keycloak-aplcache

diff --git a/broker/pom.xml b/broker/pom.xml
index e2ae6ff..7121b2b 100755
--- a/broker/pom.xml
+++ b/broker/pom.xml
@@ -18,7 +18,6 @@
         <module>core</module>
         <module>oidc</module>
         <module>saml</module>
-        <module>kerberos</module>
     </modules>
 
 </project>

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java
index 35a7e42..aded77e 100755
--- a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/MongoStoreImpl.java
@@ -18,6 +18,7 @@ import org.keycloak.connections.mongo.api.types.Mapper;
 import org.keycloak.connections.mongo.api.types.MapperContext;
 import org.keycloak.connections.mongo.api.types.MapperRegistry;
 import org.keycloak.connections.mongo.impl.types.BasicDBListMapper;
+import org.keycloak.connections.mongo.impl.types.BasicDBListToSetMapper;
 import org.keycloak.connections.mongo.impl.types.BasicDBObjectMapper;
 import org.keycloak.connections.mongo.impl.types.BasicDBObjectToMapMapper;
 import org.keycloak.connections.mongo.impl.types.EnumToStringMapper;
@@ -35,8 +36,10 @@ import org.keycloak.models.utils.reflection.PropertyQueries;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 
@@ -71,6 +74,10 @@ public class MongoStoreImpl implements MongoStore {
         mapperRegistry.addAppObjectMapper(new ListMapper(mapperRegistry, List.class));
         mapperRegistry.addDBObjectMapper(new BasicDBListMapper(mapperRegistry));
 
+        mapperRegistry.addAppObjectMapper(new ListMapper(mapperRegistry, HashSet.class));
+        mapperRegistry.addAppObjectMapper(new ListMapper(mapperRegistry, Set.class));
+        mapperRegistry.addDBObjectMapper(new BasicDBListToSetMapper(mapperRegistry));
+
         mapperRegistry.addAppObjectMapper(new MapMapper(HashMap.class));
         mapperRegistry.addAppObjectMapper(new MapMapper(Map.class));
         mapperRegistry.addDBObjectMapper(new BasicDBObjectToMapMapper());

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java
index f44f545..cc229c6 100755
--- a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListMapper.java
@@ -6,6 +6,7 @@ import org.keycloak.connections.mongo.api.types.MapperContext;
 import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.List;
 
 /**

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListToSetMapper.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListToSetMapper.java
new file mode 100644
index 0000000..d43781a
--- /dev/null
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/BasicDBListToSetMapper.java
@@ -0,0 +1,44 @@
+package org.keycloak.connections.mongo.impl.types;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import com.mongodb.BasicDBList;
+import org.keycloak.connections.mongo.api.types.Mapper;
+import org.keycloak.connections.mongo.api.types.MapperContext;
+import org.keycloak.connections.mongo.api.types.MapperRegistry;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class BasicDBListToSetMapper implements Mapper<BasicDBList, Set> {
+
+    private final MapperRegistry mapperRegistry;
+
+    public BasicDBListToSetMapper(MapperRegistry mapperRegistry) {
+        this.mapperRegistry = mapperRegistry;
+    }
+
+    @Override
+    public Set convertObject(MapperContext<BasicDBList, Set> context) {
+        BasicDBList dbList = context.getObjectToConvert();
+        Set<Object> appObjects = new HashSet<Object>();
+        Class<?> expectedListElementType = context.getGenericTypes().get(0);
+
+        for (Object dbObject : dbList) {
+            MapperContext<Object, Object> newContext = new MapperContext<Object, Object>(dbObject, expectedListElementType, null);
+            appObjects.add(mapperRegistry.convertDBObjectToApplicationObject(newContext));
+        }
+        return appObjects;
+    }
+
+    @Override
+    public Class<? extends BasicDBList> getTypeOfObjectToConvert() {
+        return BasicDBList.class;
+    }
+
+    @Override
+    public Class<Set> getExpectedReturnType() {
+        return Set.class;
+    }
+}

diff --git a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java
index 3274fe3..dc649d6 100755
--- a/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java
+++ b/connections/mongo/src/main/java/org/keycloak/connections/mongo/impl/types/ListMapper.java
@@ -5,12 +5,12 @@ import org.keycloak.connections.mongo.api.types.Mapper;
 import org.keycloak.connections.mongo.api.types.MapperContext;
 import org.keycloak.connections.mongo.api.types.MapperRegistry;
 
-import java.util.List;
+import java.util.Collection;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
-public class ListMapper<T extends List> implements Mapper<T, BasicDBList> {
+public class ListMapper<T extends Collection> implements Mapper<T, BasicDBList> {
 
     private final MapperRegistry mapperRegistry;
     private final Class<T> listType;

diff --git a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
index f1ea715..b7dad57 100755
--- a/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
+++ b/core/src/main/java/org/keycloak/representations/idm/CredentialRepresentation.java
@@ -10,6 +10,7 @@ public class CredentialRepresentation {
     public static final String PASSWORD_TOKEN = "password-token";
     public static final String TOTP = "totp";
     public static final String CLIENT_CERT = "cert";
+    public static final String KERBEROS = "kerberos";
 
     protected String type;
     protected String device;

diff --git a/dependencies/server-all/pom.xml b/dependencies/server-all/pom.xml
index c2546e8..f697926 100755
--- a/dependencies/server-all/pom.xml
+++ b/dependencies/server-all/pom.xml
@@ -95,7 +95,7 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
-            <artifactId>keycloak-broker-kerberos</artifactId>
+            <artifactId>keycloak-kerberos-federation</artifactId>
             <version>${project.version}</version>
         </dependency>
         <dependency>

diff --git a/docbook/reference/en/en-US/modules/adapter-config.xml b/docbook/reference/en/en-US/modules/adapter-config.xml
index a9d4e08..d4ef642 100755
--- a/docbook/reference/en/en-US/modules/adapter-config.xml
+++ b/docbook/reference/en/en-US/modules/adapter-config.xml
@@ -38,7 +38,7 @@
         Some of these configuration switches may be adapter specific and some are common across all adapters.
         For Java adapters you can use <literal>${...}</literal> enclosure as System property replacement.
         For example <literal>${jboss.server.config.dir}</literal>.  Also, you can obtain a template
-        for this config file from the admin console.  Go to the realm and application you want a template for.
+        for this config file from the admin console.  Go to the realm and select the application you want a template for.
         Go to the <literal>Installation</literal> tab and this will provide you with a template that includes
         the public key of the realm.
     </para>
@@ -348,7 +348,7 @@
                 <listitem>
                     <para>
                         If <emphasis>true</emphasis>, then adapter will send registration request to Keycloak. It's <emphasis>false</emphasis>
-                        by default as useful just in cluster (See <link linkend="registration-app-nodes">Registration of application nodes to Keycloak</link>)
+                        by default and useful just in cluster (See <link linkend="registration-app-nodes">Registration of application nodes to Keycloak</link>)
                     </para>
                 </listitem>
             </varlistentry>

diff --git a/docbook/reference/en/en-US/modules/admin-rest-api.xml b/docbook/reference/en/en-US/modules/admin-rest-api.xml
index 74533cd..56d5ccd 100755
--- a/docbook/reference/en/en-US/modules/admin-rest-api.xml
+++ b/docbook/reference/en/en-US/modules/admin-rest-api.xml
@@ -3,7 +3,7 @@
     <para>
         The Keycloak Admin Console is implemented entirely with a fully functional REST admin API.  You can invoke this
         REST API from your Java applications by obtaining an access token.  You must have the appropriate
-        permissions set up as describe in <xref linkend="admin-permissions" /> and <xref linkend="per-realm-admin-permissions" />
+        permissions set up as described in <xref linkend="admin-permissions" /> and <xref linkend="per-realm-admin-permissions" />
     </para>
     <para>
         The documentation for this REST API is auto-generated and is contained in the distribution of keycloak under

diff --git a/docbook/reference/en/en-US/modules/events.xml b/docbook/reference/en/en-US/modules/events.xml
index e580448..57cac03 100755
--- a/docbook/reference/en/en-US/modules/events.xml
+++ b/docbook/reference/en/en-US/modules/events.xml
@@ -40,7 +40,7 @@
     <section>
         <title>Event Listener</title>
         <para>
-            Keycloak comes with an Email Event Listener and a JBogg Logging Event Listener. The Email Event Listener
+            Keycloak comes with an Email Event Listener and a JBoss Logging Event Listener. The Email Event Listener
             sends an email to the users account when an event occurs. The JBoss Logging Event Listener writes to a log
             file when an events occurs.
         </para>

diff --git a/docbook/reference/en/en-US/modules/javascript-adapter.xml b/docbook/reference/en/en-US/modules/javascript-adapter.xml
index c208562..80f04ed 100755
--- a/docbook/reference/en/en-US/modules/javascript-adapter.xml
+++ b/docbook/reference/en/en-US/modules/javascript-adapter.xml
@@ -206,7 +206,7 @@ new Keycloak({ url: 'http://localhost/auth', realm: 'myrealm', clientId: 'myApp'
                 <para>Options is an Object, where:
                     <itemizedlist>
                         <listitem>redirectUri - specifies the uri to redirect to after login</listitem>
-                        <listitem>prompt - can be set to 'none' to check if the user is logged in already (if not logged in a login form is not displayed)</listitem>
+                        <listitem>prompt - can be set to 'none' to check if the user is logged in already (if not logged in, a login form is not displayed)</listitem>
                         <listitem>loginHint - used to pre-fill the username/email field on the login form</listitem>
                     </itemizedlist>
                 </para>
@@ -218,7 +218,7 @@ new Keycloak({ url: 'http://localhost/auth', realm: 'myrealm', clientId: 'myApp'
                 <para>Options is an Object, where:
                     <itemizedlist>
                         <listitem>redirectUri - specifies the uri to redirect to after login</listitem>
-                        <listitem>prompt - can be set to 'none' to check if the user is logged in already (if not logged in a login form is not displayed)</listitem>
+                        <listitem>prompt - can be set to 'none' to check if the user is logged in already (if not logged in, a login form is not displayed)</listitem>
                     </itemizedlist>
                 </para>
             </simplesect>

diff --git a/docbook/reference/en/en-US/modules/multi-tenancy.xml b/docbook/reference/en/en-US/modules/multi-tenancy.xml
index 410621f..e7b385e 100644
--- a/docbook/reference/en/en-US/modules/multi-tenancy.xml
+++ b/docbook/reference/en/en-US/modules/multi-tenancy.xml
@@ -9,7 +9,7 @@
             <listitem>
                 The same WAR file deployed under two different names, each with its own Keycloak configuration (probably via the Keycloak Subsystem).
                 This scenario is suitable when the number of realms is known in advance or when there's a dynamic provision of application instances.
-                One example would be a service provider that dinamically creates servers/deployments for their clients, like a PaaS.
+                One example would be a service provider that dynamically creates servers/deployments for their clients, like a PaaS.
             </listitem>
 
             <listitem>
@@ -37,7 +37,7 @@
 
             <listitem>
                 Add a context parameter to the <literal>web.xml</literal>, named <literal>keycloak.config.resolver</literal>.
-                The value of this property should be the fully qualified name of the a class extending
+                The value of this property should be the fully qualified name of the class extending
                 <literal>org.keycloak.adapters.KeycloakConfigResolver</literal>.
             </listitem>
 
@@ -51,6 +51,6 @@
         </itemizedlist>
     </para>
     <para>
-        An implementation of this feature can be found on the examples.
+        An implementation of this feature can be found in the examples.
     </para>
 </section>

diff --git a/docbook/reference/en/en-US/modules/providers.xml b/docbook/reference/en/en-US/modules/providers.xml
index 62b5b8e..4e2239d 100755
--- a/docbook/reference/en/en-US/modules/providers.xml
+++ b/docbook/reference/en/en-US/modules/providers.xml
@@ -80,9 +80,7 @@ public class MyEventListenerProvider implements EventListenerProvider {
         <para>
             The file <literal>META-INF/services/org.keycloak.events.EventListenerProviderFactory</literal> should
             contain the full name of your ProviderFactory implementation:
-<programlisting><![CDATA[{
-org.acme.provider.MyEventListenerProviderFactory
-}]]></programlisting>
+<programlisting><![CDATA[org.acme.provider.MyEventListenerProviderFactory]]></programlisting>
         </para>
     </section>
 
@@ -142,7 +140,7 @@ org.acme.provider.MyEventListenerProviderFactory
                 <varlistentry>
                     <term>Connections Jpa</term>
                     <listitem>
-                        Loads and configures Infinispan connections. The default implementation can load datasources
+                        Loads and configures Jpa connections. The default implementation can load datasources
                         from
                         WildFly/EAP, or alternatively can be manually configured in keycloak-server.json.
                     </listitem>
@@ -188,15 +186,15 @@ org.acme.provider.MyEventListenerProviderFactory
                     <listitem>
                         Exports the Keycloak database. Keycloak provides implementations that export to JSON files
                         either
-                        as a single file, multiple file in a directory or a encrypted ZIP archive.
+                        as a single file, multiple files in a directory or a encrypted ZIP archive.
                     </listitem>
                 </varlistentry>
                 <varlistentry>
                     <term>Import</term>
                     <listitem>
-                        Imports and exported Keycloak database. Keycloak provides implementations that import from JSON
+                        Imports an exported Keycloak database. Keycloak provides implementations that import from JSON
                         files either
-                        as a single file, multiple file in a directory or a encrypted ZIP archive.
+                        as a single file, multiple files in a directory or a encrypted ZIP archive.
                     </listitem>
                 </varlistentry>
                 <varlistentry>

diff --git a/docbook/reference/en/en-US/modules/server-installation.xml b/docbook/reference/en/en-US/modules/server-installation.xml
index a4b5455..35d231d 100755
--- a/docbook/reference/en/en-US/modules/server-installation.xml
+++ b/docbook/reference/en/en-US/modules/server-installation.xml
@@ -94,8 +94,8 @@ keycloak-war-dist-all-&project.version;/
         <para>
 <programlisting>
     $ cd keycloak-war-dist-all-&project.version;
-    $ cp -r deployments $JBOSS_HOME/standalone
-    $ cp -r configuration $JBOSS_HOME/standalone
+    $ cp -r deployments $JBOSS_HOME/standalone/deployments
+    $ cp -r configuration $JBOSS_HOME/standalone/configuration
 </programlisting>
         </para>
         <para>
@@ -515,7 +515,7 @@ keycloak-war-dist-all-&project.version;/
     </programlisting>
                         </para>
                         <para>
-                            You should answer the <literal>What is your first and last name?</literal> question with
+                            You should answer <literal>What is your first and last name ?</literal> question with
                             the DNS name of the machine you're installing the server on.  For testing purposes,
                             <literal>localhost</literal> should be used.  After executing this command, the
                             <literal>keycloak.jks</literal> file will be generated in the same directory as you executed

diff --git a/docbook/reference/en/en-US/modules/timeouts.xml b/docbook/reference/en/en-US/modules/timeouts.xml
index 62d72a6..ef41019 100755
--- a/docbook/reference/en/en-US/modules/timeouts.xml
+++ b/docbook/reference/en/en-US/modules/timeouts.xml
@@ -11,7 +11,7 @@
             If you go to the admin console page of Settings->General, you should see a <literal>Remember Me</literal> on/off switch.
             Your realm sets a SSO cookie so that you only have to enter in your login credentials once.
             This <literal>Remember Me</literal> admin config option, when turned on, will show a "Remember Me" checkbox on the user's login page.
-            If the user clicks this, the realm's SSO. cookie will be persistent.   This means that if the user closes their browser
+            If the user clicks this, the realm's SSO cookie will be persistent.   This means that if the user closes their browser
             they will still be logged in the next time they start up their browser.
         </para>
     </section>

diff --git a/docbook/reference/en/en-US/modules/user-federation.xml b/docbook/reference/en/en-US/modules/user-federation.xml
index f1ba3ba..777f4b7 100755
--- a/docbook/reference/en/en-US/modules/user-federation.xml
+++ b/docbook/reference/en/en-US/modules/user-federation.xml
@@ -155,7 +155,7 @@
         <para>
             The keycloak examples directory contains an example of a simple User Federation Provider backed by
             a simple properties file.  See <literal>examples/providers/federation-provider</literal>.  Most of how
-            to create a federation provider is explain directly within the example code, but some information is here too.
+            to create a federation provider is explained directly within the example code, but some information is here too.
         </para>
         <para>
             Writing a User Federation Provider starts by implementing the <literal>UserFederationProvider</literal>

diff --git a/examples/fuse/camel/pom.xml b/examples/fuse/camel/pom.xml
index 51869c0..a81554e 100644
--- a/examples/fuse/camel/pom.xml
+++ b/examples/fuse/camel/pom.xml
@@ -52,6 +52,13 @@
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
                     <source>${maven.compiler.source}</source>

diff --git a/examples/fuse/cxf-jaxrs/pom.xml b/examples/fuse/cxf-jaxrs/pom.xml
index 5486df2..eea2858 100644
--- a/examples/fuse/cxf-jaxrs/pom.xml
+++ b/examples/fuse/cxf-jaxrs/pom.xml
@@ -56,6 +56,13 @@
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
                     <source>${maven.compiler.source}</source>

diff --git a/examples/fuse/cxf-jaxws/pom.xml b/examples/fuse/cxf-jaxws/pom.xml
index 6f38b76..8cefdf4 100644
--- a/examples/fuse/cxf-jaxws/pom.xml
+++ b/examples/fuse/cxf-jaxws/pom.xml
@@ -79,6 +79,13 @@
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
                     <source>${maven.compiler.source}</source>

diff --git a/examples/fuse/features/pom.xml b/examples/fuse/features/pom.xml
index e6e8bfc..452f190 100644
--- a/examples/fuse/features/pom.xml
+++ b/examples/fuse/features/pom.xml
@@ -23,6 +23,13 @@
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-resources-plugin</artifactId>
                 <executions>
                     <execution>

diff --git a/examples/fuse/product-app-fuse/pom.xml b/examples/fuse/product-app-fuse/pom.xml
index fdd218d..96a0410 100644
--- a/examples/fuse/product-app-fuse/pom.xml
+++ b/examples/fuse/product-app-fuse/pom.xml
@@ -58,6 +58,13 @@
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
                     <source>${maven.compiler.source}</source>

diff --git a/examples/providers/event-listener-sysout/pom.xml b/examples/providers/event-listener-sysout/pom.xml
index b5bbd22..c6579da 100755
--- a/examples/providers/event-listener-sysout/pom.xml
+++ b/examples/providers/event-listener-sysout/pom.xml
@@ -1,10 +1,10 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-        <artifactId>examples-providers-pom</artifactId>
+        <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
         <version>1.2.0.Beta1-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
+        <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Event Listener System.out Example</name>
     <description/>

diff --git a/examples/providers/event-store-mem/pom.xml b/examples/providers/event-store-mem/pom.xml
index c8d4174..7e657b1 100755
--- a/examples/providers/event-store-mem/pom.xml
+++ b/examples/providers/event-store-mem/pom.xml
@@ -1,10 +1,10 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-        <artifactId>examples-providers-pom</artifactId>
+        <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
         <version>1.2.0.Beta1-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
+        <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Event Store In-Mem Example</name>
     <description/>

diff --git a/examples/providers/federation-provider/pom.xml b/examples/providers/federation-provider/pom.xml
index ef8ddf3..eaa07d2 100755
--- a/examples/providers/federation-provider/pom.xml
+++ b/examples/providers/federation-provider/pom.xml
@@ -1,10 +1,10 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-        <artifactId>examples-providers-pom</artifactId>
+        <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
         <version>1.2.0.Beta1-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
+        <relativePath>../../../pom.xml</relativePath>
     </parent>
     <name>Properties Authentication Provider Example</name>
     <description/>

diff --git a/examples/providers/federation-provider/src/main/java/org/keycloak/examples/federation/properties/BasePropertiesFederationProvider.java b/examples/providers/federation-provider/src/main/java/org/keycloak/examples/federation/properties/BasePropertiesFederationProvider.java
index 0d63474..964560c 100755
--- a/examples/providers/federation-provider/src/main/java/org/keycloak/examples/federation/properties/BasePropertiesFederationProvider.java
+++ b/examples/providers/federation-provider/src/main/java/org/keycloak/examples/federation/properties/BasePropertiesFederationProvider.java
@@ -1,5 +1,6 @@
 package org.keycloak.examples.federation.properties;
 
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -128,6 +129,11 @@ public abstract class BasePropertiesFederationProvider implements UserFederation
     }
 
     @Override
+    public Set<String> getSupportedCredentialTypes() {
+        return supportedCredentialTypes;
+    }
+
+    @Override
     public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
         for (UserCredentialModel cred : input) {
             if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
@@ -156,6 +162,11 @@ public abstract class BasePropertiesFederationProvider implements UserFederation
     }
 
     @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel credential) {
+        return CredentialValidationOutput.failed();
+    }
+
+    @Override
     public void close() {
 
     }

diff --git a/examples/providers/pom.xml b/examples/providers/pom.xml
index 2dbe041..0459b74 100755
--- a/examples/providers/pom.xml
+++ b/examples/providers/pom.xml
@@ -1,11 +1,13 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
     <parent>
-        <artifactId>examples-pom</artifactId>
+        <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
         <version>1.2.0.Beta1-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
+        <relativePath>../../pom.xml</relativePath>
     </parent>
+
     <name>Provider Examples</name>
     <description/>
     <modelVersion>4.0.0</modelVersion>

diff --git a/examples/saml/pom.xml b/examples/saml/pom.xml
index bd10f77..6570429 100755
--- a/examples/saml/pom.xml
+++ b/examples/saml/pom.xml
@@ -1,10 +1,10 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <parent>
-        <artifactId>examples-pom</artifactId>
+        <artifactId>keycloak-parent</artifactId>
         <groupId>org.keycloak</groupId>
         <version>1.2.0.Beta1-SNAPSHOT</version>
-        <relativePath>../pom.xml</relativePath>
+        <relativePath>../../pom.xml</relativePath>
     </parent>
     <name>Provider Examples</name>
     <description/>

diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java
new file mode 100644
index 0000000..6515950
--- /dev/null
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/impl/KerberosUsernamePasswordAuthenticator.java
@@ -0,0 +1,126 @@
+package org.keycloak.federation.kerberos.impl;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.NameCallback;
+import javax.security.auth.callback.PasswordCallback;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.login.AppConfigurationEntry;
+import javax.security.auth.login.Configuration;
+import javax.security.auth.login.LoginContext;
+import javax.security.auth.login.LoginException;
+
+import org.jboss.logging.Logger;
+import org.keycloak.federation.kerberos.CommonKerberosConfig;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosUsernamePasswordAuthenticator {
+
+    private static final Logger logger = Logger.getLogger(KerberosUsernamePasswordAuthenticator.class);
+
+    private final CommonKerberosConfig config;
+
+    public KerberosUsernamePasswordAuthenticator(CommonKerberosConfig config) {
+        this.config = config;
+    }
+
+    /**
+     * Returns true if user with given username exists in kerberos database
+     *
+     * @param username username without Kerberos realm attached
+     * @return true if user available
+     */
+    public boolean isUserAvailable(String username) {
+        String principal = getKerberosPrincipal(username);
+
+        logger.debug("Checking existence of principal: " + principal);
+        try {
+            LoginContext loginContext = new LoginContext("does-not-matter", null,
+                    createJaasCallbackHandler(principal, "fake-password-which-nobody-has"),
+                    createJaasConfiguration());
+
+            loginContext.login();
+
+            throw new IllegalStateException("Didn't expect to end here");
+        } catch (LoginException le) {
+            String message = le.getMessage();
+            logger.debug("Message from kerberos: " + message);
+
+            // Bit cumbersome, but seems to work with tested kerberos servers
+            boolean exists = (!message.contains("Client not found"));
+            return exists;
+        }
+    }
+
+    /**
+     * Returns true if user was successfully authenticated against Kerberos
+     *
+     * @param username username without Kerberos realm attached
+     * @param password kerberos password
+     * @return  true if user was successfully authenticated
+     */
+    public boolean validUser(String username, String password) {
+        String principal = getKerberosPrincipal(username);
+
+        logger.debug("Validating password of principal: " + principal);
+        try {
+            LoginContext loginContext = new LoginContext("does-not-matter", null,
+                    createJaasCallbackHandler(principal, password),
+                    createJaasConfiguration());
+
+            loginContext.login();
+            logger.debug("Principal " + principal + " authenticated succesfully");
+
+            loginContext.logout();
+            return true;
+        } catch (LoginException le) {
+            logger.debug("Failed to authenticate user " + username, le);
+            return false;
+        }
+    }
+
+
+    protected String getKerberosPrincipal(String username) {
+        return username + "@" + config.getKerberosRealm();
+    }
+
+    protected CallbackHandler createJaasCallbackHandler(final String principal, final String password) {
+        return new CallbackHandler() {
+
+            @Override
+            public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
+                for (Callback callback : callbacks) {
+                    if (callback instanceof NameCallback) {
+                        NameCallback nameCallback = (NameCallback) callback;
+                        nameCallback.setName(principal);
+                    } else if (callback instanceof PasswordCallback) {
+                        PasswordCallback passwordCallback = (PasswordCallback) callback;
+                        passwordCallback.setPassword(password.toCharArray());
+                    } else {
+                        throw new UnsupportedCallbackException(callback, "Unsupported callback: " + callback.getClass().getCanonicalName());
+                    }
+                }
+            }
+        };
+    }
+
+    protected Configuration createJaasConfiguration() {
+        return new Configuration() {
+
+            @Override
+            public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
+                Map<String, Object> options = new HashMap<String, Object>();
+                options.put("storeKey", "true");
+                options.put("debug", String.valueOf(config.getDebug()));
+                AppConfigurationEntry kerberosLMConfiguration = new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule", AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, options);
+                return new AppConfigurationEntry[] { kerberosLMConfiguration };
+            }
+        };
+    }
+}

diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosConfig.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosConfig.java
new file mode 100644
index 0000000..950f9cd
--- /dev/null
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosConfig.java
@@ -0,0 +1,34 @@
+package org.keycloak.federation.kerberos;
+
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderModel;
+
+/**
+ * Configuration specific to {@link KerberosFederationProvider}
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosConfig extends CommonKerberosConfig {
+
+    public KerberosConfig(UserFederationProviderModel userFederationProvider) {
+        super(userFederationProvider);
+    }
+
+    public UserFederationProvider.EditMode getEditMode() {
+        String editModeString = getConfig().get("editMode");
+        if (editModeString == null) {
+            return UserFederationProvider.EditMode.UNSYNCED;
+        } else {
+            return UserFederationProvider.EditMode.valueOf(editModeString);
+        }
+    }
+
+    public boolean isAllowPasswordAuthentication() {
+        return Boolean.valueOf(getConfig().get("allowPasswordAuthentication"));
+    }
+
+    public boolean isUpdateProfileFirstLogin() {
+        return Boolean.valueOf(getConfig().get("updateProfileFirstLogin"));
+    }
+
+}

diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
new file mode 100644
index 0000000..35f5885
--- /dev/null
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProvider.java
@@ -0,0 +1,241 @@
+package org.keycloak.federation.kerberos;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.jboss.logging.Logger;
+import org.keycloak.federation.kerberos.impl.KerberosUsernamePasswordAuthenticator;
+import org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator;
+import org.keycloak.models.CredentialValidationOutput;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RoleModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserCredentialValueModel;
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KerberosConstants;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosFederationProvider implements UserFederationProvider {
+
+    private static final Logger logger = Logger.getLogger(KerberosFederationProvider.class);
+    public static final String KERBEROS_PRINCIPAL = "KERBEROS_PRINCIPAL";
+
+    protected KeycloakSession session;
+    protected UserFederationProviderModel model;
+    protected KerberosConfig kerberosConfig;
+    protected KerberosFederationProviderFactory factory;
+
+    public KerberosFederationProvider(KeycloakSession session,UserFederationProviderModel model, KerberosFederationProviderFactory factory) {
+        this.session = session;
+        this.model = model;
+        this.kerberosConfig = new KerberosConfig(model);
+        this.factory = factory;
+    }
+
+    @Override
+    public UserModel proxy(UserModel local) {
+        if (kerberosConfig.getEditMode() == EditMode.READ_ONLY) {
+            return new ReadOnlyKerberosUserModelDelegate(local, this);
+        } else {
+            return local;
+        }
+    }
+
+    @Override
+    public boolean synchronizeRegistrations() {
+        return false;
+    }
+
+    @Override
+    public UserModel register(RealmModel realm, UserModel user) {
+        return null;
+    }
+
+    @Override
+    public boolean removeUser(RealmModel realm, UserModel user) {
+        // TODO: Not sure if federation provider is expected to delete user in localStorage. Looks rather like a bug in UserFederationManager.removeUser .
+        return session.userStorage().removeUser(realm, user);
+    }
+
+    @Override
+    public UserModel getUserByUsername(RealmModel realm, String username) {
+        if (username.contains("@")) {
+            username = username.split("@")[0];
+        }
+
+        KerberosUsernamePasswordAuthenticator authenticator = factory.createKerberosUsernamePasswordAuthenticator(kerberosConfig);
+        if (authenticator.isUserAvailable(username)) {
+            return findOrCreateAuthenticatedUser(realm, username);
+        } else {
+            return null;
+        }
+    }
+
+    @Override
+    public UserModel getUserByEmail(RealmModel realm, String email) {
+        return null;
+    }
+
+    @Override
+    public List<UserModel> searchByAttributes(Map<String, String> attributes, RealmModel realm, int maxResults) {
+        return Collections.emptyList();
+    }
+
+    @Override
+    public void preRemove(RealmModel realm) {
+
+    }
+
+    @Override
+    public void preRemove(RealmModel realm, RoleModel role) {
+
+    }
+
+    @Override
+    public boolean isValid(UserModel local) {
+        // KerberosUsernamePasswordAuthenticator.isUserAvailable is an overhead, so avoid it for now
+
+        String kerberosPrincipal = local.getUsername() + "@" + kerberosConfig.getKerberosRealm();
+        return model.getId().equals(local.getFederationLink()) && kerberosPrincipal.equals(local.getAttribute(KERBEROS_PRINCIPAL));
+    }
+
+    @Override
+    public Set<String> getSupportedCredentialTypes(UserModel local) {
+        Set<String> supportedCredTypes = new HashSet<String>();
+        supportedCredTypes.add(UserCredentialModel.KERBEROS);
+
+        if (kerberosConfig.isAllowPasswordAuthentication()) {
+            boolean passwordSupported = true;
+            if (kerberosConfig.getEditMode() == EditMode.UNSYNCED ) {
+
+                // Password from KC database has preference over kerberos password
+                for (UserCredentialValueModel cred : local.getCredentialsDirectly()) {
+                    if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                        passwordSupported = false;
+                    }
+                }
+            }
+
+            if (passwordSupported) {
+                supportedCredTypes.add(UserCredentialModel.PASSWORD);
+            }
+        }
+
+        return supportedCredTypes;
+    }
+
+    @Override
+    public Set<String> getSupportedCredentialTypes() {
+        Set<String> supportedCredTypes = new HashSet<String>();
+        supportedCredTypes.add(UserCredentialModel.KERBEROS);
+        return supportedCredTypes;
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
+        for (UserCredentialModel cred : input) {
+            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
+                return validPassword(user.getUsername(), cred.getValue());
+            } else {
+                return false; // invalid cred type
+            }
+        }
+        return true;
+    }
+
+    protected boolean validPassword(String username, String password) {
+        if (kerberosConfig.isAllowPasswordAuthentication()) {
+            KerberosUsernamePasswordAuthenticator authenticator = factory.createKerberosUsernamePasswordAuthenticator(kerberosConfig);
+            return authenticator.validUser(username, password);
+        } else {
+            return false;
+        }
+    }
+
+    @Override
+    public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
+        return validCredentials(realm, user, Arrays.asList(input));
+    }
+
+    @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel credential) {
+        if (credential.getType().equals(UserCredentialModel.KERBEROS)) {
+            String spnegoToken = credential.getValue();
+            SPNEGOAuthenticator spnegoAuthenticator = factory.createSPNEGOAuthenticator(spnegoToken, kerberosConfig);
+
+            spnegoAuthenticator.authenticate();
+
+            if (spnegoAuthenticator.isAuthenticated()) {
+                Map<String, Object> state = new HashMap<String, Object>();
+                state.put(KerberosConstants.GSS_DELEGATION_CREDENTIAL, spnegoAuthenticator.getDelegationCredential());
+
+                String username = spnegoAuthenticator.getAuthenticatedUsername();
+                UserModel user = findOrCreateAuthenticatedUser(realm, username);
+
+                return new CredentialValidationOutput(user, CredentialValidationOutput.Status.AUTHENTICATED, state);
+            }  else {
+                Map<String, Object> state = new HashMap<String, Object>();
+                state.put(KerberosConstants.RESPONSE_TOKEN, spnegoAuthenticator.getResponseToken());
+                return new CredentialValidationOutput(null, CredentialValidationOutput.Status.CONTINUE, state);
+            }
+
+        } else {
+            return CredentialValidationOutput.failed();
+        }
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    /**
+     * Called after successful authentication
+     *
+     * @param realm
+     * @param username username without realm prefix
+     * @return
+     */
+    protected UserModel findOrCreateAuthenticatedUser(RealmModel realm, String username) {
+        UserModel user = session.userStorage().getUserByUsername(username, realm);
+        if (user != null) {
+            logger.debug("Kerberos authenticated user " + username + " found in Keycloak storage");
+            if (!isValid(user)) {
+                throw new IllegalStateException("User with username " + username + " already exists, but is not linked to provider [" + model.getDisplayName() +
+                        "] or kerberos principal is not correct. Kerberos principal on user is: " + user.getAttribute(KERBEROS_PRINCIPAL));
+            }
+
+            return proxy(user);
+        } else {
+            return importUserToKeycloak(realm, username);
+        }
+    }
+
+    protected UserModel importUserToKeycloak(RealmModel realm, String username) {
+        // Just guessing email from kerberos realm
+        String email = username + "@" + kerberosConfig.getKerberosRealm().toLowerCase();
+
+        logger.info("Creating kerberos user: " + username + ", email: " + email + " to local Keycloak storage");
+        UserModel user = session.userStorage().addUser(realm, username);
+        user.setEnabled(true);
+        user.setEmail(email);
+        user.setFederationLink(model.getId());
+        user.setAttribute(KERBEROS_PRINCIPAL, username + "@" + kerberosConfig.getKerberosRealm());
+
+        if (kerberosConfig.isUpdateProfileFirstLogin()) {
+            user.addRequiredAction(UserModel.RequiredAction.UPDATE_PROFILE);
+        }
+
+        return proxy(user);
+    }
+}

diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProviderFactory.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProviderFactory.java
new file mode 100644
index 0000000..871587c
--- /dev/null
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/KerberosFederationProviderFactory.java
@@ -0,0 +1,80 @@
+package org.keycloak.federation.kerberos;
+
+import java.util.Collections;
+import java.util.Date;
+import java.util.Set;
+
+import org.jboss.logging.Logger;
+import org.keycloak.Config;
+import org.keycloak.federation.kerberos.impl.KerberosServerSubjectAuthenticator;
+import org.keycloak.federation.kerberos.impl.KerberosUsernamePasswordAuthenticator;
+import org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.models.UserFederationProvider;
+import org.keycloak.models.UserFederationProviderFactory;
+import org.keycloak.models.UserFederationProviderModel;
+
+/**
+ * Factory for standalone Kerberos federation provider. Standalone means that it's not backed by LDAP. For Kerberos backed by LDAP (like MS AD or ApacheDS environment)
+ * you should rather use LDAP Federation Provider.
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosFederationProviderFactory implements UserFederationProviderFactory {
+
+    private static final Logger logger = Logger.getLogger(KerberosFederationProviderFactory.class);
+    public static final String PROVIDER_NAME = "kerberos";
+    @Override
+    public UserFederationProvider getInstance(KeycloakSession session, UserFederationProviderModel model) {
+        return new KerberosFederationProvider(session, model, this);
+    }
+
+    @Override
+    public Set<String> getConfigurationOptions() {
+        return Collections.emptySet();
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_NAME;
+    }
+
+    @Override
+    public void syncAllUsers(KeycloakSessionFactory sessionFactory, String realmId, UserFederationProviderModel model) {
+        logger.warn("Sync users not supported for this provider");
+    }
+
+    @Override
+    public void syncChangedUsers(KeycloakSessionFactory sessionFactory, String realmId, UserFederationProviderModel model, Date lastSync) {
+        logger.warn("Sync users not supported for this provider");
+    }
+
+    @Override
+    public UserFederationProvider create(KeycloakSession session) {
+        throw new IllegalAccessError("Illegal to call this method");
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+
+    }
+
+    @Override
+    public void close() {
+
+    }
+
+    protected SPNEGOAuthenticator createSPNEGOAuthenticator(String spnegoToken, CommonKerberosConfig kerberosConfig) {
+        KerberosServerSubjectAuthenticator kerberosAuth = createKerberosSubjectAuthenticator(kerberosConfig);
+        return new SPNEGOAuthenticator(kerberosConfig, kerberosAuth, spnegoToken);
+    }
+
+    protected KerberosServerSubjectAuthenticator createKerberosSubjectAuthenticator(CommonKerberosConfig kerberosConfig) {
+        return new KerberosServerSubjectAuthenticator(kerberosConfig);
+    }
+
+    protected KerberosUsernamePasswordAuthenticator createKerberosUsernamePasswordAuthenticator(CommonKerberosConfig kerberosConfig) {
+        return new KerberosUsernamePasswordAuthenticator(kerberosConfig);
+    }
+}

diff --git a/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/ReadOnlyKerberosUserModelDelegate.java b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/ReadOnlyKerberosUserModelDelegate.java
new file mode 100644
index 0000000..7ac3ca7
--- /dev/null
+++ b/federation/kerberos/src/main/java/org/keycloak/federation/kerberos/ReadOnlyKerberosUserModelDelegate.java
@@ -0,0 +1,28 @@
+package org.keycloak.federation.kerberos;
+
+import org.keycloak.models.ModelReadOnlyException;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.UserModelDelegate;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class ReadOnlyKerberosUserModelDelegate extends UserModelDelegate {
+
+    protected KerberosFederationProvider provider;
+
+    public ReadOnlyKerberosUserModelDelegate(UserModel delegate, KerberosFederationProvider provider) {
+        super(delegate);
+        this.provider = provider;
+    }
+
+    @Override
+    public void updateCredential(UserCredentialModel cred) {
+        if (provider.getSupportedCredentialTypes(delegate).contains(cred.getType())) {
+            throw new ModelReadOnlyException("Can't change password in Keycloak database. Change password with your Kerberos server");
+        }
+
+        delegate.updateCredential(cred);
+    }
+}

diff --git a/federation/kerberos/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory b/federation/kerberos/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory
new file mode 100644
index 0000000..040f5c9
--- /dev/null
+++ b/federation/kerberos/src/main/resources/META-INF/services/org.keycloak.models.UserFederationProviderFactory
@@ -0,0 +1 @@
+org.keycloak.federation.kerberos.KerberosFederationProviderFactory
\ No newline at end of file

diff --git a/federation/ldap/pom.xml b/federation/ldap/pom.xml
index 7149e43..a449335 100755
--- a/federation/ldap/pom.xml
+++ b/federation/ldap/pom.xml
@@ -27,6 +27,12 @@
         </dependency>
         <dependency>
             <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-kerberos-federation</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
             <artifactId>keycloak-picketlink-api</artifactId>
             <version>${project.version}</version>
             <scope>provided</scope>

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/kerberos/LDAPProviderKerberosConfig.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/kerberos/LDAPProviderKerberosConfig.java
new file mode 100644
index 0000000..b98c5ca
--- /dev/null
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/kerberos/LDAPProviderKerberosConfig.java
@@ -0,0 +1,20 @@
+package org.keycloak.federation.ldap.kerberos;
+
+import org.keycloak.federation.kerberos.CommonKerberosConfig;
+import org.keycloak.models.UserFederationProviderModel;
+
+/**
+ * Configuration specific to {@link org.keycloak.federation.ldap.LDAPFederationProvider}
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class LDAPProviderKerberosConfig extends CommonKerberosConfig {
+
+    public LDAPProviderKerberosConfig(UserFederationProviderModel userFederationProvider) {
+        super(userFederationProvider);
+    }
+
+    public boolean isUseKerberosForPasswordAuthentication() {
+        return Boolean.valueOf(getConfig().get("useKerberosForPasswordAuthentication"));
+    }
+}

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
index a49a989..9a92604 100755
--- a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProvider.java
@@ -1,6 +1,10 @@
 package org.keycloak.federation.ldap;
 
 import org.jboss.logging.Logger;
+import org.keycloak.federation.kerberos.impl.KerberosUsernamePasswordAuthenticator;
+import org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator;
+import org.keycloak.federation.ldap.kerberos.LDAPProviderKerberosConfig;
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.ModelException;
 import org.keycloak.models.RealmModel;
@@ -10,6 +14,7 @@ import org.keycloak.models.UserCredentialValueModel;
 import org.keycloak.models.UserFederationProvider;
 import org.keycloak.models.UserFederationProviderModel;
 import org.keycloak.models.UserModel;
+import org.keycloak.models.utils.KerberosConstants;
 import org.picketlink.idm.IdentityManagementException;
 import org.picketlink.idm.IdentityManager;
 import org.picketlink.idm.PartitionManager;
@@ -17,7 +22,7 @@ import org.picketlink.idm.model.basic.BasicModel;
 import org.picketlink.idm.model.basic.User;
 import org.picketlink.idm.query.IdentityQuery;
 
-import java.util.Collections;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.LinkedList;
@@ -36,28 +41,32 @@ public class LDAPFederationProvider implements UserFederationProvider {
     public static final String SYNC_REGISTRATIONS = "syncRegistrations";
     public static final String EDIT_MODE = "editMode";
 
+    protected LDAPFederationProviderFactory factory;
     protected KeycloakSession session;
     protected UserFederationProviderModel model;
     protected PartitionManager partitionManager;
     protected EditMode editMode;
+    protected LDAPProviderKerberosConfig kerberosConfig;
 
-    protected static final Set<String> supportedCredentialTypes = new HashSet<String>();
+    protected final Set<String> supportedCredentialTypes = new HashSet<String>();
 
-    static
-    {
-        supportedCredentialTypes.add(UserCredentialModel.PASSWORD);
-    }
-
-    public LDAPFederationProvider(KeycloakSession session, UserFederationProviderModel model, PartitionManager partitionManager) {
+    public LDAPFederationProvider(LDAPFederationProviderFactory factory, KeycloakSession session, UserFederationProviderModel model, PartitionManager partitionManager) {
+        this.factory = factory;
         this.session = session;
         this.model = model;
         this.partitionManager = partitionManager;
+        this.kerberosConfig = new LDAPProviderKerberosConfig(model);
         String editModeString = model.getConfig().get(EDIT_MODE);
         if (editModeString == null) {
             editMode = EditMode.READ_ONLY;
         } else {
             editMode = EditMode.valueOf(editModeString);
         }
+
+        supportedCredentialTypes.add(UserCredentialModel.PASSWORD);
+        if (kerberosConfig.isAllowKerberosAuthentication()) {
+            supportedCredentialTypes.add(UserCredentialModel.KERBEROS);
+        }
     }
 
     private ModelException convertIDMException(IdentityManagementException ie) {
@@ -97,10 +106,12 @@ public class LDAPFederationProvider implements UserFederationProvider {
 
     @Override
     public Set<String> getSupportedCredentialTypes(UserModel local) {
+        Set<String> supportedCredentialTypes = new HashSet<String>(this.supportedCredentialTypes);
         if (editMode == EditMode.UNSYNCED ) {
             for (UserCredentialValueModel cred : local.getCredentialsDirectly()) {
                 if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
-                    return Collections.emptySet();
+                    // User has changed password in KC local database. Use KC password instead of LDAP password
+                    supportedCredentialTypes.remove(UserCredentialModel.PASSWORD);
                 }
             }
         }
@@ -108,6 +119,11 @@ public class LDAPFederationProvider implements UserFederationProvider {
     }
 
     @Override
+    public Set<String> getSupportedCredentialTypes() {
+        return new HashSet<String>(this.supportedCredentialTypes);
+    }
+
+    @Override
     public boolean synchronizeRegistrations() {
         return "true".equalsIgnoreCase(model.getConfig().get(SYNC_REGISTRATIONS)) && editMode == EditMode.WRITABLE;
     }
@@ -244,6 +260,8 @@ public class LDAPFederationProvider implements UserFederationProvider {
         imported.setLastName(picketlinkUser.getLastName());
         imported.setFederationLink(model.getId());
         imported.setAttribute(LDAP_ID, picketlinkUser.getId());
+
+        logger.debugf("Added new user from LDAP. Username: " + imported.getUsername() + ", Email: ", imported.getEmail() + ", LDAP_ID: " + picketlinkUser.getId());
         return proxy(imported);
     }
 
@@ -285,10 +303,17 @@ public class LDAPFederationProvider implements UserFederationProvider {
     }
 
     public boolean validPassword(String username, String password) {
-        try {
-            return LDAPUtils.validatePassword(partitionManager, username, password);
-        } catch (IdentityManagementException ie) {
-            throw convertIDMException(ie);
+        if (kerberosConfig.isAllowKerberosAuthentication() && kerberosConfig.isUseKerberosForPasswordAuthentication()) {
+            // Use Kerberos JAAS (Krb5LoginModule)
+            KerberosUsernamePasswordAuthenticator authenticator = factory.createKerberosUsernamePasswordAuthenticator(kerberosConfig);
+            return authenticator.validUser(username, password);
+        } else {
+            // Use Naming LDAP API
+            try {
+                return LDAPUtils.validatePassword(partitionManager, username, password);
+            } catch (IdentityManagementException ie) {
+                throw convertIDMException(ie);
+            }
         }
     }
 
@@ -307,14 +332,37 @@ public class LDAPFederationProvider implements UserFederationProvider {
 
     @Override
     public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
-        for (UserCredentialModel cred : input) {
-            if (cred.getType().equals(UserCredentialModel.PASSWORD)) {
-                return validPassword(user.getUsername(), cred.getValue());
-            } else {
-                return false; // invalid cred type
+        return validCredentials(realm, user, Arrays.asList(input));
+    }
+
+    @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel credential) {
+        if (credential.getType().equals(UserCredentialModel.KERBEROS)) {
+            if (kerberosConfig.isAllowKerberosAuthentication()) {
+                String spnegoToken = credential.getValue();
+                SPNEGOAuthenticator spnegoAuthenticator = factory.createSPNEGOAuthenticator(spnegoToken, kerberosConfig);
+
+                spnegoAuthenticator.authenticate();
+
+                if (spnegoAuthenticator.isAuthenticated()) {
+                    Map<String, Object> state = new HashMap<String, Object>();
+                    state.put(KerberosConstants.GSS_DELEGATION_CREDENTIAL, spnegoAuthenticator.getDelegationCredential());
+
+                    // TODO: This assumes that LDAP "uid" is equal to kerberos principal name. Like uid "hnelson" and kerberos principal "hnelson@KEYCLOAK.ORG".
+                    // Check if it's correct or if LDAP attribute for mapping kerberos principal should be available (For ApacheDS it seems to be attribute "krb5PrincipalName" but on MSAD it's likely different)
+                    String username = spnegoAuthenticator.getAuthenticatedUsername();
+                    UserModel user = findOrCreateAuthenticatedUser(realm, username);
+
+                    return new CredentialValidationOutput(user, CredentialValidationOutput.Status.AUTHENTICATED, state);
+                }  else {
+                    Map<String, Object> state = new HashMap<String, Object>();
+                    state.put(KerberosConstants.RESPONSE_TOKEN, spnegoAuthenticator.getResponseToken());
+                    return new CredentialValidationOutput(null, CredentialValidationOutput.Status.CONTINUE, state);
+                }
             }
         }
-        return true;
+
+        return CredentialValidationOutput.failed();
     }
 
     @Override
@@ -330,7 +378,6 @@ public class LDAPFederationProvider implements UserFederationProvider {
             if (currentUser == null) {
                 // Add new user to Keycloak
                 importUserFromPicketlink(realm, picketlinkUser);
-                logger.debugf("Added new user from LDAP: %s", username);
             } else {
                 if ((fedModel.getId().equals(currentUser.getFederationLink())) && (picketlinkUser.getId().equals(currentUser.getAttribute(LDAPFederationProvider.LDAP_ID)))) {
                     // Update keycloak user
@@ -345,4 +392,27 @@ public class LDAPFederationProvider implements UserFederationProvider {
             }
         }
     }
+
+    /**
+     * Called after successful kerberos authentication
+     *
+     * @param realm
+     * @param username username without realm prefix
+     * @return
+     */
+    protected UserModel findOrCreateAuthenticatedUser(RealmModel realm, String username) {
+        UserModel user = session.userStorage().getUserByUsername(username, realm);
+        if (user != null) {
+            logger.debug("Kerberos authenticated user " + username + " found in Keycloak storage");
+            if (!isValid(user)) {
+                throw new IllegalStateException("User with username " + username + " already exists, but is not linked to provider [" + model.getDisplayName() +
+                        "] or LDAP_ID is not correct. LDAP_ID on user is: " + user.getAttribute(LDAP_ID));
+            }
+
+            return proxy(user);
+        } else {
+            // Creating user to local storage
+            return getUserByUsername(realm, username);
+        }
+    }
 }

diff --git a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java
index 44987e9..16a877f 100755
--- a/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java
+++ b/federation/ldap/src/main/java/org/keycloak/federation/ldap/LDAPFederationProviderFactory.java
@@ -2,6 +2,11 @@ package org.keycloak.federation.ldap;
 
 import org.jboss.logging.Logger;
 import org.keycloak.Config;
+import org.keycloak.federation.kerberos.CommonKerberosConfig;
+import org.keycloak.federation.kerberos.KerberosConfig;
+import org.keycloak.federation.kerberos.impl.KerberosServerSubjectAuthenticator;
+import org.keycloak.federation.kerberos.impl.KerberosUsernamePasswordAuthenticator;
+import org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
 import org.keycloak.models.KeycloakSessionTask;
@@ -45,7 +50,7 @@ public class LDAPFederationProviderFactory implements UserFederationProviderFact
     public LDAPFederationProvider getInstance(KeycloakSession session, UserFederationProviderModel model) {
         PartitionManagerProvider idmProvider = session.getProvider(PartitionManagerProvider.class);
         PartitionManager partition = idmProvider.getPartitionManager(model);
-        return new LDAPFederationProvider(session, model, partition);
+        return new LDAPFederationProvider(this, session, model, partition);
     }
 
     @Override
@@ -140,4 +145,17 @@ public class LDAPFederationProviderFactory implements UserFederationProviderFact
         LDAPFederationProvider ldapFedProvider = getInstance(session, fedModel);
         ldapFedProvider.importPicketlinkUsers(realm, users, fedModel);
     }
+
+    protected SPNEGOAuthenticator createSPNEGOAuthenticator(String spnegoToken, CommonKerberosConfig kerberosConfig) {
+        KerberosServerSubjectAuthenticator kerberosAuth = createKerberosSubjectAuthenticator(kerberosConfig);
+        return new SPNEGOAuthenticator(kerberosConfig, kerberosAuth, spnegoToken);
+    }
+
+    protected KerberosServerSubjectAuthenticator createKerberosSubjectAuthenticator(CommonKerberosConfig kerberosConfig) {
+        return new KerberosServerSubjectAuthenticator(kerberosConfig);
+    }
+
+    protected KerberosUsernamePasswordAuthenticator createKerberosUsernamePasswordAuthenticator(CommonKerberosConfig kerberosConfig) {
+        return new KerberosUsernamePasswordAuthenticator(kerberosConfig);
+    }
 }

diff --git a/federation/pom.xml b/federation/pom.xml
index b990d51..7c1487a 100755
--- a/federation/pom.xml
+++ b/federation/pom.xml
@@ -17,6 +17,7 @@
 
     <modules>
         <module>ldap</module>
+        <module>kerberos</module>
     </modules>
 
 </project>

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/app.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/app.js
index 7a31d03..054c218 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/app.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/app.js
@@ -875,6 +875,36 @@ module.config([ '$routeProvider', function($routeProvider) {
             },
             controller : 'LDAPCtrl'
         })
+        .when('/realms/:realm/user-federation/providers/kerberos/:instance', {
+            templateUrl : 'partials/federated-kerberos.html',
+            resolve : {
+                realm : function(RealmLoader) {
+                    return RealmLoader();
+                },
+                instance : function(UserFederationInstanceLoader) {
+                    return UserFederationInstanceLoader();
+                },
+                providerFactory : function() {
+                    return { id: "kerberos" };
+                }
+            },
+            controller : 'GenericUserFederationCtrl'
+        })
+        .when('/create/user-federation/:realm/providers/kerberos', {
+            templateUrl : 'partials/federated-kerberos.html',
+            resolve : {
+                realm : function(RealmLoader) {
+                    return RealmLoader();
+                },
+                instance : function() {
+                    return {};
+                },
+                providerFactory : function() {
+                    return { id: "kerberos" };
+                }
+            },
+            controller : 'GenericUserFederationCtrl'
+        })
         .when('/create/user-federation/:realm/providers/:provider', {
             templateUrl : 'partials/federated-generic.html',
             resolve : {
@@ -1101,7 +1131,7 @@ module.directive('onoffswitch', function() {
  *
  * Usage: <input ng-model="mmm" name="nnn" id="iii" kc-onoffswitch-model [on-text="ooo" off-text="fff"] />
  */
-module.directive('kc-onoffswitch-model', function() {
+module.directive('onoffswitchmodel', function() {
     return {
         restrict: "EA",
         replace: true,

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/realm.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/realm.js
index 5c25e1b..52b313a 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/realm.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/realm.js
@@ -435,7 +435,7 @@ module.controller('RealmRequiredCredentialsCtrl', function($scope, Realm, realm,
     $scope.userCredentialOptions = {
         'multiple' : true,
         'simple_tags' : true,
-        'tags' : ['password', 'totp', 'cert']
+        'tags' : ['password', 'totp', 'cert', 'kerberos']
     };
 
     $scope.changed = false;
@@ -653,8 +653,7 @@ module.controller('RealmIdentityProviderCtrl', function($scope, $filter, $upload
         $scope.identityProvider.name = providerFactory.name;
         $scope.identityProvider.enabled = true;
         $scope.identityProvider.updateProfileFirstLogin = true;
-        // Kerberos is suggested as default provider, others not
-        $scope.identityProvider.authenticateByDefault = (providerFactory.id === "kerberos");
+        $scope.identityProvider.authenticateByDefault = false;
         $scope.newIdentityProvider = true;
     }
 

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
index 1f36f90..fb0ce1b 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/js/controllers/users.js
@@ -378,9 +378,23 @@ module.controller('GenericUserFederationCtrl', function($scope, $location, Notif
             instance.priority = 0;
             $scope.fullSyncEnabled = false;
             $scope.changedSyncEnabled = false;
+
+            if (providerFactory.id === 'kerberos') {
+                instance.config.debug = false;
+                instance.config.allowPasswordAuthentication = true;
+                instance.config.editMode = 'UNSYNCED';
+                instance.config.updateProfileFirstLogin = true;
+                instance.config.allowKerberosAuthentication = true;
+            }
         } else {
             $scope.fullSyncEnabled = (instance.fullSyncPeriod && instance.fullSyncPeriod > 0);
             $scope.changedSyncEnabled = (instance.changedSyncPeriod && instance.changedSyncPeriod > 0);
+
+            if (providerFactory.id === 'kerberos') {
+                instance.config.debug = (instance.config.debug === 'true' || instance.config.debug === true);
+                instance.config.allowPasswordAuthentication = (instance.config.allowPasswordAuthentication === 'true' || instance.config.allowPasswordAuthentication === true);
+                instance.config.updateProfileFirstLogin = (instance.config.updateProfileFirstLogin === 'true' || instance.config.updateProfileFirstLogin === true);
+            }
         }
 
         $scope.changed = false;
@@ -488,25 +502,30 @@ module.controller('LDAPCtrl', function($scope, $location, Notifications, Dialog,
             instance.providerName = "ldap";
             instance.config = {};
             instance.priority = 0;
-            $scope.syncRegistrations = false;
 
-            $scope.userAccountControlsAfterPasswordUpdate = true;
-            instance.config.userAccountControlsAfterPasswordUpdate = "true";
+            instance.config.syncRegistrations = false;
+            instance.config.userAccountControlsAfterPasswordUpdate = true;
+            instance.config.connectionPooling = true;
+            instance.config.pagination = true;
 
-            $scope.connectionPooling = true;
-            instance.config.connectionPooling = "true";
+            instance.config.allowKerberosAuthentication = false;
+            instance.config.debug = false;
+            instance.config.useKerberosForPasswordAuthentication = false;
 
-            $scope.pagination = true;
-            instance.config.pagination = "true";
             instance.config.batchSizeForSync = DEFAULT_BATCH_SIZE;
 
             $scope.fullSyncEnabled = false;
             $scope.changedSyncEnabled = false;
         } else {
-            $scope.syncRegistrations = instance.config.syncRegistrations && instance.config.syncRegistrations == "true";
-            $scope.userAccountControlsAfterPasswordUpdate = instance.config.userAccountControlsAfterPasswordUpdate && instance.config.userAccountControlsAfterPasswordUpdate == "true";
-            $scope.connectionPooling = instance.config.connectionPooling && instance.config.connectionPooling == "true";
-            $scope.pagination = instance.config.pagination && instance.config.pagination == "true";
+            instance.config.syncRegistrations = (instance.config.syncRegistrations === 'true' || instance.config.syncRegistrations === true);
+            instance.config.userAccountControlsAfterPasswordUpdate = (instance.config.userAccountControlsAfterPasswordUpdate === 'true' || instance.config.userAccountControlsAfterPasswordUpdate === true);
+            instance.config.connectionPooling = (instance.config.connectionPooling === 'true' || instance.config.connectionPooling === true);
+            instance.config.pagination = (instance.config.pagination === 'true' || instance.config.pagination === true);
+
+            instance.config.allowKerberosAuthentication = (instance.config.allowKerberosAuthentication === 'true' || instance.config.allowKerberosAuthentication === true);
+            instance.config.debug = (instance.config.debug === 'true' || instance.config.debug === true);
+            instance.config.useKerberosForPasswordAuthentication = (instance.config.useKerberosForPasswordAuthentication === 'true' || instance.config.useKerberosForPasswordAuthentication === true);
+
             if (!instance.config.batchSizeForSync) {
                 instance.config.batchSizeForSync = DEFAULT_BATCH_SIZE;
             }
@@ -534,21 +553,6 @@ module.controller('LDAPCtrl', function($scope, $location, Notifications, Dialog,
 
     $scope.realm = realm;
 
-    function watchBooleanProperty(propertyName) {
-        $scope.$watch(propertyName, function() {
-            if ($scope[propertyName]) {
-                $scope.instance.config[propertyName] = "true";
-            } else {
-                $scope.instance.config[propertyName] = "false";
-            }
-        })
-    }
-
-    watchBooleanProperty('syncRegistrations');
-    watchBooleanProperty('userAccountControlsAfterPasswordUpdate');
-    watchBooleanProperty('connectionPooling');
-    watchBooleanProperty('pagination');
-
     $scope.$watch('fullSyncEnabled', function(newVal, oldVal) {
         if (oldVal == newVal) {
             return;

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-identity-provider.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-identity-provider.html
index 6c90ef2..94d79be 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-identity-provider.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-identity-provider.html
@@ -7,13 +7,13 @@
             <li><a href="#/realms/{{realm.realm}}/applications/{{application.id}}">{{application.name}}</a></li>
             <li class="active">Identity Provider</li>
         </ol>
-        <h2 data-ng-hide="create"><span>{{application.name}}</span> Identity Provider Settings</h2>
+        <h2 data-ng-hide="create"><span>{{application.name}}</span> Identity Provider Settings<span tooltip-placement="right" tooltip="Select which identity providers can be used for this application. By default, all identity providers are enabled. Select one or more to restrict." class="fa fa-info-circle"></span></h2>
         <form class="form-horizontal" name="identityProviderForm" novalidate>
             <div class="form-group" ng-repeat="identityProvider in identityProviders">
                 <legend><span class="text">{{identityProvider.name}}</span></legend>
                 <label class="col-sm-2 control-label" for="{{identityProvider.id}}">Enable</label>
                 <div class="col-sm-4">
-                    <input ng-model="application.allowedIdentityProviders[$index]" name="identityProvider.id" id="identityProvider.id" value="identityProvider.id" kc-onoffswitch-model />
+                    <input ng-model="application.allowedIdentityProviders[$index]" name="identityProvider.id" id="identityProvider.id" value="identityProvider.id" onoffswitchmodel />
                 </div>
             </div>
             <div class="pull-right form-actions">

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-kerberos.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-kerberos.html
new file mode 100644
index 0000000..1b30221
--- /dev/null
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-kerberos.html
@@ -0,0 +1,118 @@
+<div class="bs-sidebar col-sm-3 " data-ng-include data-src="'partials/realm-menu.html'"></div>
+<div id="content-area" class="col-sm-9" role="main">
+    <ul class="nav nav-tabs nav-tabs-pf">
+        <li><a href="#/realms/{{realm.realm}}/users">User List</a></li>
+        <li><a href="#/realms/{{realm.realm}}/user-federation">Federation</a></li>
+    </ul>
+    <div id="content">
+        <ol class="breadcrumb" data-ng-hide="create">
+            <li><a href="#/realms/{{realm.realm}}/user-federation">Federation Providers</a></li>
+            <li><a href="#/realms/{{realm.realm}}/user-federation/providers/{{instance.providerName}}/{{instance.id}}">{{instance.displayName}}</a></li>
+            <li class="active">Kerberos Settings</li>
+        </ol>
+        <ol class="breadcrumb" data-ng-show="create">
+            <li><a href="#/realms/{{realm.realm}}/user-federation">Federation Providers</a></li>
+            <li class="active">Add Kerberos Provider</li>
+        </ol>
+        <h2 class="pull-left" data-ng-hide="create">Kerberos Provider Settings <span tooltip-placement="right" tooltip="Use Kerberos federation provider just if you don't need Kerberos integrated with LDAP! For Kerberos+LDAP use LDAP Federation provider instead"
+                                                                                     class="fa fa-info-circle"></span></h2>
+        <h2 class="pull-left" data-ng-show="create">Add Standalone Kerberos Provider <span tooltip-placement="right" tooltip="Use Kerberos federation provider just if you don't need Kerberos integrated with LDAP! For Kerberos+LDAP use LDAP Federation provider instead"
+                                                                                           class="fa fa-info-circle"></span></h2>
+        <p class="subtitle"><span class="required">*</span> Required fields</p>
+        <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
+
+            <fieldset>
+                <legend><span class="text">Required Settings</span></legend>
+                <div class="form-group clearfix" data-ng-show="!create">
+                    <label class="col-sm-2 control-label" for="providerId">Provider ID </label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="providerId" type="text" ng-model="instance.id" readonly>
+                    </div>
+                </div>
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="consoleDisplayName">Console display name </label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="consoleDisplayName" type="text" ng-model="instance.displayName" placeholder="defaults to id">
+                    </div>
+                    <span tooltip-placement="right" tooltip="Display name of provider when linked in admin console." class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="priority">Priority </label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="priority" type="text" ng-model="instance.priority">
+                    </div>
+                    <span tooltip-placement="right" tooltip="Priority of provider when doing a user lookup.  Lowest first." class="fa fa-info-circle"></span>
+                </div>
+
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="kerberosRealm">Kerberos Realm <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="kerberosRealm" type="text" ng-model="instance.config.kerberosRealm" required>
+                    </div>
+                    <span tooltip-placement="right" tooltip="Name of kerberos realm. For example FOO.ORG" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="serverPrincipal">Server principal <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="serverPrincipal" type="text" ng-model="instance.config.serverPrincipal" required>
+                    </div>
+                    <span tooltip-placement="right" tooltip="Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix">
+                    <label class="col-sm-2 control-label" for="keyTab">KeyTab <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="keyTab" type="text" ng-model="instance.config.keyTab" required>
+                    </div>
+                    <span tooltip-placement="right" tooltip="Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group">
+                    <label class="col-sm-2 control-label" for="debug">Debug </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.debug" id="debug" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Enable/disable debug logging to standard output for Krb5LoginModule." class="fa fa-info-circle"></span>
+                </div>
+
+                <div class="form-group">
+                    <label class="col-sm-2 control-label" for="allowPasswordAuthentication">Allow Password Authentication </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.allowPasswordAuthentication" id="allowPasswordAuthentication" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Enable/disable possibility of username/password authentication against Kerberos database" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group" data-ng-show="instance.config.allowPasswordAuthentication">
+                    <label class="col-sm-2 control-label" for="editMode">Edit mode</label>
+                    <div class="col-sm-4">
+                        <div class="select-kc">
+                            <select id="editMode"
+                                    ng-model="instance.config.editMode">
+                                <option>READ_ONLY</option>
+                                <option>UNSYNCED</option>
+                            </select>
+                        </div>
+                    </div>
+                    <span tooltip-placement="right" tooltip="READ_ONLY means that password updates are not allowed and user always authenticates with Kerberos password. UNSYNCED means user can change his password in Keycloak database and this one will be used instead of Kerberos password then" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group">
+                    <label class="col-sm-2 control-label" for="updateProfileFirstLogin">Update Profile First Login </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.updateProfileFirstLogin" id="updateProfileFirstLogin" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Update profile on first login" class="fa fa-info-circle"></span>
+                </div>
+
+            </fieldset>
+
+            <div class="pull-right form-actions" data-ng-show="create && access.manageUsers">
+                <button kc-cancel data-ng-click="cancel()">Cancel</button>
+                <button kc-save data-ng-show="changed">Save</button>
+            </div>
+
+            <div class="pull-right form-actions" data-ng-show="!create && access.manageUsers">
+                <button kc-reset data-ng-show="changed">Clear changes</button>
+                <button kc-save  data-ng-show="changed">Save</button>
+                <button kc-delete data-ng-click="remove()" data-ng-hide="changed">Delete</button>
+            </div>
+        </form>
+    </div>
+</div>
\ No newline at end of file

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-ldap.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-ldap.html
index 69c53e2..66ff5c2 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-ldap.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/federated-ldap.html
@@ -58,7 +58,7 @@
                 <div class="form-group clearfix block">
                     <label class="col-sm-2 control-label" for="syncRegistrations">Sync Registrations</label>
                     <div class="col-sm-4">
-                        <input ng-model="syncRegistrations" name="syncRegistrations" id="syncRegistrations" onoffswitch />
+                        <input ng-model="instance.config.syncRegistrations" name="syncRegistrations" id="syncRegistrations" onoffswitch />
                     </div>
                     <span tooltip-placement="right" tooltip="Should newly created users be created within LDAP store?  Priority effects which provider is chose to sync the new user." class="fa fa-info-circle"></span>
                 </div>
@@ -139,21 +139,21 @@
                 <div class="form-group clearfix">
                     <label class="col-sm-2 control-label" for="connectionPooling">Connection pooling</label>
                     <div class="col-sm-4">
-                        <input ng-model="connectionPooling" name="connectionPooling" id="connectionPooling" onoffswitch />
+                        <input ng-model="instance.config.connectionPooling" name="connectionPooling" id="connectionPooling" onoffswitch />
                     </div>
                     <span tooltip-placement="right" tooltip="Does Keycloak should use connection pooling for accessing LDAP server" class="fa fa-info-circle"></span>
                 </div>
                 <div class="form-group clearfix">
                     <label class="col-sm-2 control-label" for="pagination">Pagination</label>
                     <div class="col-sm-4">
-                        <input ng-model="pagination" name="pagination" id="pagination" onoffswitch />
+                        <input ng-model="instance.config.pagination" name="pagination" id="pagination" onoffswitch />
                     </div>
                     <span tooltip-placement="right" tooltip="Does the LDAP server support pagination." class="fa fa-info-circle"></span>
                 </div>
                 <div class="form-group clearfix" data-ng-show="instance.config.vendor === 'ad' ">
                     <label class="col-sm-2 control-label" for="userAccountControlsAfterPasswordUpdate">Enable Account After Password Update</label>
                     <div class="col-sm-4">
-                        <input ng-model="userAccountControlsAfterPasswordUpdate" name="userAccountControlsAfterPasswordUpdate" id="userAccountControlsAfterPasswordUpdate" onoffswitch />
+                        <input ng-model="instance.config.userAccountControlsAfterPasswordUpdate" name="userAccountControlsAfterPasswordUpdate" id="userAccountControlsAfterPasswordUpdate" onoffswitch />
                     </div>
                     <span tooltip-placement="right" tooltip="Useful just for Active Directory. If enabled, then Keycloak will always set
                     Active Directory userAccountControl attribute to 512 after password update. This would mean that particular user will be enabled in Active Directory" class="fa fa-info-circle"></span>
@@ -161,6 +161,52 @@
             </fieldset>
 
             <fieldset>
+                <legend><span class="text">Kerberos integration</span></legend>
+                <div class="form-group">
+                    <label class="col-sm-2 control-label" for="allowKerberosAuthentication">Allow Kerberos authentication </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.allowKerberosAuthentication" id="allowKerberosAuthentication" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix" data-ng-show="instance.config.allowKerberosAuthentication">
+                    <label class="col-sm-2 control-label" for="kerberosRealm">Kerberos Realm <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="kerberosRealm" type="text" ng-model="instance.config.kerberosRealm" ng-required="instance.config.allowKerberosAuthentication">
+                    </div>
+                    <span tooltip-placement="right" tooltip="Name of kerberos realm. For example FOO.ORG" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix" data-ng-show="instance.config.allowKerberosAuthentication">
+                    <label class="col-sm-2 control-label" for="serverPrincipal">Server principal <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="serverPrincipal" type="text" ng-model="instance.config.serverPrincipal" ng-required="instance.config.allowKerberosAuthentication">
+                    </div>
+                    <span tooltip-placement="right" tooltip="Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group clearfix" data-ng-show="instance.config.allowKerberosAuthentication">
+                    <label class="col-sm-2 control-label" for="keyTab">KeyTab <span class="required">*</span></label>
+                    <div class="col-sm-4">
+                        <input class="form-control" id="keyTab" type="text" ng-model="instance.config.keyTab" ng-required="instance.config.allowKerberosAuthentication">
+                    </div>
+                    <span tooltip-placement="right" tooltip="Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab" class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group" data-ng-show="instance.config.allowKerberosAuthentication">
+                    <label class="col-sm-2 control-label" for="debug">Debug </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.debug" id="debug" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Enable/disable debug logging to standard output for Krb5LoginModule." class="fa fa-info-circle"></span>
+                </div>
+                <div class="form-group" data-ng-show="instance.config.allowKerberosAuthentication">
+                    <label class="col-sm-2 control-label" for="debug">Use Kerberos For Password Authentication </label>
+                    <div class="col-sm-4">
+                        <input ng-model="instance.config.useKerberosForPasswordAuthentication" id="useKerberosForPasswordAuthentication" onoffswitch />
+                    </div>
+                    <span tooltip-placement="right" tooltip="Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API" class="fa fa-info-circle"></span>
+                </div>
+            </fieldset>
+
+            <fieldset>
                 <legend><span class="text">Sync settings</span></legend>
                 <div class="form-group clearfix">
                     <label class="col-sm-2 control-label" for="batchSizeForSync">Batch size</label>

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-detail.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-detail.html
index c678571..5e770a8 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-detail.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/user-detail.html
@@ -16,7 +16,7 @@
         <ol class="breadcrumb" data-ng-hide="create">
             <li><a href="#/realms/{{realm.realm}}/users">Users</a></li>
             <li><a href="#/realms/{{realm.realm}}/users/{{user.username}}">{{user.username}}</a></li>
-            <li class="active">Settings</li>
+            <li class="active">Attributes</li>
         </ol>
         <ol class="breadcrumb" data-ng-show="create">
             <li><a href="#/realms/{{realm.realm}}/users">Users</a></li>

diff --git a/forms/common-themes/src/main/resources/theme/login/base/messages/messages.properties b/forms/common-themes/src/main/resources/theme/login/base/messages/messages.properties
index c7e1fff..5c5d1f7 100755
--- a/forms/common-themes/src/main/resources/theme/login/base/messages/messages.properties
+++ b/forms/common-themes/src/main/resources/theme/login/base/messages/messages.properties
@@ -98,8 +98,7 @@ actionPasswordWarning=You need to change your password to activate your account.
 actionEmailWarning=You need to verify your email address to activate your account.
 actionFollow=Please fill in the fields below.
 
-errorKerberosLogin=Kerberos ticket not available. Use different login mechanism
-errorKerberosLinkAccount=Kerberos ticket not available.
+errorKerberosLogin=Kerberos ticket not available. Authenticate with password.
 
 successHeader=Success!
 errorHeader=Error!

diff --git a/forms/login-api/src/main/java/org/keycloak/login/LoginFormsProvider.java b/forms/login-api/src/main/java/org/keycloak/login/LoginFormsProvider.java
index 0d1f931..45f3adb 100755
--- a/forms/login-api/src/main/java/org/keycloak/login/LoginFormsProvider.java
+++ b/forms/login-api/src/main/java/org/keycloak/login/LoginFormsProvider.java
@@ -54,6 +54,8 @@ public interface LoginFormsProvider extends Provider {
 
     public LoginFormsProvider setQueryParams(MultivaluedMap<String, String> queryParams);
 
+    public LoginFormsProvider setResponseHeader(String headerName, String headerValue);
+
     public LoginFormsProvider setFormData(MultivaluedMap<String, String> formData);
 
     public LoginFormsProvider setStatus(Response.Status status);

diff --git a/forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/FreeMarkerLoginFormsProvider.java b/forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/FreeMarkerLoginFormsProvider.java
index 1360800..44a7585 100755
--- a/forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/FreeMarkerLoginFormsProvider.java
+++ b/forms/login-freemarker/src/main/java/org/keycloak/login/freemarker/FreeMarkerLoginFormsProvider.java
@@ -57,6 +57,7 @@ public class FreeMarkerLoginFormsProvider implements LoginFormsProvider {
     private List<RoleModel> realmRolesRequested;
     private MultivaluedMap<String, RoleModel> resourceRolesRequested;
     private MultivaluedMap<String, String> queryParams;
+    private Map<String, String> httpResponseHeaders = new HashMap<String, String>();
     private String accessRequestMessage;
     private URI actionUri;
 
@@ -226,6 +227,9 @@ public class FreeMarkerLoginFormsProvider implements LoginFormsProvider {
             String result = freeMarker.processTemplate(attributes, Templates.getTemplate(page), theme);
             Response.ResponseBuilder builder = Response.status(status).type(MediaType.TEXT_HTML).entity(result);
             BrowserSecurityHeaderSetup.headers(builder, realm);
+            for (Map.Entry<String, String> entry : httpResponseHeaders.entrySet()) {
+                builder.header(entry.getKey(), entry.getValue());
+            }
             return builder.build();
         } catch (FreeMarkerException e) {
             logger.error("Failed to process template", e);
@@ -336,6 +340,12 @@ public class FreeMarkerLoginFormsProvider implements LoginFormsProvider {
     }
 
     @Override
+    public LoginFormsProvider setResponseHeader(String headerName, String headerValue) {
+        this.httpResponseHeaders.put(headerName, headerValue);
+        return this;
+    }
+
+    @Override
     public void close() {
     }
 

diff --git a/model/api/src/main/java/org/keycloak/models/CredentialValidationOutput.java b/model/api/src/main/java/org/keycloak/models/CredentialValidationOutput.java
new file mode 100644
index 0000000..70e4093
--- /dev/null
+++ b/model/api/src/main/java/org/keycloak/models/CredentialValidationOutput.java
@@ -0,0 +1,46 @@
+package org.keycloak.models;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Output of credential validation
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class CredentialValidationOutput {
+
+    private final UserModel authenticatedUser; // authenticated user.
+    private final Status authStatus;           // status whether user is authenticated or more steps needed
+    private final Map<String, Object> state;   // Additional state related to authentication. It can contain data to be sent back to client or data about used credentials.
+
+    public CredentialValidationOutput(UserModel authenticatedUser, Status authStatus, Map<String, Object> state) {
+        this.authenticatedUser = authenticatedUser;
+        this.authStatus = authStatus;
+        this.state = state;
+    }
+
+    public static CredentialValidationOutput failed() {
+        return new CredentialValidationOutput(null, CredentialValidationOutput.Status.FAILED, new HashMap<String, Object>());
+    }
+
+    public UserModel getAuthenticatedUser() {
+        return authenticatedUser;
+    }
+
+    public Status getAuthStatus() {
+        return authStatus;
+    }
+
+    public Map<String, Object> getState() {
+        return state;
+    }
+
+    public CredentialValidationOutput merge(CredentialValidationOutput that) {
+        throw new IllegalStateException("Not supported yet");
+    }
+
+    public static enum Status {
+        AUTHENTICATED, FAILED, CONTINUE
+    }
+}

diff --git a/model/api/src/main/java/org/keycloak/models/RequiredCredentialModel.java b/model/api/src/main/java/org/keycloak/models/RequiredCredentialModel.java
index 9d77a7a..0840b04 100755
--- a/model/api/src/main/java/org/keycloak/models/RequiredCredentialModel.java
+++ b/model/api/src/main/java/org/keycloak/models/RequiredCredentialModel.java
@@ -54,6 +54,7 @@ public class RequiredCredentialModel {
     public static final RequiredCredentialModel TOTP;
     public static final RequiredCredentialModel CLIENT_CERT;
     public static final RequiredCredentialModel SECRET;
+    public static final RequiredCredentialModel KERBEROS;
 
     static {
         Map<String, RequiredCredentialModel> map = new HashMap<String, RequiredCredentialModel>();
@@ -81,6 +82,12 @@ public class RequiredCredentialModel {
         CLIENT_CERT.setSecret(false);
         CLIENT_CERT.setFormLabel("clientCertificate");
         map.put(CLIENT_CERT.getType(), CLIENT_CERT);
+        KERBEROS = new RequiredCredentialModel();
+        KERBEROS.setType(UserCredentialModel.KERBEROS);
+        KERBEROS.setInput(false);
+        KERBEROS.setSecret(false);
+        KERBEROS.setFormLabel("kerberos");
+        map.put(KERBEROS.getType(), KERBEROS);
         BUILT_IN = Collections.unmodifiableMap(map);
     }
 }

diff --git a/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java b/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
index 2f1fbf7..5fb6005 100755
--- a/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
+++ b/model/api/src/main/java/org/keycloak/models/UserCredentialModel.java
@@ -14,6 +14,7 @@ public class UserCredentialModel {
     public static final String SECRET = "secret";
     public static final String TOTP = "totp";
     public static final String CLIENT_CERT = "cert";
+    public static final String KERBEROS = "kerberos";
 
     protected String type;
     protected String value;
@@ -49,6 +50,13 @@ public class UserCredentialModel {
         return model;
     }
 
+    public static UserCredentialModel kerberos(String token) {
+        UserCredentialModel model = new UserCredentialModel();
+        model.setType(KERBEROS);
+        model.setValue(token);
+        return model;
+    }
+
     public static UserCredentialModel generateSecret() {
         UserCredentialModel model = new UserCredentialModel();
         model.setType(SECRET);

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationManager.java b/model/api/src/main/java/org/keycloak/models/UserFederationManager.java
index 1b3bdd1..7d3ecf4 100755
--- a/model/api/src/main/java/org/keycloak/models/UserFederationManager.java
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationManager.java
@@ -3,6 +3,7 @@ package org.keycloak.models;
 import org.jboss.logging.Logger;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
@@ -355,27 +356,40 @@ public class UserFederationManager implements UserProvider {
 
     @Override
     public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
-        UserFederationProvider link = getFederationLink(realm, user);
-        if (link != null) {
-            validateUser(realm, user);
-            Set<String> supportedCredentialTypes = link.getSupportedCredentialTypes(user);
-            if (supportedCredentialTypes.size() > 0) {
-                List<UserCredentialModel> fedCreds = new ArrayList<UserCredentialModel>();
-                List<UserCredentialModel> localCreds = new ArrayList<UserCredentialModel>();
-                for (UserCredentialModel cred : input) {
-                    if (supportedCredentialTypes.contains(cred.getType())) {
-                        fedCreds.add(cred);
-                    } else {
-                        localCreds.add(cred);
-                    }
-                }
-                if (!link.validCredentials(realm, user, fedCreds)) {
-                    return false;
+        return validCredentials(realm, user, Arrays.asList(input));
+    }
+
+    @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input) {
+        List<UserFederationProviderModel> fedProviderModels = realm.getUserFederationProviders();
+        List<UserFederationProvider> fedProviders = new ArrayList<UserFederationProvider>();
+        for (UserFederationProviderModel fedProviderModel : fedProviderModels) {
+            fedProviders.add(getFederationProvider(fedProviderModel));
+        }
+
+        CredentialValidationOutput result = null;
+        for (UserCredentialModel cred : input) {
+            UserFederationProvider providerSupportingCreds = null;
+
+            // Find provider, which supports required credential type
+            for (UserFederationProvider fedProvider : fedProviders) {
+                if (fedProvider.getSupportedCredentialTypes().contains(cred.getType())) {
+                    providerSupportingCreds = fedProvider;
+                    break;
                 }
-                return session.userStorage().validCredentials(realm, user, localCreds);
             }
+
+            if (providerSupportingCreds == null) {
+                logger.warn("Don't have provider supporting credentials of type " + cred.getType());
+                return CredentialValidationOutput.failed();
+            }
+
+            CredentialValidationOutput currentResult = providerSupportingCreds.validCredentials(realm, cred);
+            result = (result == null) ? currentResult : result.merge(currentResult);
         }
-        return session.userStorage().validCredentials(realm, user, input);
+
+        // For now, validCredentials(realm, input) is not supported for local userProviders
+        return (result != null) ? result : CredentialValidationOutput.failed();
     }
 
     @Override

diff --git a/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java b/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java
index 16e81b5..948e8c9 100755
--- a/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java
+++ b/model/api/src/main/java/org/keycloak/models/UserFederationProvider.java
@@ -131,6 +131,14 @@ public interface UserFederationProvider extends Provider {
     Set<String> getSupportedCredentialTypes(UserModel user);
 
     /**
+     * What UserCredentialModel types should be handled by this provider? This is called in scenarios when we don't know user,
+     * who is going to authenticate (For example Kerberos authentication).
+     *
+     * @return
+     */
+    Set<String> getSupportedCredentialTypes();
+
+    /**
      * Validate credentials for this user.  This method will only be called with credential parameters supported
      * by this provider
      *
@@ -141,6 +149,15 @@ public interface UserFederationProvider extends Provider {
      */
     boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input);
     boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input);
+
+    /**
+     * Validate credentials of unknown user. The authenticated user is recognized based on provided credentials and returned back in CredentialValidationOutput
+     * @param realm
+     * @param input
+     * @return
+     */
+    CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel credential);
+
     void close();
 
 }

diff --git a/model/api/src/main/java/org/keycloak/models/UserProvider.java b/model/api/src/main/java/org/keycloak/models/UserProvider.java
index 0d0a25b..b508638 100755
--- a/model/api/src/main/java/org/keycloak/models/UserProvider.java
+++ b/model/api/src/main/java/org/keycloak/models/UserProvider.java
@@ -43,5 +43,7 @@ public interface UserProvider extends Provider {
 
     boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input);
     boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input);
+    CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input);
+
     void close();
 }

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/DefaultCacheUserProvider.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/DefaultCacheUserProvider.java
index 017a26e..8dbb044 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/DefaultCacheUserProvider.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/DefaultCacheUserProvider.java
@@ -1,5 +1,6 @@
 package org.keycloak.models.cache;
 
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakTransaction;
 import org.keycloak.models.RealmModel;
@@ -283,6 +284,11 @@ public class DefaultCacheUserProvider implements CacheUserProvider {
     }
 
     @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input) {
+        return getDelegate().validCredentials(realm, input);
+    }
+
+    @Override
     public void preRemove(RealmModel realm) {
         realmInvalidations.add(realm.getId());
         getDelegate().preRemove(realm);

diff --git a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java
index e468b16..857b3e8 100755
--- a/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java
+++ b/model/invalidation-cache/model-adapters/src/main/java/org/keycloak/models/cache/NoCacheUserProvider.java
@@ -1,5 +1,6 @@
 package org.keycloak.models.cache;
 
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
@@ -156,6 +157,11 @@ public class NoCacheUserProvider implements CacheUserProvider {
     }
 
     @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input) {
+        return getDelegate().validCredentials(realm, input);
+    }
+
+    @Override
     public void preRemove(RealmModel realm) {
         getDelegate().preRemove(realm);
     }

diff --git a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
index 438c700..c94c068 100755
--- a/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
+++ b/model/jpa/src/main/java/org/keycloak/models/jpa/JpaUserProvider.java
@@ -1,6 +1,7 @@
 package org.keycloak.models.jpa;
 
 import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
@@ -375,4 +376,10 @@ public class JpaUserProvider implements UserProvider {
     public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
         return CredentialValidation.validCredentials(realm, user, input);
     }
+
+    @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input) {
+        // Not supported yet
+        return null;
+    }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java
index 7ce4935..691bce4 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProvider.java
@@ -27,11 +27,9 @@ public class MongoRealmProvider implements RealmProvider {
 
     private final MongoStoreInvocationContext invocationContext;
     private final KeycloakSession session;
-    private final MongoStore mongoStore;
 
-    public MongoRealmProvider(KeycloakSession session, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+    public MongoRealmProvider(KeycloakSession session, MongoStoreInvocationContext invocationContext) {
         this.session = session;
-        this.mongoStore = mongoStore;
         this.invocationContext = invocationContext;
     }
 

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java
index fceeb82..9606753 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoRealmProviderFactory.java
@@ -27,7 +27,7 @@ public class MongoRealmProviderFactory implements RealmProviderFactory {
     @Override
     public RealmProvider create(KeycloakSession session) {
         MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
-        return new MongoRealmProvider(session, connection.getMongoStore(), connection.getInvocationContext());
+        return new MongoRealmProvider(session, connection.getInvocationContext());
     }
 
     @Override

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProvider.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProvider.java
index 52d4c98..5babac0 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProvider.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProvider.java
@@ -6,6 +6,7 @@ import com.mongodb.QueryBuilder;
 import org.keycloak.connections.mongo.api.MongoStore;
 import org.keycloak.connections.mongo.api.context.MongoStoreInvocationContext;
 import org.keycloak.models.ApplicationModel;
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.FederatedIdentityModel;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
@@ -33,11 +34,9 @@ public class MongoUserProvider implements UserProvider {
 
     private final MongoStoreInvocationContext invocationContext;
     private final KeycloakSession session;
-    private final MongoStore mongoStore;
 
-    public MongoUserProvider(KeycloakSession session, MongoStore mongoStore, MongoStoreInvocationContext invocationContext) {
+    public MongoUserProvider(KeycloakSession session, MongoStoreInvocationContext invocationContext) {
         this.session = session;
-        this.mongoStore = mongoStore;
         this.invocationContext = invocationContext;
     }
 
@@ -311,6 +310,7 @@ public class MongoUserProvider implements UserProvider {
 
     @Override
     public void updateFederatedIdentity(RealmModel realm, UserModel federatedUser, FederatedIdentityModel federatedIdentityModel) {
+        federatedUser = getUserById(federatedUser.getId(), realm);
         MongoUserEntity userEntity = ((UserAdapter) federatedUser).getUser();
         FederatedIdentityEntity federatedIdentityEntity = findFederatedIdentityLink(userEntity, federatedIdentityModel.getIdentityProvider());
 
@@ -379,4 +379,10 @@ public class MongoUserProvider implements UserProvider {
     public boolean validCredentials(RealmModel realm, UserModel user, UserCredentialModel... input) {
         return CredentialValidation.validCredentials(realm, user, input);
     }
+
+    @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel... input) {
+        // Not supported yet
+        return null;
+    }
 }

diff --git a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java
index 083d0c0..a117048 100755
--- a/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java
+++ b/model/mongo/src/main/java/org/keycloak/models/mongo/keycloak/adapters/MongoUserProviderFactory.java
@@ -27,7 +27,7 @@ public class MongoUserProviderFactory implements UserProviderFactory {
     @Override
     public UserProvider create(KeycloakSession session) {
         MongoConnectionProvider connection = session.getProvider(MongoConnectionProvider.class);
-        return new MongoUserProvider(session, connection.getMongoStore(), connection.getInvocationContext());
+        return new MongoUserProvider(session, connection.getInvocationContext());
     }
 
     @Override

diff --git a/pom.xml b/pom.xml
index 4aada1a..d43ce03 100755
--- a/pom.xml
+++ b/pom.xml
@@ -13,6 +13,8 @@
 
     <properties>
         <aesh.version>0.33.12</aesh.version>
+        <apacheds.version>2.0.0-M17</apacheds.version>
+        <apacheds.codec.version>1.0.0-M23</apacheds.codec.version>
         <base64.version>2.3.8</base64.version>
         <bouncycastle.crypto.version>1.50</bouncycastle.crypto.version>
         <bouncycastle.mail.version>1.50</bouncycastle.mail.version>
@@ -23,7 +25,6 @@
         <!-- <undertow.version>1.1.0.Final</undertow.version> -->
         <undertow.version>1.1.1.Final</undertow.version>
         <picketlink.version>2.7.0.CR3</picketlink.version>
-        <picketbox.ldap.version>1.0.2.Final</picketbox.ldap.version>
         <mongo.driver.version>2.11.3</mongo.driver.version>
         <jboss.logging.version>3.1.4.GA</jboss.logging.version>
         <syslog4j.version>0.9.30</syslog4j.version>
@@ -308,17 +309,6 @@
                 <version>${picketlink.version}</version>
             </dependency>
             <dependency>
-                <groupId>org.picketbox</groupId>
-                <artifactId>picketbox-ldap</artifactId>
-                <version>${picketbox.ldap.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.picketbox</groupId>
-                <artifactId>picketbox-ldap</artifactId>
-                <version>${picketbox.ldap.version}</version>
-                <type>test-jar</type>
-            </dependency>
-            <dependency>
                 <groupId>org.jboss.logging</groupId>
                 <artifactId>jboss-logging</artifactId>
                 <version>${jboss.logging.version}</version>
@@ -422,6 +412,28 @@
                 <version>${winzipaes.version}</version>
             </dependency>
 
+            <!-- Apache DS -->
+            <dependency>
+                <groupId>org.apache.directory.server</groupId>
+                <artifactId>apacheds-core-annotations</artifactId>
+                <version>${apacheds.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.directory.server</groupId>
+                <artifactId>apacheds-interceptor-kerberos</artifactId>
+                <version>${apacheds.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.directory.server</groupId>
+                <artifactId>apacheds-server-annotations</artifactId>
+                <version>${apacheds.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.directory.api</groupId>
+                <artifactId>api-ldap-codec-standalone</artifactId>
+                <version>${apacheds.codec.version}</version>
+            </dependency>
+
             <!-- Selenium -->
             <dependency>
                 <groupId>org.seleniumhq.selenium</groupId>

diff --git a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
index 9b0f96f..ae0ba0a 100755
--- a/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
+++ b/services/src/main/java/org/keycloak/protocol/oidc/OIDCLoginProtocolService.java
@@ -41,6 +41,7 @@ import org.keycloak.services.ForbiddenException;
 import org.keycloak.services.managers.AuthenticationManager;
 import org.keycloak.services.managers.AuthenticationManager.AuthenticationStatus;
 import org.keycloak.services.managers.ClientSessionCode;
+import org.keycloak.services.managers.HttpAuthenticationManager;
 import org.keycloak.services.resources.Cors;
 import org.keycloak.services.resources.RealmsResource;
 import org.keycloak.services.resources.flows.Flows;
@@ -883,6 +884,11 @@ public class OIDCLoginProtocolService {
         response = authManager.checkNonFormAuthentication(session, clientSession, realm, uriInfo, request, clientConnection, headers, event);
         if (response != null) return response;
 
+        // SPNEGO/Kerberos authentication TODO: This should be somehow pluggable instead of hardcoded this way (Authentication interceptors?)
+        HttpAuthenticationManager httpAuthManager = new HttpAuthenticationManager(session, clientSession, realm, uriInfo, request, clientConnection, event);
+        HttpAuthenticationManager.HttpAuthOutput httpAuthOutput = httpAuthManager.spnegoAuthenticate();
+        if (httpAuthOutput.getResponse() != null) return httpAuthOutput.getResponse();
+
         if (prompt != null && prompt.equals("none")) {
             OIDCLoginProtocol oauth = new OIDCLoginProtocol(session, realm, uriInfo);
             return oauth.cancelLogin(clientSession);
@@ -911,6 +917,11 @@ public class OIDCLoginProtocolService {
         LoginFormsProvider forms = Flows.forms(session, realm, clientSession.getClient(), uriInfo)
                 .setClientSessionCode(accessCode);
 
+        // Attach state from SPNEGO authentication
+        if (httpAuthOutput.getChallenge() != null) {
+            httpAuthOutput.getChallenge().sendChallenge(forms);
+        }
+
         String rememberMeUsername = AuthenticationManager.getRememberMeUsername(realm, headers);
 
         if (loginHint != null || rememberMeUsername != null) {

diff --git a/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationChallenge.java b/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationChallenge.java
new file mode 100644
index 0000000..0be8bcc
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationChallenge.java
@@ -0,0 +1,11 @@
+package org.keycloak.services.managers;
+
+import org.keycloak.login.LoginFormsProvider;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public interface HttpAuthenticationChallenge {
+
+    void addChallenge(LoginFormsProvider loginFormsProvider);
+}

diff --git a/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationManager.java b/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationManager.java
new file mode 100644
index 0000000..ca0488e
--- /dev/null
+++ b/services/src/main/java/org/keycloak/services/managers/HttpAuthenticationManager.java
@@ -0,0 +1,167 @@
+package org.keycloak.services.managers;
+
+import javax.ws.rs.core.HttpHeaders;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
+import org.jboss.logging.Logger;
+import org.jboss.resteasy.spi.HttpRequest;
+import org.keycloak.ClientConnection;
+import org.keycloak.events.Errors;
+import org.keycloak.events.EventBuilder;
+import org.keycloak.login.LoginFormsProvider;
+import org.keycloak.models.ClientSessionModel;
+import org.keycloak.models.CredentialValidationOutput;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredCredentialModel;
+import org.keycloak.models.UserCredentialModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.models.UserSessionModel;
+import org.keycloak.models.utils.KerberosConstants;
+import org.keycloak.protocol.oidc.TokenManager;
+import org.keycloak.representations.idm.CredentialRepresentation;
+import org.keycloak.services.messages.Messages;
+import org.keycloak.services.resources.flows.Flows;
+
+/**
+ * Handle HTTP authentication types requiring complex handshakes with multiple HTTP request/responses
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class HttpAuthenticationManager {
+
+    private static final Logger logger = Logger.getLogger(HttpAuthenticationManager.class);
+
+    private KeycloakSession session;
+    private RealmModel realm;
+    private UriInfo uriInfo;
+    private HttpRequest request;
+    private EventBuilder event;
+    private ClientConnection clientConnection;
+    private ClientSessionModel clientSession;
+
+    public HttpAuthenticationManager(KeycloakSession session, ClientSessionModel clientSession, RealmModel realm, UriInfo uriInfo,
+                                     HttpRequest request,
+                                     ClientConnection clientConnection,
+                                     EventBuilder event) {
+        this.session = session;
+        this.realm = realm;
+        this.uriInfo = uriInfo;
+        this.request = request;
+        this.event = event;
+        this.clientConnection = clientConnection;
+        this.clientSession = clientSession;
+    }
+
+
+    public HttpAuthOutput spnegoAuthenticate() {
+        boolean kerberosSupported = false;
+        for (RequiredCredentialModel c : realm.getRequiredCredentials()) {
+            if (c.getType().equals(CredentialRepresentation.KERBEROS)) {
+                logger.debug("Kerberos authentication is supported");
+                kerberosSupported = true;
+            }
+        }
+
+        if (!kerberosSupported) {
+            return new HttpAuthOutput(null, null);
+        }
+
+        String authHeader = request.getHttpHeaders().getRequestHeaders().getFirst(HttpHeaders.AUTHORIZATION);
+
+        // Case when we don't yet have any Negotiate header
+        if (authHeader == null) {
+            return challengeNegotiation(null);
+        }
+
+        String[] tokens = authHeader.split(" ");
+        if (tokens.length != 2) {
+            logger.warn("Invalid length of tokens: " + tokens.length);
+            return challengeNegotiation(null);
+        } else if (!KerberosConstants.NEGOTIATE.equalsIgnoreCase(tokens[0])) {
+            logger.warn("Unknown scheme " + tokens[0]);
+            return challengeNegotiation(null);
+        } else {
+            String spnegoToken = tokens[1];
+            UserCredentialModel spnegoCredential = UserCredentialModel.kerberos(spnegoToken);
+
+            CredentialValidationOutput output = session.users().validCredentials(realm, spnegoCredential);
+
+            if (output.getAuthStatus() == CredentialValidationOutput.Status.AUTHENTICATED) {
+                return sendResponse(output.getAuthenticatedUser(), "spnego");
+            }  else {
+                String spnegoResponseToken = (String) output.getState().get(KerberosConstants.RESPONSE_TOKEN);
+                return challengeNegotiation(spnegoResponseToken);
+            }
+        }
+    }
+
+
+    // Send response after successful authentication
+    private HttpAuthOutput sendResponse(UserModel user, String authMethod) {
+        Response response;
+        if (!user.isEnabled()) {
+            event.error(Errors.USER_DISABLED);
+            response = Flows.forwardToSecurityFailurePage(session, realm, uriInfo, Messages.ACCOUNT_DISABLED);
+        } else {
+            UserSessionModel userSession = session.sessions().createUserSession(realm, user, user.getUsername(), clientConnection.getRemoteAddr(), authMethod, false);
+            TokenManager.attachClientSession(userSession, clientSession);
+            event.session(userSession);
+            response = AuthenticationManager.nextActionAfterAuthentication(session, userSession, clientSession, clientConnection, request, uriInfo, event);
+        }
+
+        return new HttpAuthOutput(response, null);
+    }
+
+
+    private HttpAuthOutput challengeNegotiation(final String negotiateToken) {
+        return new HttpAuthOutput(null, new HttpAuthChallenge() {
+
+            @Override
+            public void sendChallenge(LoginFormsProvider loginFormsProvider) {
+                String negotiateHeader = negotiateToken == null ? KerberosConstants.NEGOTIATE : KerberosConstants.NEGOTIATE + " " + negotiateToken;
+
+                if (logger.isTraceEnabled()) {
+                    logger.trace("Sending back " + HttpHeaders.WWW_AUTHENTICATE + ": " + negotiateHeader);
+                }
+
+                loginFormsProvider.setStatus(Response.Status.UNAUTHORIZED);
+                loginFormsProvider.setResponseHeader(HttpHeaders.WWW_AUTHENTICATE, negotiateHeader);
+                loginFormsProvider.setWarning("errorKerberosLogin");
+            }
+
+        });
+    }
+
+
+    public class HttpAuthOutput {
+
+        // It's non-null if we want to immediately send response to user
+        private final Response response;
+
+        // It's non-null if challenge should be attached to rendered login form
+        private final HttpAuthChallenge challenge;
+
+        public HttpAuthOutput(Response response, HttpAuthChallenge challenge) {
+            this.response = response;
+            this.challenge = challenge;
+        }
+
+        public Response getResponse() {
+            return response;
+        }
+
+        public HttpAuthChallenge getChallenge() {
+            return challenge;
+        }
+    }
+
+
+    public interface HttpAuthChallenge {
+
+        void sendChallenge(LoginFormsProvider loginFormsProvider);
+
+    }
+
+}

diff --git a/services/src/main/java/org/keycloak/services/managers/LDAPConnectionTestManager.java b/services/src/main/java/org/keycloak/services/managers/LDAPConnectionTestManager.java
index 2b78406..fff0bfb 100755
--- a/services/src/main/java/org/keycloak/services/managers/LDAPConnectionTestManager.java
+++ b/services/src/main/java/org/keycloak/services/managers/LDAPConnectionTestManager.java
@@ -27,11 +27,10 @@ public class LDAPConnectionTestManager {
         try {
             Hashtable<String, Object> env = new Hashtable<String, Object>();
             env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
-            env.put(Context.SECURITY_AUTHENTICATION, "simple");
-
             env.put(Context.PROVIDER_URL, connectionUrl);
 
             if (TEST_AUTHENTICATION.equals(action)) {
+                env.put(Context.SECURITY_AUTHENTICATION, "simple");
                 env.put(Context.SECURITY_PRINCIPAL, bindDn);
 
                 char[] bindCredentialChar = null;

diff --git a/services/src/main/java/org/keycloak/services/resources/admin/UserFederationResource.java b/services/src/main/java/org/keycloak/services/resources/admin/UserFederationResource.java
index 751f092..730252c 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/UserFederationResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/UserFederationResource.java
@@ -5,9 +5,12 @@ import org.jboss.resteasy.annotations.cache.NoCache;
 import org.jboss.resteasy.spi.NotFoundException;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.RealmModel;
+import org.keycloak.models.RequiredCredentialModel;
+import org.keycloak.models.UserCredentialModel;
 import org.keycloak.models.UserFederationProvider;
 import org.keycloak.models.UserFederationProviderFactory;
 import org.keycloak.models.UserFederationProviderModel;
+import org.keycloak.models.utils.KerberosConstants;
 import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.provider.ProviderFactory;
 import org.keycloak.representations.idm.UserFederationProviderFactoryRepresentation;
@@ -118,6 +121,7 @@ public class UserFederationResource {
         UserFederationProviderModel model = realm.addUserFederationProvider(rep.getProviderName(), rep.getConfig(), rep.getPriority(), displayName,
                 rep.getFullSyncPeriod(), rep.getChangedSyncPeriod(), rep.getLastSync());
         new UsersSyncManager().refreshPeriodicSyncForProvider(session.getKeycloakSessionFactory(), session.getProvider(TimerProvider.class), model, realm.getId());
+        checkKerberosCredential(model);
 
         return Response.created(uriInfo.getAbsolutePathBuilder().path(model.getId()).build()).build();
     }
@@ -141,6 +145,7 @@ public class UserFederationResource {
                 rep.getFullSyncPeriod(), rep.getChangedSyncPeriod(), rep.getLastSync());
         realm.updateUserFederationProvider(model);
         new UsersSyncManager().refreshPeriodicSyncForProvider(session.getKeycloakSessionFactory(), session.getProvider(TimerProvider.class), model, realm.getId());
+        checkKerberosCredential(model);
     }
 
     /**
@@ -223,5 +228,23 @@ public class UserFederationResource {
         throw new NotFoundException("could not find provider");
     }
 
+    // Automatically add "kerberos" to required realm credentials if it's supported by saved provider
+    private void checkKerberosCredential(UserFederationProviderModel model) {
+        String allowKerberosCfg = model.getConfig().get(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION);
+        if (Boolean.valueOf(allowKerberosCfg)) {
+            boolean found = false;
+            List<RequiredCredentialModel> currentCreds = realm.getRequiredCredentials();
+            for (RequiredCredentialModel cred : currentCreds) {
+                if (cred.getType().equals(UserCredentialModel.KERBEROS)) {
+                    found = true;
+                }
+            }
+
+            if (!found) {
+                realm.addRequiredCredential(UserCredentialModel.KERBEROS);
+                logger.info("Added 'kerberos' to required realm credentials");
+            }
+        }
+    }
 
 }

diff --git a/testsuite/integration/pom.xml b/testsuite/integration/pom.xml
index 5800d98..98697e5 100755
--- a/testsuite/integration/pom.xml
+++ b/testsuite/integration/pom.xml
@@ -114,10 +114,6 @@
             <artifactId>javase</artifactId>
         </dependency>
         <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
-        </dependency>
-        <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpclient</artifactId>
             <version>${keycloak.apache.httpcomponents.version}</version>
@@ -212,16 +208,32 @@
             <groupId>org.seleniumhq.selenium</groupId>
             <artifactId>selenium-chrome-driver</artifactId>
         </dependency>
+
+        <!-- Apache DS -->
         <dependency>
-            <groupId>org.picketbox</groupId>
-            <artifactId>picketbox-ldap</artifactId>
-            <type>test-jar</type>
+            <groupId>org.apache.directory.server</groupId>
+            <artifactId>apacheds-core-annotations</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-log4j12</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
-            <groupId>org.picketbox</groupId>
-            <artifactId>picketbox-ldap</artifactId>
+            <groupId>org.apache.directory.server</groupId>
+            <artifactId>apacheds-interceptor-kerberos</artifactId>
         </dependency>
         <dependency>
+            <groupId>org.apache.directory.server</groupId>
+            <artifactId>apacheds-server-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.directory.api</groupId>
+            <artifactId>api-ldap-codec-standalone</artifactId>
+        </dependency>
+
+        <dependency>
             <groupId>org.picketlink</groupId>
             <artifactId>picketlink-wildfly-common</artifactId>
             <scope>test</scope>
@@ -270,6 +282,12 @@
                     <workingDirectory>${project.basedir}</workingDirectory>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <inherited>true</inherited>
+                <extensions>true</extensions>
+            </plugin>
         </plugins>
     </build>
 
@@ -316,6 +334,34 @@
                 </plugins>
             </build>
         </profile>
+        <profile>
+            <id>ldap</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <configuration>
+                            <mainClass>org.keycloak.testutils.ldap.LDAPEmbeddedServer</mainClass>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+        <profile>
+            <id>kerberos</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.mojo</groupId>
+                        <artifactId>exec-maven-plugin</artifactId>
+                        <configuration>
+                            <mainClass>org.keycloak.testutils.ldap.KerberosEmbeddedServer</mainClass>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
 
         <profile>
             <id>jpa</id>

diff --git a/testsuite/integration/README.md b/testsuite/integration/README.md
index 9de055c..a8d0671 100644
--- a/testsuite/integration/README.md
+++ b/testsuite/integration/README.md
@@ -90,4 +90,34 @@ To configure Keycloak to use the above server add the following system propertie
 For example if using the test utils Keycloak server start it with:
 
     mvn exec:java -Pkeycloak-server -Dkeycloak.mail.smtp.from=auto@keycloak.org -Dkeycloak.mail.smtp.host=localhost -Dkeycloak.mail.smtp.port=3025
+    
+LDAP server
+-----------
+
+To start a ApacheDS based LDAP server for testing LDAP sending run:
+    
+    mvn exec:java -Pldap
+    
+There are additional system properties you can use to configure (See EmbeddedServersFactory class for details). Once done, you can create LDAP Federation provider
+in Keycloak admin console with the settings like:
+Vendor: Other
+Connection URL: ldap://localhost:10389
+Base DN: dc=keycloak,dc=org
+User DN Suffix: ou=People,dc=keycloak,dc=org
+Bind DN: uid=admin,ou=system
+Bind credential: secret
+
+Kerberos server
+---------------
+
+To start a ApacheDS based Kerberos server for testing Kerberos + LDAP sending run:
+    
+    mvn exec:java -Pkerberos
+    
+There are additional system properties you can use to configure (See EmbeddedServersFactory class for details). Once done, you can create LDAP Federation provider
+in Keycloak admin console with same settings like mentioned in previous LDAP section. And you can enable Kerberos with the settings like:
+
+Server Principal: HTTP/localhost@KEYCLOAK.ORG
+KeyTab: $KEYCLOAK_SOURCES/testsuite/integration/src/main/resources/kerberos/http.keytab
+
 

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/DummyUserFederationProvider.java b/testsuite/integration/src/main/java/org/keycloak/testutils/DummyUserFederationProvider.java
index 753409a..9964421 100755
--- a/testsuite/integration/src/main/java/org/keycloak/testutils/DummyUserFederationProvider.java
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/DummyUserFederationProvider.java
@@ -1,5 +1,6 @@
 package org.keycloak.testutils;
 
+import org.keycloak.models.CredentialValidationOutput;
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.RoleModel;
 import org.keycloak.models.UserCredentialModel;
@@ -77,6 +78,11 @@ public class DummyUserFederationProvider implements UserFederationProvider {
     }
 
     @Override
+    public Set<String> getSupportedCredentialTypes() {
+        return Collections.emptySet();
+    }
+
+    @Override
     public boolean validCredentials(RealmModel realm, UserModel user, List<UserCredentialModel> input) {
         return false;
     }
@@ -87,6 +93,11 @@ public class DummyUserFederationProvider implements UserFederationProvider {
     }
 
     @Override
+    public CredentialValidationOutput validCredentials(RealmModel realm, UserCredentialModel credential) {
+        return CredentialValidationOutput.failed();
+    }
+
+    @Override
     public void close() {
 
     }

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java b/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
index 9b0c200..d5e1c37 100755
--- a/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/KeycloakServer.java
@@ -104,27 +104,8 @@ public class KeycloakServer {
     }
 
     public static void main(String[] args) throws Throwable {
-        //bootstrapLdap();  Can't seem to get this to work.
         bootstrapKeycloakServer(args);
     }
-    /*private static LDAPEmbeddedServer embeddedServer;
-    public static void bootstrapLdap() throws Exception {
-        embeddedServer = new LDAPEmbeddedServer();
-        embeddedServer.setup();
-        embeddedServer.importLDIF("ldap/users.ldif");
-        Runtime.getRuntime().addShutdownHook(new Thread() {
-            @Override
-            public void run() {
-                try {
-                    embeddedServer.tearDown();
-                } catch (Exception e) {
-                    throw new RuntimeException(e);
-                }
-            }
-        });
-
-
-    } */
 
     public static KeycloakServer bootstrapKeycloakServer(String[] args) throws Throwable {
         KeycloakServerConfig config = new KeycloakServerConfig();

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/EmbeddedServersFactory.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/EmbeddedServersFactory.java
new file mode 100644
index 0000000..a377d9b
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/EmbeddedServersFactory.java
@@ -0,0 +1,82 @@
+package org.keycloak.testutils.ldap;
+
+/**
+ * Factory for ApacheDS based LDAP and Kerberos servers
+ *
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class EmbeddedServersFactory {
+
+    private static final String DEFAULT_BASE_DN = "dc=keycloak,dc=org";
+    private static final String DEFAULT_BIND_HOST = "localhost";
+    private static final int DEFAULT_BIND_PORT = 10389;
+    private static final String DEFAULT_LDIF_FILE = "ldap/users.ldif";
+
+    private static final String DEFAULT_KERBEROS_LDIF_FILE = "kerberos/users-kerberos.ldif";
+
+    private static final String DEFAULT_KERBEROS_REALM = "KEYCLOAK.ORG";
+    private static final int DEFAULT_KDC_PORT = 6088;
+
+    private String baseDN;
+    private String bindHost;
+    private int bindPort;
+    private String ldifFile;
+    private String kerberosRealm;
+    private int kdcPort;
+
+
+    public static EmbeddedServersFactory readConfiguration() {
+        EmbeddedServersFactory factory = new EmbeddedServersFactory();
+        factory.readProperties();
+        return factory;
+    }
+
+
+    protected void readProperties() {
+        this.baseDN = System.getProperty("ldap.baseDN");
+        this.bindHost = System.getProperty("ldap.host");
+        String bindPort = System.getProperty("ldap.port");
+        this.ldifFile = System.getProperty("ldap.ldif");
+
+        this.kerberosRealm = System.getProperty("kerberos.realm");
+        String kdcPort = System.getProperty("kerberos.port");
+
+        if (baseDN == null || baseDN.isEmpty()) {
+            baseDN = DEFAULT_BASE_DN;
+        }
+        if (bindHost == null || bindHost.isEmpty()) {
+            bindHost = DEFAULT_BIND_HOST;
+        }
+        this.bindPort = (bindPort == null || bindPort.isEmpty()) ? DEFAULT_BIND_PORT : Integer.parseInt(bindPort);
+        if (ldifFile == null || ldifFile.isEmpty()) {
+            ldifFile = DEFAULT_LDIF_FILE;
+        }
+
+        if (kerberosRealm == null || kerberosRealm.isEmpty()) {
+            kerberosRealm = DEFAULT_KERBEROS_REALM;
+        }
+        this.kdcPort = (kdcPort == null || kdcPort.isEmpty()) ? DEFAULT_KDC_PORT : Integer.parseInt(kdcPort);
+    }
+
+
+    public LDAPEmbeddedServer createLdapServer() {
+
+        // Override LDIF file with default for embedded LDAP
+        if (ldifFile.equals(DEFAULT_KERBEROS_LDIF_FILE)) {
+            ldifFile = DEFAULT_LDIF_FILE;
+        }
+
+        return new LDAPEmbeddedServer(baseDN, bindHost, bindPort, ldifFile);
+    }
+
+
+    public KerberosEmbeddedServer createKerberosServer() {
+
+        // Override LDIF file with default for embedded Kerberos
+        if (ldifFile.equals(DEFAULT_LDIF_FILE)) {
+            ldifFile = DEFAULT_KERBEROS_LDIF_FILE;
+        }
+
+        return new KerberosEmbeddedServer(baseDN, bindHost, bindPort, ldifFile, kerberosRealm, kdcPort);
+    }
+}

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemoryDirectoryServiceFactory.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemoryDirectoryServiceFactory.java
new file mode 100644
index 0000000..bba4954
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemoryDirectoryServiceFactory.java
@@ -0,0 +1,144 @@
+package org.keycloak.testutils.ldap;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.List;
+import net.sf.ehcache.CacheManager;
+import net.sf.ehcache.config.CacheConfiguration;
+import net.sf.ehcache.config.Configuration;
+import org.apache.commons.io.FileUtils;
+import org.apache.directory.api.ldap.model.constants.SchemaConstants;
+import org.apache.directory.api.ldap.model.schema.LdapComparator;
+import org.apache.directory.api.ldap.model.schema.SchemaManager;
+import org.apache.directory.api.ldap.model.schema.comparators.NormalizingComparator;
+import org.apache.directory.api.ldap.model.schema.registries.ComparatorRegistry;
+import org.apache.directory.api.ldap.model.schema.registries.SchemaLoader;
+import org.apache.directory.api.ldap.schemaloader.JarLdifSchemaLoader;
+import org.apache.directory.api.ldap.schemamanager.impl.DefaultSchemaManager;
+import org.apache.directory.api.util.exception.Exceptions;
+import org.apache.directory.server.constants.ServerDNConstants;
+import org.apache.directory.server.core.DefaultDirectoryService;
+import org.apache.directory.server.core.api.CacheService;
+import org.apache.directory.server.core.api.DirectoryService;
+import org.apache.directory.server.core.api.InstanceLayout;
+import org.apache.directory.server.core.api.partition.Partition;
+import org.apache.directory.server.core.api.schema.SchemaPartition;
+import org.apache.directory.server.core.factory.AvlPartitionFactory;
+import org.apache.directory.server.core.factory.DirectoryServiceFactory;
+import org.apache.directory.server.core.factory.PartitionFactory;
+import org.apache.directory.server.i18n.I18n;
+import org.jboss.logging.Logger;
+
+/**
+ * Factory for a fast (mostly in-memory-only) ApacheDS DirectoryService. Use only for tests!!
+ *
+ * @author Josef Cacek
+ */
+class InMemoryDirectoryServiceFactory implements DirectoryServiceFactory {
+
+    private static final Logger log = Logger.getLogger(InMemoryDirectoryServiceFactory.class);
+
+    private final DirectoryService directoryService;
+    private final PartitionFactory partitionFactory;
+
+    /**
+     * Default constructor which creates {@link DefaultDirectoryService} instance and configures {@link AvlPartitionFactory} as
+     * the {@link PartitionFactory} implementation.
+     */
+    public InMemoryDirectoryServiceFactory() {
+        try {
+            directoryService = new DefaultDirectoryService();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+        directoryService.setShutdownHookEnabled(false);
+        partitionFactory = new AvlPartitionFactory();
+    }
+
+    /**
+     * Constructor which uses provided {@link DirectoryService} and {@link PartitionFactory} implementations.
+     *
+     * @param directoryService must be not-<code>null</code>
+     * @param partitionFactory must be not-<code>null</code>
+     */
+    public InMemoryDirectoryServiceFactory(DirectoryService directoryService, PartitionFactory partitionFactory) {
+        this.directoryService = directoryService;
+        this.partitionFactory = partitionFactory;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public void init(String name) throws Exception {
+        if ((directoryService != null) && directoryService.isStarted()) {
+            return;
+        }
+        directoryService.setInstanceId(name);
+
+        // instance layout
+        InstanceLayout instanceLayout = new InstanceLayout(System.getProperty("java.io.tmpdir") + "/server-work-" + name);
+        if (instanceLayout.getInstanceDirectory().exists()) {
+            try {
+                FileUtils.deleteDirectory(instanceLayout.getInstanceDirectory());
+            } catch (IOException e) {
+                log.warn("couldn't delete the instance directory before initializing the DirectoryService", e);
+            }
+        }
+        directoryService.setInstanceLayout(instanceLayout);
+
+        // EhCache in disabled-like-mode
+        Configuration ehCacheConfig = new Configuration();
+        CacheConfiguration defaultCache = new CacheConfiguration("default", 1).eternal(false).timeToIdleSeconds(30)
+                .timeToLiveSeconds(30).overflowToDisk(false);
+        ehCacheConfig.addDefaultCache(defaultCache);
+        CacheService cacheService = new CacheService(new CacheManager(ehCacheConfig));
+        directoryService.setCacheService(cacheService);
+
+        // Init the schema
+        // SchemaLoader loader = new SingleLdifSchemaLoader();
+        SchemaLoader loader = new JarLdifSchemaLoader();
+        SchemaManager schemaManager = new DefaultSchemaManager(loader);
+        schemaManager.loadAllEnabled();
+        ComparatorRegistry comparatorRegistry = schemaManager.getComparatorRegistry();
+        for (LdapComparator<?> comparator : comparatorRegistry) {
+            if (comparator instanceof NormalizingComparator) {
+                ((NormalizingComparator) comparator).setOnServer();
+            }
+        }
+        directoryService.setSchemaManager(schemaManager);
+        InMemorySchemaPartition inMemorySchemaPartition = new InMemorySchemaPartition(schemaManager);
+        SchemaPartition schemaPartition = new SchemaPartition(schemaManager);
+        schemaPartition.setWrappedPartition(inMemorySchemaPartition);
+        directoryService.setSchemaPartition(schemaPartition);
+        List<Throwable> errors = schemaManager.getErrors();
+        if (errors.size() != 0) {
+            throw new Exception(I18n.err(I18n.ERR_317, Exceptions.printErrors(errors)));
+        }
+
+        // Init system partition
+        Partition systemPartition = partitionFactory.createPartition(directoryService.getSchemaManager(),
+                directoryService.getDnFactory(), "system",
+                ServerDNConstants.SYSTEM_DN, 500,
+                new File(directoryService.getInstanceLayout().getPartitionsDirectory(),
+                        "system"));
+
+        systemPartition.setSchemaManager(directoryService.getSchemaManager());
+        partitionFactory.addIndex(systemPartition, SchemaConstants.OBJECT_CLASS_AT, 100);
+        directoryService.setSystemPartition(systemPartition);
+        directoryService.startup();
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public DirectoryService getDirectoryService() throws Exception {
+        return directoryService;
+    }
+
+    /**
+     * {@inheritDoc}
+     */
+    public PartitionFactory getPartitionFactory() throws Exception {
+        return partitionFactory;
+    }
+}
\ No newline at end of file

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemorySchemaPartition.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemorySchemaPartition.java
new file mode 100644
index 0000000..a5fed44
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/InMemorySchemaPartition.java
@@ -0,0 +1,75 @@
+package org.keycloak.testutils.ldap;
+
+import java.net.URL;
+import java.util.Map;
+import java.util.TreeSet;
+import java.util.UUID;
+import java.util.regex.Pattern;
+import javax.naming.InvalidNameException;
+import org.apache.directory.api.ldap.model.constants.SchemaConstants;
+import org.apache.directory.api.ldap.model.entry.DefaultEntry;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.ldif.LdifEntry;
+import org.apache.directory.api.ldap.model.ldif.LdifReader;
+import org.apache.directory.api.ldap.model.schema.SchemaManager;
+import org.apache.directory.api.ldap.schemaextractor.impl.DefaultSchemaLdifExtractor;
+import org.apache.directory.api.ldap.schemaextractor.impl.ResourceMap;
+import org.apache.directory.server.core.api.interceptor.context.AddOperationContext;
+import org.apache.directory.server.core.partition.ldif.AbstractLdifPartition;
+import org.jboss.logging.Logger;
+
+/**
+ * In-memory schema-only partition which loads the data in the similar way as the
+ * {@link org.apache.directory.api.ldap.schemaloader.JarLdifSchemaLoader}.
+ *
+ * @author Josef Cacek
+ */
+class InMemorySchemaPartition extends AbstractLdifPartition {
+
+    private static final Logger log = Logger.getLogger(InMemorySchemaPartition.class);
+
+    /**
+     * Filesystem path separator pattern, either forward slash or backslash. java.util.regex.Pattern is immutable so only one
+     * instance is needed for all uses.
+     */
+    public InMemorySchemaPartition(SchemaManager schemaManager) {
+        super(schemaManager);
+    }
+
+    /**
+     * Partition initialization - loads schema entries from the files on classpath.
+     *
+     * @see org.apache.directory.server.core.partition.impl.avl.AvlPartition#doInit()
+     */
+    @Override
+    protected void doInit() throws InvalidNameException, Exception {
+        if (initialized)
+            return;
+        log.debug("Initializing schema partition " + getId());
+        suffixDn.apply(schemaManager);
+        super.doInit();
+
+        // load schema
+        final Map<String, Boolean> resMap = ResourceMap.getResources(Pattern.compile("schema[/\\Q\\\\E]ou=schema.*"));
+        for (String resourcePath : new TreeSet<String>(resMap.keySet())) {
+            if (resourcePath.endsWith(".ldif")) {
+                URL resource = DefaultSchemaLdifExtractor.getUniqueResource(resourcePath, "Schema LDIF file");
+                LdifReader reader = new LdifReader(resource.openStream());
+                LdifEntry ldifEntry = reader.next();
+                reader.close();
+                Entry entry = new DefaultEntry(schemaManager, ldifEntry.getEntry());
+
+                // add mandatory attributes
+                if (entry.get(SchemaConstants.ENTRY_CSN_AT) == null) {
+                    entry.add(SchemaConstants.ENTRY_CSN_AT, defaultCSNFactory.newInstance().toString());
+                }
+                if (entry.get(SchemaConstants.ENTRY_UUID_AT) == null) {
+                    entry.add(SchemaConstants.ENTRY_UUID_AT, UUID.randomUUID().toString());
+                }
+                AddOperationContext addContext = new AddOperationContext(null, entry);
+                super.add(addContext);
+            }
+        }
+    }
+
+}

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java
new file mode 100644
index 0000000..635c817
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java
@@ -0,0 +1,183 @@
+package org.keycloak.testutils.ldap;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+
+import javax.security.auth.kerberos.KerberosPrincipal;
+
+import org.apache.directory.api.ldap.model.constants.SupportedSaslMechanisms;
+import org.apache.directory.api.ldap.model.exception.LdapInvalidDnException;
+import org.apache.directory.server.core.api.DirectoryService;
+import org.apache.directory.server.core.kerberos.KeyDerivationInterceptor;
+import org.apache.directory.server.kerberos.KerberosConfig;
+import org.apache.directory.server.kerberos.kdc.KdcServer;
+import org.apache.directory.server.kerberos.shared.replay.ReplayCache;
+import org.apache.directory.server.ldap.LdapServer;
+import org.apache.directory.server.ldap.handlers.sasl.cramMD5.CramMd5MechanismHandler;
+import org.apache.directory.server.ldap.handlers.sasl.digestMD5.DigestMd5MechanismHandler;
+import org.apache.directory.server.ldap.handlers.sasl.gssapi.GssapiMechanismHandler;
+import org.apache.directory.server.ldap.handlers.sasl.ntlm.NtlmMechanismHandler;
+import org.apache.directory.server.ldap.handlers.sasl.plain.PlainMechanismHandler;
+import org.apache.directory.server.protocol.shared.transport.UdpTransport;
+import org.apache.directory.shared.kerberos.KerberosTime;
+import org.jboss.logging.Logger;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class KerberosEmbeddedServer extends LDAPEmbeddedServer {
+
+    private static final Logger log = Logger.getLogger(LDAPEmbeddedServer.class);
+
+    private final String kerberosRealm;
+    private final int kdcPort;
+
+    private KdcServer kdcServer;
+
+
+    public static void main(String[] args) throws Exception {
+        EmbeddedServersFactory factory = EmbeddedServersFactory.readConfiguration();
+        KerberosEmbeddedServer kerberosEmbeddedServer = factory.createKerberosServer();
+        kerberosEmbeddedServer.init();
+        kerberosEmbeddedServer.start();
+    }
+
+
+    protected KerberosEmbeddedServer(String baseDN, String bindHost, int bindPort, String ldifFile, String kerberosRealm, int kdcPort) {
+        super(baseDN, bindHost, bindPort, ldifFile);
+        this.kerberosRealm = kerberosRealm;
+        this.kdcPort = kdcPort;
+    }
+
+
+    @Override
+    public void init() throws Exception {
+        super.init();
+
+        log.info("Creating KDC server");
+        createAndStartKdcServer();
+    }
+
+
+    @Override
+    protected DirectoryService createDirectoryService() throws Exception {
+        DirectoryService directoryService = super.createDirectoryService();
+
+        directoryService.addLast(new KeyDerivationInterceptor());
+        return directoryService;
+    }
+
+
+    @Override
+    protected LdapServer createLdapServer() {
+        LdapServer ldapServer = super.createLdapServer();
+
+        ldapServer.setSaslHost( this.bindHost );
+        ldapServer.setSaslPrincipal( "ldap/" + this.bindHost + "@" + this.kerberosRealm);
+
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.PLAIN, new PlainMechanismHandler());
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.CRAM_MD5, new CramMd5MechanismHandler());
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.DIGEST_MD5, new DigestMd5MechanismHandler());
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.GSSAPI, new GssapiMechanismHandler());
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.NTLM, new NtlmMechanismHandler());
+        ldapServer.addSaslMechanismHandler(SupportedSaslMechanisms.GSS_SPNEGO, new NtlmMechanismHandler());
+
+        return ldapServer;
+    }
+
+
+    protected KdcServer createAndStartKdcServer() throws Exception {
+        KerberosConfig kdcConfig = new KerberosConfig();
+        kdcConfig.setServicePrincipal("krbtgt/" + this.kerberosRealm + "@" + this.kerberosRealm);
+        kdcConfig.setPrimaryRealm(this.kerberosRealm);
+        kdcConfig.setMaximumTicketLifetime(60000 * 1440);
+        kdcConfig.setMaximumRenewableLifetime(60000 * 10080);
+        kdcConfig.setPaEncTimestampRequired(false);
+
+        kdcServer = new NoReplayKdcServer(kdcConfig);
+        kdcServer.setSearchBaseDn(this.baseDN);
+
+        UdpTransport udp = new UdpTransport(this.bindHost, this.kdcPort);
+        kdcServer.addTransports(udp);
+
+        kdcServer.setDirectoryService(directoryService);
+
+        // Launch the server
+        kdcServer.start();
+
+        return kdcServer;
+    }
+
+
+    public void stop() throws Exception {
+        stopLdapServer();
+        stopKerberosServer();
+        shutdownDirectoryService();
+    }
+
+
+    protected void stopKerberosServer() {
+        log.info("Stoping Kerberos server.");
+        kdcServer.stop();
+    }
+
+
+    /**
+     * Replacement of apacheDS KdcServer class with disabled ticket replay cache.
+     *
+     * @author Dominik Pospisil <dpospisi@redhat.com>
+     */
+    class NoReplayKdcServer extends KdcServer {
+
+        NoReplayKdcServer(KerberosConfig kdcConfig) {
+            super(kdcConfig);
+        }
+
+        /**
+         *
+         * Dummy implementation of the ApacheDS kerberos replay cache. Essentially disables kerbores ticket replay checks.
+         * https://issues.jboss.org/browse/JBPAPP-10974
+         *
+         * @author Dominik Pospisil <dpospisi@redhat.com>
+         */
+        private class DummyReplayCache implements ReplayCache {
+
+            @Override
+            public boolean isReplay(KerberosPrincipal serverPrincipal, KerberosPrincipal clientPrincipal, KerberosTime clientTime,
+                                    int clientMicroSeconds) {
+                return false;
+            }
+
+            @Override
+            public void save(KerberosPrincipal serverPrincipal, KerberosPrincipal clientPrincipal, KerberosTime clientTime,
+                             int clientMicroSeconds) {
+                return;
+            }
+
+            @Override
+            public void clear() {
+                return;
+            }
+
+        }
+
+        /**
+         * @throws java.io.IOException if we cannot bind to the sockets
+         */
+        @Override
+        public void start() throws IOException, LdapInvalidDnException {
+            super.start();
+
+            try {
+
+                // override initialized replay cache with a dummy implementation
+                Field replayCacheField = KdcServer.class.getDeclaredField("replayCache");
+                replayCacheField.setAccessible(true);
+                replayCacheField.set(this, new DummyReplayCache());
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+
+        }
+    }
+}

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosKeytabCreator.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosKeytabCreator.java
new file mode 100644
index 0000000..aa26153
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosKeytabCreator.java
@@ -0,0 +1,70 @@
+package org.keycloak.testutils.ldap;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.directory.server.kerberos.shared.crypto.encryption.KerberosKeyFactory;
+import org.apache.directory.server.kerberos.shared.keytab.Keytab;
+import org.apache.directory.server.kerberos.shared.keytab.KeytabEntry;
+import org.apache.directory.shared.kerberos.KerberosTime;
+import org.apache.directory.shared.kerberos.codec.types.EncryptionType;
+import org.apache.directory.shared.kerberos.components.EncryptionKey;
+
+/**
+ * Helper utility for creating Keytab files.
+ *
+ * @author Josef Cacek
+ */
+public class KerberosKeytabCreator {
+
+    // Public methods --------------------------------------------------------
+
+    /**
+     * The main.
+     *
+     * @param args
+     * @throws java.io.IOException
+     */
+    public static void main(String[] args) throws IOException {
+        if (args == null || args.length != 3) {
+            System.out.println("Kerberos keytab generator");
+            System.out.println("-------------------------");
+            System.out.println("Arguments missing or invalid. Required arguments are: <principalName> <passPhrase> <outputKeytabFile>");
+            System.out.println("Example of usage:");
+            System.out.println("mvn exec:java -Dexec.mainClass=\"org.keycloak.testutils.ldap.KerberosKeytabCreator\" -Dexec.args=\"HTTP/localhost@KEYCLOAK.ORG httppwd src/main/resources/kerberos/http.keytab\"");
+        } else {
+            final File keytabFile = new File(args[2]);
+            createKeytab(args[0], args[1], keytabFile);
+            System.out.println("Keytab file was created: " + keytabFile.getAbsolutePath() + ", principal: " + args[0] + ", passphrase: " + args[1]);
+        }
+    }
+
+    /**
+     * Creates a keytab file for given principal.
+     *
+     * @param principalName
+     * @param passPhrase
+     * @param keytabFile
+     * @throws IOException
+     */
+    public static void createKeytab(final String principalName, final String passPhrase, final File keytabFile)
+            throws IOException {
+        final KerberosTime timeStamp = new KerberosTime();
+        final int principalType = 1; // KRB5_NT_PRINCIPAL
+
+        final Keytab keytab = Keytab.getInstance();
+        final List<KeytabEntry> entries = new ArrayList<KeytabEntry>();
+        for (Map.Entry<EncryptionType, EncryptionKey> keyEntry : KerberosKeyFactory.getKerberosKeys(principalName, passPhrase)
+                .entrySet()) {
+            System.out.println("Adding keytab entry of type: " + keyEntry.getKey().getName());
+            final EncryptionKey key = keyEntry.getValue();
+            final byte keyVersion = (byte) key.getKeyVersion();
+            entries.add(new KeytabEntry(principalName, principalType, timeStamp, keyVersion, key));
+        }
+        keytab.setEntries(entries);
+        keytab.write(keytabFile);
+    }
+}

diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/LDAPEmbeddedServer.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/LDAPEmbeddedServer.java
new file mode 100644
index 0000000..9c18288
--- /dev/null
+++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/LDAPEmbeddedServer.java
@@ -0,0 +1,186 @@
+package org.keycloak.testutils.ldap;
+
+import java.io.File;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang.text.StrSubstitutor;
+import org.apache.directory.api.ldap.model.entry.DefaultEntry;
+import org.apache.directory.api.ldap.model.exception.LdapEntryAlreadyExistsException;
+import org.apache.directory.api.ldap.model.ldif.LdifEntry;
+import org.apache.directory.api.ldap.model.ldif.LdifReader;
+import org.apache.directory.api.ldap.model.schema.SchemaManager;
+import org.apache.directory.server.core.api.DirectoryService;
+import org.apache.directory.server.core.api.partition.Partition;
+import org.apache.directory.server.core.factory.DSAnnotationProcessor;
+import org.apache.directory.server.core.factory.PartitionFactory;
+import org.apache.directory.server.ldap.LdapServer;
+import org.apache.directory.server.protocol.shared.transport.TcpTransport;
+import org.apache.directory.server.protocol.shared.transport.Transport;
+import org.jboss.logging.Logger;
+import org.keycloak.util.StreamUtil;
+
+/**
+ * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
+ */
+public class LDAPEmbeddedServer {
+
+    private static final Logger log = Logger.getLogger(LDAPEmbeddedServer.class);
+
+    protected final String baseDN;
+    protected final String bindHost;
+    protected final int bindPort;
+    protected final String ldifFile;
+
+    protected DirectoryService directoryService;
+    protected LdapServer ldapServer;
+
+
+    public static void main(String[] args) throws Exception {
+        EmbeddedServersFactory factory = EmbeddedServersFactory.readConfiguration();
+        LDAPEmbeddedServer ldapEmbeddedServer = factory.createLdapServer();
+        ldapEmbeddedServer.init();
+        ldapEmbeddedServer.start();
+    }
+
+    public LDAPEmbeddedServer(String baseDN, String bindHost, int bindPort, String ldifFile) {
+        this.baseDN = baseDN;
+        this.bindHost = bindHost;
+        this.bindPort = bindPort;
+        this.ldifFile = ldifFile;
+    }
+
+
+    public void init() throws Exception {
+        log.info("Creating LDAP Directory Service. Config: baseDN=" + baseDN + ", bindHost=" + bindHost + ", bindPort=" + bindPort);
+        this.directoryService = createDirectoryService();
+
+        log.info("Importing LDIF: " + ldifFile);
+        importLdif();
+
+        log.info("Creating LDAP Server");
+        this.ldapServer = createLdapServer();
+    }
+
+
+    public void start() throws Exception {
+        log.info("Starting LDAP Server");
+        ldapServer.start();
+        log.info("LDAP Server started");
+    }
+
+
+    protected DirectoryService createDirectoryService() throws Exception {
+        // Parse "keycloak" from "dc=keycloak,dc=org"
+        String dcName = baseDN.split(",")[0].substring(3);
+
+        InMemoryDirectoryServiceFactory dsf = new InMemoryDirectoryServiceFactory();
+
+        DirectoryService service = dsf.getDirectoryService();
+        service.setAccessControlEnabled(false);
+        service.setAllowAnonymousAccess(false);
+        service.getChangeLog().setEnabled(false);
+
+        dsf.init(dcName + "DS");
+
+        SchemaManager schemaManager = service.getSchemaManager();
+
+        PartitionFactory partitionFactory = dsf.getPartitionFactory();
+        Partition partition = partitionFactory.createPartition(
+                schemaManager,
+                service.getDnFactory(),
+                dcName,
+                this.baseDN,
+                1000,
+                new File(service.getInstanceLayout().getPartitionsDirectory(), dcName));
+        partition.setCacheService( service.getCacheService() );
+        partition.initialize();
+
+        partition.setSchemaManager( schemaManager );
+
+        // Inject the partition into the DirectoryService
+        service.addPartition( partition );
+
+        // Last, process the context entry
+        String entryLdif =
+                "dn: " + baseDN + "\n" +
+                        "dc: " + dcName + "\n" +
+                        "objectClass: top\n" +
+                        "objectClass: domain\n\n";
+        DSAnnotationProcessor.injectEntries(service, entryLdif);
+
+        return service;
+    }
+
+
+    protected LdapServer createLdapServer() {
+        LdapServer ldapServer = new LdapServer();
+
+        ldapServer.setServiceName("DefaultLdapServer");
+
+        // Read the transports
+        Transport ldap = new TcpTransport(this.bindHost, this.bindPort, 3, 50);
+        ldapServer.addTransports( ldap );
+
+        // Associate the DS to this LdapServer
+        ldapServer.setDirectoryService( directoryService );
+
+        // Propagate the anonymous flag to the DS
+        directoryService.setAllowAnonymousAccess(false);
+
+        ldapServer.setSaslHost( this.bindHost );
+        ldapServer.setSaslPrincipal( "ldap/" + this.bindHost + "@KEYCLOAK.ORG");
+        ldapServer.setSaslRealms(new ArrayList<String>());
+        return ldapServer;
+    }
+
+
+    private void importLdif() throws Exception {
+        Map<String, String> map = new HashMap<String, String>();
+        map.put("hostname", this.bindHost);
+
+        // For now, assume that LDIF file is on classpath
+        InputStream is = getClass().getClassLoader().getResourceAsStream(ldifFile);
+        if (is == null) {
+            throw new IllegalStateException("LDIF file not found on classpath. Location was: " + ldifFile);
+        }
+
+        final String ldifContent = StrSubstitutor.replace(StreamUtil.readString(is), map);
+        log.info("Importing LDIF: " + ldifContent);
+        final SchemaManager schemaManager = directoryService.getSchemaManager();
+
+        for (LdifEntry ldifEntry : new LdifReader(IOUtils.toInputStream(ldifContent))) {
+            try {
+                directoryService.getAdminSession().add(new DefaultEntry(schemaManager, ldifEntry.getEntry()));
+            } catch (LdapEntryAlreadyExistsException ignore) {
+                log.debug("Entry " + ldifEntry.getNewRdn() + " already exists. Ignoring");
+            }
+        }
+    }
+
+
+    public void stop() throws Exception {
+        stopLdapServer();
+        shutdownDirectoryService();
+    }
+
+
+    protected void stopLdapServer() {
+        log.info("Stoping LDAP server.");
+        ldapServer.stop();
+    }
+
+
+    protected void shutdownDirectoryService() throws Exception {
+        log.info("Stoping Directory service.");
+        directoryService.shutdown();
+
+        log.info("Removing Directory service workfiles.");
+        FileUtils.deleteDirectory(directoryService.getInstanceLayout().getInstanceDirectory());
+    }
+
+}

diff --git a/testsuite/integration/src/main/resources/kerberos/http.keytab b/testsuite/integration/src/main/resources/kerberos/http.keytab
new file mode 100644
index 0000000..c156500
Binary files /dev/null and b/testsuite/integration/src/main/resources/kerberos/http.keytab differ

diff --git a/testsuite/integration/src/main/resources/kerberos/users-kerberos.ldif b/testsuite/integration/src/main/resources/kerberos/users-kerberos.ldif
new file mode 100644
index 0000000..fcde10e
--- /dev/null
+++ b/testsuite/integration/src/main/resources/kerberos/users-kerberos.ldif
@@ -0,0 +1,88 @@
+dn: dc=keycloak,dc=org
+objectclass: dcObject
+objectclass: organization
+o: Keycloak
+dc: Keycloak
+
+dn: ou=People,dc=keycloak,dc=org
+objectClass: organizationalUnit
+objectClass: top
+ou: People
+
+dn: uid=krbtgt,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: KDC Service
+sn: Service
+uid: krbtgt
+userPassword: secret
+krb5PrincipalName: krbtgt/KEYCLOAK.ORG@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0
+
+dn: uid=ldap,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: LDAP
+sn: Service
+uid: ldap
+userPassword: randall
+krb5PrincipalName: ldap/${hostname}@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0
+
+dn: uid=HTTP,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: HTTP
+sn: Service
+uid: HTTP
+userPassword: httppwd
+krb5PrincipalName: HTTP/${hostname}@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0
+
+dn: uid=hnelson,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: Horatio Nelson
+sn: Nelson
+uid: hnelson
+userPassword: secret
+krb5PrincipalName: hnelson@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0
+
+dn: uid=jduke,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: Java Duke
+sn: duke
+uid: jduke
+userPassword: theduke
+krb5PrincipalName: jduke@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0
+
+dn: uid=gsstestserver,ou=People,dc=keycloak,dc=org
+objectClass: top
+objectClass: person
+objectClass: inetOrgPerson
+objectClass: krb5principal
+objectClass: krb5kdcentry
+cn: gsstestserver
+sn: Service
+uid: gsstestserver
+userPassword: gsstestpwd
+krb5PrincipalName: gsstestserver/xxx@KEYCLOAK.ORG
+krb5KeyVersionNumber: 0

diff --git a/testsuite/integration/src/main/resources/log4j.properties b/testsuite/integration/src/main/resources/log4j.properties
index 573c238..5e78b31 100755
--- a/testsuite/integration/src/main/resources/log4j.properties
+++ b/testsuite/integration/src/main/resources/log4j.properties
@@ -19,6 +19,11 @@ log4j.logger.org.keycloak=info
 # Enable to view kerberos/spnego logging
 # log4j.logger.org.keycloak.broker.kerberos=trace
 
+# Enable to view detailed AS REQ and TGS REQ requests to embedded Kerberos server
+log4j.logger.org.apache.directory.server.kerberos=debug
+
 log4j.logger.org.xnio=off
 log4j.logger.org.hibernate=off
-log4j.logger.org.jboss.resteasy=warn
\ No newline at end of file
+log4j.logger.org.jboss.resteasy=warn
+log4j.logger.org.apache.directory.api=warn
+log4j.logger.org.apache.directory.server.core=warn
\ No newline at end of file

diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/AbstractIdentityProviderModelTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/AbstractIdentityProviderModelTest.java
index 45f638c..2dd3164 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/AbstractIdentityProviderModelTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/AbstractIdentityProviderModelTest.java
@@ -18,7 +18,6 @@
 package org.keycloak.testsuite.broker;
 
 import org.junit.Before;
-import org.keycloak.broker.kerberos.KerberosIdentityProviderFactory;
 import org.keycloak.broker.oidc.OIDCIdentityProviderFactory;
 import org.keycloak.broker.saml.SAMLIdentityProviderFactory;
 import org.keycloak.social.facebook.FacebookIdentityProviderFactory;
@@ -48,7 +47,6 @@ public abstract class AbstractIdentityProviderModelTest extends AbstractModelTes
         this.expectedProviders.add(FacebookIdentityProviderFactory.PROVIDER_ID);
         this.expectedProviders.add(GitHubIdentityProviderFactory.PROVIDER_ID);
         this.expectedProviders.add(TwitterIdentityProviderFactory.PROVIDER_ID);
-        this.expectedProviders.add(KerberosIdentityProviderFactory.PROVIDER_ID);
 
         this.expectedProviders = Collections.unmodifiableSet(this.expectedProviders);
     }

diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/ImportIdentityProviderTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/ImportIdentityProviderTest.java
index 9b9d723..36d2bda 100644
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/ImportIdentityProviderTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/broker/ImportIdentityProviderTest.java
@@ -18,9 +18,6 @@
 package org.keycloak.testsuite.broker;
 
 import org.junit.Test;
-import org.keycloak.broker.kerberos.KerberosIdentityProvider;
-import org.keycloak.broker.kerberos.KerberosIdentityProviderConfig;
-import org.keycloak.broker.kerberos.KerberosIdentityProviderFactory;
 import org.keycloak.broker.oidc.OAuth2IdentityProviderConfig;
 import org.keycloak.broker.oidc.OIDCIdentityProvider;
 import org.keycloak.broker.oidc.OIDCIdentityProviderConfig;
@@ -157,8 +154,6 @@ public class ImportIdentityProviderTest extends AbstractIdentityProviderModelTes
                     assertGitHubIdentityProviderConfig(identityProvider);
                 } else if (TwitterIdentityProviderFactory.PROVIDER_ID.equals(providerId)) {
                     assertTwitterIdentityProviderConfig(identityProvider);
-                } else if (KerberosIdentityProviderFactory.PROVIDER_ID.equals(providerId)) {
-                    assertKerberosIdentityProviderConfig(identityProvider);
                 } else {
                     continue;
                 }
@@ -276,21 +271,6 @@ public class ImportIdentityProviderTest extends AbstractIdentityProviderModelTes
         assertEquals("clientSecret", config.getClientSecret());
     }
 
-    private void assertKerberosIdentityProviderConfig(IdentityProviderModel identityProvider) {
-        KerberosIdentityProvider kerberosIdentityProvider = new KerberosIdentityProviderFactory().create(identityProvider);
-        KerberosIdentityProviderConfig config = kerberosIdentityProvider.getConfig();
-
-        assertEquals("model-kerberos", config.getId());
-        assertEquals(KerberosIdentityProviderFactory.PROVIDER_ID, config.getProviderId());
-        assertEquals("Kerberos", config.getName());
-        assertEquals(true, config.isEnabled());
-        assertEquals(true, config.isUpdateProfileFirstLogin());
-        assertEquals(false, config.isAuthenticateByDefault());
-        assertEquals("HTTP/server.domain.org@DOMAIN.ORG", config.getServerPrincipal());
-        assertEquals("/etc/http.keytab", config.getKeyTab());
-        assertTrue(config.getDebug());
-    }
-
     private RealmModel installTestRealm() throws IOException {
         RealmRepresentation realmRepresentation = loadJson("broker-test/test-realm-with-broker.json");
 

diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/FederationProvidersIntegrationTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/FederationProvidersIntegrationTest.java
index 1146257..833e56c 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/FederationProvidersIntegrationTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/FederationProvidersIntegrationTest.java
@@ -33,7 +33,6 @@ import org.keycloak.testsuite.rule.KeycloakRule;
 import org.keycloak.testsuite.rule.LDAPRule;
 import org.keycloak.testsuite.rule.WebResource;
 import org.keycloak.testsuite.rule.WebRule;
-import org.keycloak.testutils.LDAPEmbeddedServer;
 import org.openqa.selenium.WebDriver;
 import org.picketlink.idm.PartitionManager;
 import org.picketlink.idm.model.basic.User;
@@ -56,8 +55,7 @@ public class FederationProvidersIntegrationTest {
         public void config(RealmManager manager, RealmModel adminstrationRealm, RealmModel appRealm) {
             addUser(manager.getSession(), appRealm, "mary", "mary@test.com", "password-app");
 
-            LDAPEmbeddedServer ldapServer = ldapRule.getEmbeddedServer();
-            Map<String,String> ldapConfig = ldapServer.getLDAPConfig();
+            Map<String,String> ldapConfig = ldapRule.getLdapConfig();
             ldapConfig.put(LDAPFederationProvider.SYNC_REGISTRATIONS, "true");
             ldapConfig.put(LDAPFederationProvider.EDIT_MODE, UserFederationProvider.EditMode.WRITABLE.toString());
 

diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/SyncProvidersTest.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/SyncProvidersTest.java
index f256ee0..917a544 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/SyncProvidersTest.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/forms/SyncProvidersTest.java
@@ -22,7 +22,6 @@ import org.keycloak.services.managers.UsersSyncManager;
 import org.keycloak.testsuite.rule.KeycloakRule;
 import org.keycloak.testsuite.rule.LDAPRule;
 import org.keycloak.testutils.DummyUserFederationProviderFactory;
-import org.keycloak.testutils.LDAPEmbeddedServer;
 import org.keycloak.timer.TimerProvider;
 import org.keycloak.util.Time;
 import org.picketlink.idm.PartitionManager;
@@ -49,8 +48,7 @@ public class SyncProvidersTest {
             // Other tests may left Time offset uncleared, which could cause issues
             Time.setOffset(0);
 
-            LDAPEmbeddedServer ldapServer = ldapRule.getEmbeddedServer();
-            Map<String,String> ldapConfig = ldapServer.getLDAPConfig();
+            Map<String,String> ldapConfig = ldapRule.getLdapConfig();
             ldapConfig.put(LDAPFederationProvider.SYNC_REGISTRATIONS, "false");
             ldapConfig.put(LDAPFederationProvider.EDIT_MODE, UserFederationProvider.EditMode.UNSYNCED.toString());
 

diff --git a/testsuite/integration/src/test/java/org/keycloak/testsuite/rule/LDAPRule.java b/testsuite/integration/src/test/java/org/keycloak/testsuite/rule/LDAPRule.java
index 1c631bb..5b12037 100755
--- a/testsuite/integration/src/test/java/org/keycloak/testsuite/rule/LDAPRule.java
+++ b/testsuite/integration/src/test/java/org/keycloak/testsuite/rule/LDAPRule.java
@@ -1,37 +1,46 @@
 package org.keycloak.testsuite.rule;
 
+import java.util.Map;
+
 import org.junit.rules.ExternalResource;
-import org.keycloak.testutils.LDAPEmbeddedServer;
+import org.keycloak.testutils.ldap.EmbeddedServersFactory;
+import org.keycloak.testutils.ldap.LDAPConfiguration;
+import org.keycloak.testutils.ldap.LDAPEmbeddedServer;
 
 /**
  * @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
  */
 public class LDAPRule extends ExternalResource {
 
-    private LDAPEmbeddedServer embeddedServer;
+    private LDAPConfiguration ldapConfiguration;
+    private LDAPEmbeddedServer ldapEmbeddedServer;
 
     @Override
     protected void before() throws Throwable {
-        try {
-            embeddedServer = new LDAPEmbeddedServer();
-            embeddedServer.setup();
-            embeddedServer.importLDIF("ldap/users.ldif");
-        } catch (Exception e) {
-            throw new RuntimeException("Error starting Embedded LDAP server.", e);
+        ldapConfiguration = LDAPConfiguration.readConfiguration();
+
+        if (ldapConfiguration.isStartEmbeddedLdapLerver()) {
+            EmbeddedServersFactory factory = EmbeddedServersFactory.readConfiguration();
+            ldapEmbeddedServer = factory.createLdapServer();
+            ldapEmbeddedServer.init();
+            ldapEmbeddedServer.start();
         }
     }
 
     @Override
     protected void after() {
         try {
-            embeddedServer.tearDown();
-            embeddedServer = null;
+            if (ldapEmbeddedServer != null) {
+                ldapEmbeddedServer.stop();
+                ldapEmbeddedServer = null;
+                ldapConfiguration = null;
+            }
         } catch (Exception e) {
             throw new RuntimeException("Error tearDown Embedded LDAP server.", e);
         }
     }
 
-    public LDAPEmbeddedServer getEmbeddedServer() {
-        return embeddedServer;
+    public Map<String, String> getLdapConfig() {
+        return ldapConfiguration.getLDAPConfig();
     }
 }