    }
+}

diff --git a/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaUserProvider.java b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaUserProvider.java
new file mode 100755
index 0000000..204ab33
--- /dev/null
+++ b/model/users-jpa/src/main/java/org/keycloak/models/users/jpa/JpaUserProvider.java
@@ -0,0 +1,184 @@
+package org.keycloak.models.users.jpa;
+
+import org.keycloak.models.KeycloakTransaction;
+import org.keycloak.models.users.Credentials;
+import org.keycloak.models.users.Feature;
+import org.keycloak.models.users.User;
+import org.keycloak.models.users.UserProvider;
+import org.keycloak.models.users.jpa.entities.UserEntity;
+
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
+ * @version $Revision: 1 $
+ */
+public class JpaUserProvider implements UserProvider {
+
+    protected final EntityManager em;
+
+    public JpaUserProvider(EntityManager em) {
+        this.em = PersistenceExceptionConverter.create(em);
+    }
+
+    @Override
+    public KeycloakTransaction getTransaction() {
+        return new JpaKeycloakTransaction(em);
+    }
+
+    @Override
+    public User addUser(String id, String username, Set<String> initialRoles, String realm) {
+        UserEntity entity = new UserEntity();
+        entity.setId(id);
+        entity.setUsername(username);
+        entity.setEmailConstraint(id);
+        entity.setRealm(realm);
+        em.persist(entity);
+
+        UserAdapter adapter = new UserAdapter(realm, em, entity);
+
+        if (initialRoles != null && !initialRoles.isEmpty()) {
+            for (String role : initialRoles) {
+                adapter.grantRole(role);
+            }
+        }
+
+        return adapter;
+    }
+
+    @Override
+    public boolean removeUser(String name, String realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByLoginName", UserEntity.class);
+        query.setParameter("username", name);
+        query.setParameter("realm", realm);
+        List<UserEntity> results = query.getResultList();
+        if (results.size() == 0) return false;
+        em.remove(results.get(0));
+        return true;
+    }
+
+    @Override
+    public User getUserById(String id, String realm) {
+        UserEntity user = em.find(UserEntity.class, new UserEntity.Key(id, realm));
+        return user != null ? new UserAdapter(realm, em, user) : null;
+    }
+
+    @Override
+    public User getUserByUsername(String username, String realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByUsername", UserEntity.class);
+        query.setParameter("username", username);
+        query.setParameter("realm", realm);
+        List<UserEntity> results = query.getResultList();
+        if (results.size() == 0) return null;
+        return new UserAdapter(realm, em, results.get(0));
+    }
+
+    @Override
+    public User getUserByEmail(String email, String realm) {
+        TypedQuery<UserEntity> query = em.createNamedQuery("getRealmUserByEmail", UserEntity.class);
+        query.setParameter("email", email);
+        query.setParameter("realm", realm);
+        List<UserEntity> results = query.getResultList();
+        return results.isEmpty() ? null : new UserAdapter(realm, em, results.get(0));
+    }
+
+    @Override
+    public User getUserByAttribute(String name, String value, String realm) {
+        List<UserEntity> results = em.createNamedQuery("getRealmUserByAttribute", UserEntity.class)
+                .setParameter("realm", realm)
+                .setParameter("name", name)
+                .setParameter("value", value)
+                .getResultList();
+        return results.isEmpty() ? null : new UserAdapter(realm, em, results.get(0));
+    }
+
+    @Override
+    public void close() {
+        if (em.getTransaction().isActive()) em.getTransaction().rollback();
+        if (em.isOpen()) em.close();
+    }
+
+    @Override
+    public List<User> getUsers(String realm) {
+        TypedQuery<UserEntity> query = em.createQuery("select u from UserEntity u where u.realm = :realm", UserEntity.class);
+        query.setParameter("realm", realm);
+        List<UserEntity> results = query.getResultList();
+        List<User> users = new ArrayList<User>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    @Override
+    public List<User> searchForUser(String search, String realm) {
+        TypedQuery<UserEntity> query = em.createQuery("select u from UserEntity u where u.realm = :realm and ( lower(u.username) like :search or lower(concat(u.firstName, ' ', u.lastName)) like :search or u.email like :search )", UserEntity.class);
+        query.setParameter("realm", realm);
+        query.setParameter("search", "%" + search.toLowerCase() + "%");
+        List<UserEntity> results = query.getResultList();
+        List<User> users = new ArrayList<User>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    @Override
+    public List<User> searchForUserByAttributes(Map<String, String> attributes, String realm) {
+        StringBuilder builder = new StringBuilder("select u from UserEntity u");
+        boolean first = true;
+        for (Map.Entry<String, String> entry : attributes.entrySet()) {
+            String attribute = null;
+            if (entry.getKey().equals(User.USERNAME)) {
+                attribute = "lower(username)";
+            } else if (entry.getKey().equalsIgnoreCase(User.FIRST_NAME)) {
+                attribute = "lower(firstName)";
+            } else if (entry.getKey().equalsIgnoreCase(User.LAST_NAME)) {
+                attribute = "lower(lastName)";
+            } else if (entry.getKey().equalsIgnoreCase(User.EMAIL)) {
+                attribute = "lower(email)";
+            }
+            if (attribute == null) continue;
+            if (first) {
+                first = false;
+                builder.append(" where realm = :realm");
+            } else {
+                builder.append(" and ");
+            }
+            builder.append(attribute).append(" like '%").append(entry.getValue().toLowerCase()).append("%'");
+        }
+        String q = builder.toString();
+        TypedQuery<UserEntity> query = em.createQuery(q, UserEntity.class);
+        query.setParameter("realm", realm);
+        List<UserEntity> results = query.getResultList();
+        List<User> users = new ArrayList<User>();
+        for (UserEntity entity : results) users.add(new UserAdapter(realm, em, entity));
+        return users;
+    }
+
+    @Override
+    public boolean supports(Feature feature) {
+        return (feature == Feature.READ_CREDENTIALS || feature == Feature.UPDATE_CREDENTIALS);
+    }
+
+    @Override
+    public boolean verifyCredentials(User user, Credentials... credentials) {
+        return false;
+    }
+
+    @Override
+    public void onRealmRemoved(String realm) {
+        TypedQuery<UserEntity> query = em.createQuery("select u from UserEntity u where u.realm = :realm", UserEntity.class);
+        query.setParameter("realm", realm);
+        for (UserEntity u : query.getResultList()) {
+            em.remove(u);
+        }
+    }
+
+    @Override
+    public void onRoleRemoved(String role) {
+        em.createQuery("delete from RoleEntity r where r.role = :role").setParameter("role", role).executeUpdate();
+    }
+
+}