keycloak-uncached

diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/drone/Different.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/drone/Different.java
new file mode 100644
index 0000000..dc78e30
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/drone/Different.java
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.testsuite.drone;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.jboss.arquillian.drone.api.annotation.Qualifier;
+
+/**
+ * Taken from Drone example https://docs.jboss.org/author/display/ARQ/Drone
+ * This allows you to have more than one instance of a Drone WebDriver.
+ *
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ ElementType.FIELD, ElementType.PARAMETER })
+@Qualifier
+public @interface Different {
+}

diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
index 2badf74..406ab08 100755
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/pages/AppPage.java
@@ -30,7 +30,7 @@ import javax.ws.rs.core.UriBuilder;
 public class AppPage extends AbstractPage {
 
     public static final String AUTH_SERVER_URL = "http://localhost:8180/auth";
-    public static final String baseUrl = "http://localhost:8180/auth/realms/master/app";
+    public static final String baseUrl = "http://localhost:8180/auth/realms/master/app/auth";
 
     @FindBy(id = "account")
     private WebElement accountLink;

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java
index 9f679e3..0580062 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/authentication/ProvidersTest.java
@@ -74,6 +74,8 @@ public class ProvidersTest extends AbstractAuthenticationTest {
                 "Validates client based on signed JWT issued by client and signed with the Client private key");
         addProviderInfo(expected, "client-secret", "Client Id and Secret", "Validates client based on 'client_id' and " +
                 "'client_secret' sent either in request parameters or in 'Authorization: Basic' header");
+        addProviderInfo(expected, "testsuite-client-passthrough", "Testsuite Dummy Client Validation", "Testsuite dummy authenticator, " +
+                "which automatically authenticates hardcoded client (like 'test-app' )");
 
         compareProviders(expected, result);
     }
@@ -119,6 +121,10 @@ public class ProvidersTest extends AbstractAuthenticationTest {
                 "Will also set it if execution is OPTIONAL and the OTP is currently configured for it.");
         addProviderInfo(result, "reset-password", "Reset Password", "Sets the Update Password required action if execution is REQUIRED.  " +
                 "Will also set it if execution is OPTIONAL and the password is currently configured for it.");
+        addProviderInfo(result, "testsuite-dummy-passthrough", "Testsuite Dummy Pass Thru",
+                "Testsuite Dummy authenticator.  Just passes through and is hardcoded to a specific user");
+        addProviderInfo(result, "testsuite-dummy-registration", "Testsuite Dummy Pass Thru",
+                "Testsuite Dummy authenticator.  Just passes through and is hardcoded to a specific user");
         return result;
     }
 

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java
new file mode 100644
index 0000000..f83104c
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/AbstractFlowTest.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2016 Red Hat Inc. and/or its affiliates and other contributors
+ * as indicated by the @author tags. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package org.keycloak.testsuite.forms;
+
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.testsuite.TestRealmKeycloakTest;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+public abstract class AbstractFlowTest extends TestRealmKeycloakTest {
+
+    protected AuthenticationFlowRepresentation findFlowByAlias(String alias) {
+        for (AuthenticationFlowRepresentation rep : testRealm().flows().getFlows()) {
+            if (rep.getAlias().equals(alias)) return rep;
+        }
+
+        return null;
+    }
+
+    protected void setRegistrationFlow(AuthenticationFlowRepresentation flow) {
+        RealmRepresentation realm = testRealm().toRepresentation();
+        realm.setRegistrationFlow(flow.getAlias());
+        testRealm().update(realm);
+    }
+}

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java
new file mode 100644
index 0000000..8169835
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/forms/CustomFlowTest.java
@@ -0,0 +1,272 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.testsuite.forms;
+
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+import org.jboss.arquillian.graphene.page.Page;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.keycloak.OAuth2Constants;
+import org.keycloak.admin.client.resource.AuthenticationManagementResource;
+import org.keycloak.authentication.AuthenticationFlow;
+import org.keycloak.events.Details;
+import org.keycloak.events.Errors;
+import org.keycloak.models.AuthenticationExecutionModel;
+import org.keycloak.representations.AccessToken;
+import org.keycloak.representations.RefreshToken;
+import org.keycloak.representations.idm.AuthenticationExecutionInfoRepresentation;
+import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+import org.keycloak.representations.idm.ClientRepresentation;
+import org.keycloak.representations.idm.RealmRepresentation;
+import org.keycloak.representations.idm.UserRepresentation;
+import org.keycloak.testsuite.AssertEvents;
+import org.keycloak.testsuite.TestRealmKeycloakTest;
+import org.keycloak.testsuite.pages.AppPage;
+import org.keycloak.testsuite.pages.AppPage.RequestType;
+import org.keycloak.testsuite.pages.ErrorPage;
+import org.keycloak.testsuite.pages.LoginPage;
+import org.keycloak.testsuite.pages.LoginPasswordUpdatePage;
+import org.keycloak.testsuite.pages.RegisterPage;
+import org.keycloak.testsuite.util.ClientBuilder;
+import org.keycloak.testsuite.util.ExecutionBuilder;
+import org.keycloak.testsuite.util.FlowBuilder;
+import org.keycloak.testsuite.util.OAuthClient;
+import org.keycloak.testsuite.util.UserBuilder;
+
+import static org.junit.Assert.assertEquals;
+
+/**
+ * @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+public class CustomFlowTest extends AbstractFlowTest {
+
+    @Override
+    public void configureTestRealm(RealmRepresentation testRealm) {
+        UserRepresentation user = UserBuilder.create()
+                                            .username("login-test")
+                                            .email("login@test.com")
+                                            .enabled(true)
+                                            .build();
+        testRealm.getUsers().add(user);
+
+        // Set passthrough clientAuthenticator for our clients
+        ClientRepresentation dummyClient = ClientBuilder.create()
+                                              .clientId("dummy-client")
+                                              .name("dummy-client")
+                                              .authenticatorType(PassThroughClientAuthenticator.PROVIDER_ID)
+                                              .directAccessGrants()
+                                              .build();
+        testRealm.getClients().add(dummyClient);
+
+        ClientRepresentation testApp = findClientInRealmRep(testRealm, "test-app");
+        testApp.setClientAuthenticatorType(PassThroughClientAuthenticator.PROVIDER_ID);
+        testApp.setDirectAccessGrantsEnabled(true);
+    }
+
+    @Before
+    public void configureFlows() {
+        userId = findUser("login-test").getId();
+
+        AuthenticationFlowRepresentation flow = FlowBuilder.create()
+                                                           .alias("dummy")
+                                                           .description("dummy pass through flow")
+                                                           .providerId("basic-flow")
+                                                           .topLevel(true)
+                                                           .builtIn(false)
+                                                           .build();
+        testRealm().flows().createFlow(flow);
+
+        RealmRepresentation realm = testRealm().toRepresentation();
+        realm.setBrowserFlow(flow.getAlias());
+        realm.setDirectGrantFlow(flow.getAlias());
+        testRealm().update(realm);
+
+        // refresh flow to find its id
+        flow = findFlowByAlias(flow.getAlias());
+
+        AuthenticationExecutionRepresentation execution = ExecutionBuilder.create()
+                                                            .parentFlow(flow.getId())
+                                                            .requirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString())
+                                                            .authenticator(PassThroughAuthenticator.PROVIDER_ID)
+                                                            .priority(10)
+                                                            .authenticatorFlow(false)
+                                                            .build();
+        testRealm().flows().addExecution(execution);
+
+        flow = FlowBuilder.create()
+                        .alias("dummy registration")
+                        .description("dummy pass through registration")
+                        .providerId("basic-flow")
+                        .topLevel(true)
+                        .builtIn(false)
+                        .build();
+        testRealm().flows().createFlow(flow);
+
+        setRegistrationFlow(flow);
+
+        // refresh flow to find its id
+        flow = findFlowByAlias(flow.getAlias());
+
+        execution = ExecutionBuilder.create()
+                        .parentFlow(flow.getId())
+                        .requirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString())
+                        .authenticator(PassThroughRegistration.PROVIDER_ID)
+                        .priority(10)
+                        .authenticatorFlow(false)
+                        .build();
+        testRealm().flows().addExecution(execution);
+
+        AuthenticationFlowRepresentation clientFlow = FlowBuilder.create()
+                                                           .alias("client-dummy")
+                                                           .description("dummy pass through flow")
+                                                           .providerId(AuthenticationFlow.CLIENT_FLOW)
+                                                           .topLevel(true)
+                                                           .builtIn(false)
+                                                           .build();
+        testRealm().flows().createFlow(clientFlow);
+
+        realm = testRealm().toRepresentation();
+        realm.setClientAuthenticationFlow(clientFlow.getAlias());
+        testRealm().update(realm);
+
+        // refresh flow to find its id
+        clientFlow = findFlowByAlias(clientFlow.getAlias());
+
+        execution = ExecutionBuilder.create()
+                        .parentFlow(clientFlow.getId())
+                        .requirement(AuthenticationExecutionModel.Requirement.REQUIRED.toString())
+                        .authenticator(PassThroughClientAuthenticator.PROVIDER_ID)
+                        .priority(10)
+                        .authenticatorFlow(false)
+                        .build();
+        testRealm().flows().addExecution(execution);
+    }
+
+
+    @Rule
+    public AssertEvents events = new AssertEvents(this);
+
+    @Page
+    protected AppPage appPage;
+
+    @Page
+    protected LoginPage loginPage;
+
+    @Page
+    protected ErrorPage errorPage;
+
+    @Page
+    protected LoginPasswordUpdatePage updatePasswordPage;
+
+    @Page
+    protected RegisterPage registerPage;
+
+    private static String userId;
+
+    @Test
+    public void loginSuccess() {
+
+        PassThroughAuthenticator.username = "login-test";
+
+        oauth.openLoginForm();
+
+        Assert.assertEquals(RequestType.AUTH_RESPONSE, appPage.getRequestType());
+        Assert.assertNotNull(oauth.getCurrentQuery().get(OAuth2Constants.CODE));
+
+        events.expectLogin().user(userId).detail(Details.USERNAME, "login-test").assertEvent();
+    }
+
+    @Test
+    public void grantTest() throws Exception {
+        PassThroughAuthenticator.username = "login-test";
+        grantAccessToken("test-app", "login-test");
+    }
+
+    @Test
+    public void clientAuthTest() throws Exception {
+        PassThroughClientAuthenticator.clientId = "dummy-client";
+        PassThroughAuthenticator.username = "login-test";
+        grantAccessToken("dummy-client", "login-test");
+
+        PassThroughClientAuthenticator.clientId = "test-app";
+        grantAccessToken("test-app", "login-test");
+
+        PassThroughClientAuthenticator.clientId = "unknown";
+        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", "test-user", "password");
+        assertEquals(400, response.getStatusCode());
+        assertEquals("unauthorized_client", response.getError());
+
+        events.expectLogin()
+                .client((String) null)
+                .user((String) null)
+                .session((String) null)
+                .removeDetail(Details.CODE_ID)
+                .removeDetail(Details.REDIRECT_URI)
+                .removeDetail(Details.CONSENT)
+                .error(Errors.INVALID_CLIENT_CREDENTIALS)
+                .assertEvent();
+    }
+
+
+    private void grantAccessToken(String clientId, String login) throws Exception {
+
+        OAuthClient.AccessTokenResponse response = oauth.doGrantAccessTokenRequest("password", login, "password");
+
+        assertEquals(200, response.getStatusCode());
+
+        AccessToken accessToken = oauth.verifyToken(response.getAccessToken());
+        RefreshToken refreshToken = oauth.verifyRefreshToken(response.getRefreshToken());
+
+        events.expectLogin()
+                .client(clientId)
+                .user(userId)
+                .session(accessToken.getSessionState())
+                .detail(Details.GRANT_TYPE, OAuth2Constants.PASSWORD)
+                .detail(Details.TOKEN_ID, accessToken.getId())
+                .detail(Details.REFRESH_TOKEN_ID, refreshToken.getId())
+                .detail(Details.USERNAME, login)
+                .detail(Details.CLIENT_AUTH_METHOD, PassThroughClientAuthenticator.PROVIDER_ID)
+                .removeDetail(Details.CODE_ID)
+                .removeDetail(Details.REDIRECT_URI)
+                .removeDetail(Details.CONSENT)
+                .assertEvent();
+
+        assertEquals(accessToken.getSessionState(), refreshToken.getSessionState());
+
+        OAuthClient.AccessTokenResponse refreshedResponse = oauth.doRefreshTokenRequest(response.getRefreshToken(), "password");
+
+        AccessToken refreshedAccessToken = oauth.verifyToken(refreshedResponse.getAccessToken());
+        RefreshToken refreshedRefreshToken = oauth.verifyRefreshToken(refreshedResponse.getRefreshToken());
+
+        assertEquals(accessToken.getSessionState(), refreshedAccessToken.getSessionState());
+        assertEquals(accessToken.getSessionState(), refreshedRefreshToken.getSessionState());
+
+        events.expectRefresh(refreshToken.getId(), refreshToken.getSessionState())
+                .user(userId)
+                .client(clientId)
+                .detail(Details.CLIENT_AUTH_METHOD, PassThroughClientAuthenticator.PROVIDER_ID)
+                .assertEvent();
+    }
+
+
+}

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/TestRealmKeycloakTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/TestRealmKeycloakTest.java
index 55cf15b..0e41cee 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/TestRealmKeycloakTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/TestRealmKeycloakTest.java
@@ -21,6 +21,8 @@ import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.RealmRepresentation;
 
 import java.util.List;
+import org.keycloak.admin.client.resource.RealmResource;
+import org.keycloak.representations.idm.UserRepresentation;
 
 import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
 
@@ -32,6 +34,36 @@ import static org.keycloak.testsuite.admin.AbstractAdminTest.loadJson;
  */
 public abstract class TestRealmKeycloakTest extends AbstractKeycloakTest {
 
+    protected UserRepresentation findUserInRealmRep(RealmRepresentation testRealm, String userName) {
+        for (UserRepresentation user : testRealm.getUsers()) {
+            if (user.getUsername().equals(userName)) return user;
+        }
+
+        return null;
+    }
+
+    protected ClientRepresentation findClientInRealmRep(RealmRepresentation testRealm, String clientId) {
+        for (ClientRepresentation client : testRealm.getClients()) {
+            if (client.getClientId().equals(clientId)) return client;
+        }
+
+        return null;
+    }
+
+    protected RealmResource testRealm() {
+        return adminClient.realm("test");
+    }
+
+    protected UserRepresentation findUser(String userNameOrEmail) {
+        List<UserRepresentation> repList = testRealm().users().search(userNameOrEmail, -1, -1);
+        if (repList.size() != 1) throw new IllegalStateException("User search expected one result. Found " + repList.size() + " users.");
+        return repList.get(0);
+    }
+
+    protected void updateUser(UserRepresentation user) {
+        testRealm().users().get(user.getId()).update(user);
+    }
+
     protected ClientRepresentation findTestApp(RealmRepresentation testRealm) {
         for (ClientRepresentation client : testRealm.getClients()) {
             if (client.getClientId().equals("test-app")) return client;

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientBuilder.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientBuilder.java
index 24395ab..4cd31fe 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientBuilder.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ClientBuilder.java
@@ -43,6 +43,11 @@ public class ClientBuilder {
         return this;
     }
 
+    public ClientBuilder name(String name) {
+        rep.setName(name);
+        return this;
+    }
+
     public ClientBuilder clientId(String clientId) {
         rep.setClientId(clientId);
         return this;

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ExecutionBuilder.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ExecutionBuilder.java
new file mode 100644
index 0000000..1722c44
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/ExecutionBuilder.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.util;
+
+
+import org.keycloak.representations.idm.AuthenticationExecutionRepresentation;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+public class ExecutionBuilder {
+
+    private AuthenticationExecutionRepresentation rep = new AuthenticationExecutionRepresentation();
+
+    public static ExecutionBuilder create() {
+        return new ExecutionBuilder();
+    }
+
+    private ExecutionBuilder() {
+    }
+
+    public ExecutionBuilder id(String id) {
+        rep.setId(id);
+        return this;
+    }
+
+    public ExecutionBuilder parentFlow(String parentFlow) {
+        rep.setParentFlow(parentFlow);
+        return this;
+    }
+
+    public ExecutionBuilder requirement(String requirement) {
+        rep.setRequirement(requirement);
+        return this;
+    }
+
+    public ExecutionBuilder authenticator(String authenticator) {
+        rep.setAuthenticator(authenticator);
+        return this;
+    }
+
+    public ExecutionBuilder priority(int priority) {
+        rep.setPriority(priority);
+        return this;
+    }
+
+    public ExecutionBuilder authenticatorFlow(boolean authenticatorFlow) {
+        rep.setAutheticatorFlow(authenticatorFlow);
+        return this;
+    }
+
+    public AuthenticationExecutionRepresentation build() {
+        return rep;
+    }
+
+}

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowBuilder.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowBuilder.java
new file mode 100644
index 0000000..1823886
--- /dev/null
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/FlowBuilder.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.testsuite.util;
+
+
+import org.keycloak.representations.idm.AuthenticationFlowRepresentation;
+
+/**
+ * @author Stan Silvert ssilvert@redhat.com (C) 2016 Red Hat Inc.
+ */
+public class FlowBuilder {
+
+    private AuthenticationFlowRepresentation rep = new AuthenticationFlowRepresentation();
+
+    public static FlowBuilder create() {
+        return new FlowBuilder();
+    }
+
+    private FlowBuilder() {
+    }
+
+    public FlowBuilder id(String id) {
+        rep.setId(id);
+        return this;
+    }
+
+    public FlowBuilder alias(String alias) {
+        rep.setAlias(alias);
+        return this;
+    }
+
+    public FlowBuilder description(String description) {
+        rep.setDescription(description);
+        return this;
+    }
+
+    public FlowBuilder providerId(String providerId) {
+        rep.setProviderId(providerId);
+        return this;
+    }
+
+    public FlowBuilder topLevel(boolean topLevel) {
+        rep.setTopLevel(topLevel);
+        return this;
+    }
+
+    public FlowBuilder builtIn(boolean builtIn) {
+        rep.setBuiltIn(builtIn);
+        return this;
+    }
+
+    public AuthenticationFlowRepresentation build() {
+        return rep;
+    }
+
+}

diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/UserBuilder.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/UserBuilder.java
index 2696833..90f2421 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/UserBuilder.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/util/UserBuilder.java
@@ -122,20 +122,33 @@ public class UserBuilder {
         return this;
     }
 
-    public UserBuilder totpSecret(String totpSecret) {
+    public UserBuilder secret(String type, String secret) {
         if (rep.getCredentials() == null) {
             rep.setCredentials(new LinkedList<CredentialRepresentation>());
         }
 
         CredentialRepresentation credential = new CredentialRepresentation();
-        credential.setType(CredentialRepresentation.TOTP);
-        credential.setValue(totpSecret);
+        credential.setType(type);
+        credential.setValue(secret);
 
         rep.getCredentials().add(credential);
         rep.setTotp(true);
         return this;
     }
 
+    public UserBuilder totpSecret(String totpSecret) {
+        return secret(CredentialRepresentation.TOTP, totpSecret);
+    }
+
+    public UserBuilder hotpSecret(String hotpSecret) {
+        return secret(CredentialRepresentation.HOTP, hotpSecret);
+    }
+
+    public UserBuilder otpEnabled() {
+        rep.setTotp(Boolean.TRUE);
+        return this;
+    }
+
     public UserRepresentation build() {
         return rep;
     }