keycloak-aplcache

diff --git a/distribution/appliance-dist/assembly.xml b/distribution/appliance-dist/assembly.xml
index 228f0b9..73f33c7 100755
--- a/distribution/appliance-dist/assembly.xml
+++ b/distribution/appliance-dist/assembly.xml
@@ -21,6 +21,7 @@
             <excludes>
                 <exclude>**/*.sh</exclude>
                 <exclude>welcome-content/*</exclude>
+                <exclude>**/modules/system/layers/base/org/picketlink/**</exclude>
             </excludes>
         </fileSet>
         <fileSet>
@@ -32,6 +33,13 @@
             <fileMode>0755</fileMode>
         </fileSet>
         <fileSet>
+            <directory>${project.build.directory}/unpacked/modules</directory>
+            <outputDirectory>keycloak/modules/system/layers/base</outputDirectory>
+            <includes>
+                <include>org/picketlink/**</include>
+            </includes>
+        </fileSet>
+        <fileSet>
             <directory>${project.build.directory}/unpacked/deployments</directory>
             <outputDirectory>keycloak/standalone/deployments</outputDirectory>
             <excludes>

diff --git a/distribution/appliance-dist/pom.xml b/distribution/appliance-dist/pom.xml
index 9382e85..c75c5fc 100755
--- a/distribution/appliance-dist/pom.xml
+++ b/distribution/appliance-dist/pom.xml
@@ -90,6 +90,13 @@
                                     <outputDirectory>${project.build.directory}/unpacked/js-adapter</outputDirectory>
                                     <includes>*.js</includes>                                    
                                 </artifactItem>
+                                <artifactItem>
+                                    <groupId>org.keycloak</groupId>
+                                    <artifactId>keycloak-jboss-modules</artifactId>
+                                    <version>${project.version}</version>
+                                    <type>zip</type>
+                                    <outputDirectory>${project.build.directory}/unpacked/modules</outputDirectory>
+                                </artifactItem>
                             </artifactItems>
                             <excludes>**/welcome-content/*</excludes>
                         </configuration>

diff --git a/distribution/appliance-dist/src/main/xslt/standalone.xsl b/distribution/appliance-dist/src/main/xslt/standalone.xsl
index 64fda33..7b8ba53 100755
--- a/distribution/appliance-dist/src/main/xslt/standalone.xsl
+++ b/distribution/appliance-dist/src/main/xslt/standalone.xsl
@@ -46,6 +46,11 @@
                     <login-module code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
                 </authentication>
             </security-domain>
+            <security-domain name="sp" cache-type="default">
+                <authentication>
+                    <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+                </authentication>
+            </security-domain>
         </xsl:copy>
     </xsl:template>
 

diff --git a/distribution/as7-adapter-zip/assembly.xml b/distribution/as7-adapter-zip/assembly.xml
index 6a507fd..120549a 100755
--- a/distribution/as7-adapter-zip/assembly.xml
+++ b/distribution/as7-adapter-zip/assembly.xml
@@ -10,6 +10,7 @@
         <fileSet>
             <directory>${project.build.directory}/unpacked</directory>
             <excludes>
+                <exclude>org/picketlink/**</exclude>
                 <exclude>org/keycloak/keycloak-undertow-adapter/**</exclude>
                 <exclude>org/keycloak/keycloak-wildfly-subsystem/**</exclude>
                 <exclude>org/keycloak/keycloak-wildfly-adapter/**</exclude>

diff --git a/distribution/eap6-adapter-zip/assembly.xml b/distribution/eap6-adapter-zip/assembly.xml
index d3d334a..d3ac9a4 100755
--- a/distribution/eap6-adapter-zip/assembly.xml
+++ b/distribution/eap6-adapter-zip/assembly.xml
@@ -10,8 +10,10 @@
         <fileSet>
             <directory>${project.build.directory}/unpacked</directory>
             <excludes>
+                <exclude>org/picketlink/**</exclude>
                 <exclude>org/keycloak/keycloak-undertow-adapter/**</exclude>
                 <exclude>org/keycloak/keycloak-wildfly-subsystem/**</exclude>
+                <exclude>org/keycloak/keycloak-wildfly-adapter/**</exclude>
             </excludes>
             <outputDirectory>modules/system/layers/base</outputDirectory>
         </fileSet>

diff --git a/distribution/examples-docs-zip/build.xml b/distribution/examples-docs-zip/build.xml
index 65dd8e2..3e4f1dc 100755
--- a/distribution/examples-docs-zip/build.xml
+++ b/distribution/examples-docs-zip/build.xml
@@ -26,6 +26,14 @@
                 <exclude name="**/subsystem-config.xml"/>
             </fileset>
         </copy>
+        <copy todir="target/examples/saml" overwrite="true">
+            <fileset dir="../../examples/saml">
+                <exclude name="**/target/**"/>
+                <exclude name="**/*.iml"/>
+                <exclude name="**/*.unconfigured"/>
+                <exclude name="**/subsystem-config.xml"/>
+            </fileset>
+        </copy>
         <copy todir="target/examples/js-console" overwrite="true">
             <fileset dir="../../examples/js-console">
                 <exclude name="**/target/**"/>

diff --git a/distribution/modules/build.xml b/distribution/modules/build.xml
index 8503475..7495cdc 100755
--- a/distribution/modules/build.xml
+++ b/distribution/modules/build.xml
@@ -81,6 +81,35 @@
         <module-def name="org.keycloak.keycloak-as7-subsystem">
             <maven-resource group="org.keycloak" artifact="keycloak-as7-subsystem"/>
         </module-def>
+        <module-def name="org.picketlink">
+        </module-def>
+        <module-def name="org.picketlink.common">
+            <maven-resource group="org.picketlink" artifact="picketlink-common"/>
+        </module-def>
+        <module-def name="org.picketlink.config">
+            <maven-resource group="org.picketlink" artifact="picketlink-config"/>
+        </module-def>
+        <module-def name="org.picketlink.core">
+            <maven-resource group="org.picketlink" artifact="picketlink-impl"/>
+        </module-def>
+        <module-def name="org.picketlink.core.api">
+            <maven-resource group="org.picketlink" artifact="picketlink-api"/>
+        </module-def>
+        <module-def name="org.picketlink.federation">
+            <maven-resource group="org.picketlink" artifact="picketlink-federation"/>
+        </module-def>
+        <module-def name="org.picketlink.federation.bindings">
+            <maven-resource group="org.picketlink" artifact="picketlink-wildlfy-common"/>
+        </module-def>
+        <module-def name="org.picketlink.idm">
+            <maven-resource group="org.picketlink" artifact="picketlink-idm-impl"/>
+        </module-def>
+        <module-def name="org.picketlink.idm.api">
+            <maven-resource group="org.picketlink" artifact="picketlink-idm-api"/>
+        </module-def>
+        <module-def name="org.picketlink.idm.schema">
+            <maven-resource group="org.picketlink" artifact="picketlink-idm-simple-schema"/>
+        </module-def>
     </target>
 
     <target name="clean-target">

diff --git a/distribution/modules/pom.xml b/distribution/modules/pom.xml
index 800a182..6d8a003 100755
--- a/distribution/modules/pom.xml
+++ b/distribution/modules/pom.xml
@@ -83,6 +83,42 @@
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk16</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-common</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-federation</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-wildlfy-common</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-idm-simple-schema</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-config</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.picketlink</groupId>
+            <artifactId>picketlink-impl</artifactId>
+        </dependency>
 
     </dependencies>
 

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/common/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/common/main/module.xml
new file mode 100755
index 0000000..6602ccf
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/common/main/module.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.common">
+
+    <resources>
+        <!-- Insert resources here -->
+    </resources>
+
+    <dependencies>
+        <module name="javax.api"/>
+        <module name="javax.xml.stream.api"/>
+        <module name="org.jboss.logging"/>
+    </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/config/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/config/main/module.xml
new file mode 100755
index 0000000..9afbd36
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/config/main/module.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.config">
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.api"/>
+    <module name="org.picketlink.common"/>
+  </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/core/api/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/core/api/main/module.xml
new file mode 100755
index 0000000..eb62417
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/core/api/main/module.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.core.api">
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.enterprise.api" />
+    <module name="javax.inject.api" />
+    <module name="javax.servlet.api" optional="true" />
+    <module name="javax.persistence.api" optional="true" />
+    <module name="org.picketlink.common" />
+    <module name="org.jboss.logging"/>
+    <module name="org.picketlink.idm.api" export="true" />
+  </dependencies>
+</module>

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/core/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/core/main/module.xml
new file mode 100755
index 0000000..c9aad28
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/core/main/module.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.core">
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.enterprise.api" />
+    <module name="javax.inject.api" />
+    <module name="javax.servlet.api" optional="true" />
+    <module name="javax.persistence.api" optional="true" />
+    <module name="org.picketlink.common" />
+    <module name="org.jboss.logging"/>
+    <module name="org.picketlink.core.api" export="true" />
+    <module name="org.picketlink.idm.api" export="true" />
+    <module name="org.picketlink.idm" />
+  </dependencies>
+</module>

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/federation/bindings/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/federation/bindings/main/module.xml
new file mode 100755
index 0000000..ed09b9e
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/federation/bindings/main/module.xml
@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.federation.bindings">
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.security.auth.message.api" />
+    <module name="javax.security.jacc.api" />
+    <module name="javax.transaction.api" />
+    <module name="javax.xml.bind.api" />
+    <module name="javax.xml.stream.api" />
+    <module name="javax.servlet.api" />
+    <module name="org.jboss.common-core" />
+    <module name="org.jboss.logging" />
+    <module name="org.wildfly.extension.undertow" />
+    <module name="org.jboss.security.xacml" />
+    <module name="org.picketbox" />
+    <module name="javax.xml.ws.api" />
+    <module name="org.apache.log4j" />
+    <module name="org.apache.santuario.xmlsec">
+        <imports>
+            <exclude path="javax/*"/>
+        </imports>
+    </module>
+    <module name="javax.api" />
+    <module name="org.jboss.ws.api" />
+    <module name="org.jboss.ws.spi" />
+    <module name="org.apache.cxf" />
+    <module name="io.undertow.core" />
+    <module name="io.undertow.servlet" />
+    <module name="org.picketlink.common" />
+    <module name="org.picketlink.config" />
+    <module name="org.picketlink.federation" />
+  </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/federation/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/federation/main/module.xml
new file mode 100755
index 0000000..dac4638
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/federation/main/module.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.federation">
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.security.auth.message.api" />
+    <module name="javax.security.jacc.api" />
+    <module name="javax.transaction.api" />
+    <module name="javax.xml.bind.api" />
+    <module name="javax.xml.stream.api" />
+    <module name="javax.servlet.api" />
+    <module name="org.jboss.common-core" />
+    <module name="org.jboss.logging" />
+    <module name="org.jboss.as.web-common" />
+    <module name="org.jboss.security.xacml" />
+    <module name="org.picketbox" />
+    <module name="javax.xml.ws.api" />
+    <module name="org.apache.log4j" />
+    <module name="org.apache.santuario.xmlsec">
+        <imports>
+            <exclude path="javax/*"/>
+        </imports>
+    </module>
+    <module name="javax.api" />
+    <module name="org.jboss.ws.api" />
+    <module name="org.jboss.ws.spi" />
+    <module name="org.apache.cxf" />
+    <module name="org.picketlink.common" />
+    <module name="org.picketlink.config">
+        <imports>
+            <exclude-set>
+                <path name="org.picketlink.config.idm" />
+            </exclude-set>
+        </imports>
+    </module>
+  </dependencies>
+
+</module>

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/idm/api/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/idm/api/main/module.xml
new file mode 100755
index 0000000..9c840ba
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/idm/api/main/module.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.idm.api">
+
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.api"/>
+    <module name="org.jboss.logging"/>
+    <module name="org.picketlink.common"/>
+  </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/idm/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/idm/main/module.xml
new file mode 100755
index 0000000..97a8a80
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/idm/main/module.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.idm">
+
+  <resources>
+      <!-- Insert resources here -->
+  </resources>
+
+  <dependencies>
+    <module name="javax.api" />
+    <module name="javax.persistence.api" />
+    <module name="org.hibernate" optional="true" />
+    <module name="org.javassist" optional="true" />
+    <module name="org.jboss.logging" />
+    <module name="org.picketlink.common" />
+    <module name="org.picketlink.idm.api" export="true" />
+  </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/idm/schema/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/idm/schema/main/module.xml
new file mode 100755
index 0000000..a9bfe96
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/idm/schema/main/module.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink.idm.schema">
+
+	<resources>
+        <!-- Insert resources here -->
+	</resources>
+
+	<dependencies>
+        <module name="javax.api"/>
+        <module name="javax.persistence.api"/>
+        <module name="org.hibernate" />
+        <module name="org.javassist"/>
+        <module name="org.picketlink.idm.api"/>
+    </dependencies>
+
+</module>

diff --git a/distribution/modules/src/main/resources/modules/org/picketlink/main/module.xml b/distribution/modules/src/main/resources/modules/org/picketlink/main/module.xml
new file mode 100644
index 0000000..2418940
--- /dev/null
+++ b/distribution/modules/src/main/resources/modules/org/picketlink/main/module.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!-- ~ JBoss, Home of Professional Open Source. ~ Copyright 2012, Red Hat, 
+	Inc., and individual contributors ~ as indicated by the @author tags. See 
+	the copyright.txt file in the ~ distribution for a full listing of individual 
+	contributors. ~ ~ This is free software; you can redistribute it and/or modify 
+	it ~ under the terms of the GNU Lesser General Public License as ~ published 
+	by the Free Software Foundation; either version 2.1 of ~ the License, or 
+	(at your option) any later version. ~ ~ This software is distributed in the 
+	hope that it will be useful, ~ but WITHOUT ANY WARRANTY; without even the 
+	implied warranty of ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
+	See the GNU ~ Lesser General Public License for more details. ~ ~ You should 
+	have received a copy of the GNU Lesser General Public ~ License along with 
+	this software; if not, write to the Free ~ Software Foundation, Inc., 51 
+	Franklin St, Fifth Floor, Boston, MA ~ 02110-1301 USA, or see the FSF site: 
+	http://www.fsf.org. -->
+
+<module xmlns="urn:jboss:module:1.1" name="org.picketlink">
+  <resources>
+  </resources>
+
+  <dependencies>
+    <module name="org.picketlink.federation" export="true"/>
+    <module name="org.picketlink.federation.bindings" export="true"/>
+  </dependencies>
+
+</module>
\ No newline at end of file

diff --git a/distribution/wildfly-adapter-zip/assembly.xml b/distribution/wildfly-adapter-zip/assembly.xml
index 76d1f18..82a8fb9 100755
--- a/distribution/wildfly-adapter-zip/assembly.xml
+++ b/distribution/wildfly-adapter-zip/assembly.xml
@@ -13,6 +13,7 @@
                 <exclude>org/keycloak/keycloak-as7-adapter/**</exclude>
                 <exclude>org/keycloak/keycloak-as7-subsystem/**</exclude>
                 <exclude>org/bouncycastle/**</exclude>
+                <exclude>org/picketlink/**</exclude>
             </excludes>
             <outputDirectory>modules/system/layers/base</outputDirectory>
         </fileSet>

diff --git a/examples/saml/pom.xml b/examples/saml/pom.xml
new file mode 100755
index 0000000..e8be627
--- /dev/null
+++ b/examples/saml/pom.xml
@@ -0,0 +1,34 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>examples-pom</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>1.1.0-Alpha1-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <name>Provider Examples</name>
+    <description/>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>examples-saml-pom</artifactId>
+    <packaging>pom</packaging>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+    <modules>
+        <module>post-basic</module>
+        <module>post-with-signature</module>
+        <module>post-with-encryption</module>
+        <module>redirect-basic</module>
+        <module>redirect-with-signature</module>
+    </modules>
+</project>

diff --git a/examples/saml/post-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml b/examples/saml/post-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-basic/conf/jboss-eap/WEB-INF/jboss-web.xml b/examples/saml/post-basic/conf/jboss-eap/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..c461ff2
--- /dev/null
+++ b/examples/saml/post-basic/conf/jboss-eap/WEB-INF/jboss-web.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post</context-root>
+
+    <!-- You must configure one of the PicketLink Authenticators to get enable SAML-based SSO. Identity Providers and Service Providers
+    have different authenticators. In this case we're configuring an Service Provider, so we authenticator above is required. -->
+    <valve>
+        <class-name>org.picketlink.identity.federation.bindings.tomcat.sp.ServiceProviderAuthenticator</class-name>
+    </valve>
+</jboss-web>

diff --git a/examples/saml/post-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml b/examples/saml/post-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension b/examples/saml/post-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
new file mode 100644
index 0000000..ffaf42c
--- /dev/null
+++ b/examples/saml/post-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
@@ -0,0 +1 @@
+org.picketlink.identity.federation.bindings.wildfly.sp.SPServletExtension
\ No newline at end of file

diff --git a/examples/saml/post-basic/conf/wildfly/WEB-INF/jboss-web.xml b/examples/saml/post-basic/conf/wildfly/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..e11a2b4
--- /dev/null
+++ b/examples/saml/post-basic/conf/wildfly/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post</context-root>
+</jboss-web>

diff --git a/examples/saml/post-basic/configure-security-domain-eap.cli b/examples/saml/post-basic/configure-security-domain-eap.cli
new file mode 100644
index 0000000..9f9777c
--- /dev/null
+++ b/examples/saml/post-basic/configure-security-domain-eap.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-basic/configure-security-domain-wildfly.cli b/examples/saml/post-basic/configure-security-domain-wildfly.cli
new file mode 100644
index 0000000..6b65d5e
--- /dev/null
+++ b/examples/saml/post-basic/configure-security-domain-wildfly.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-basic/pom.xml b/examples/saml/post-basic/pom.xml
new file mode 100644
index 0000000..07762a8
--- /dev/null
+++ b/examples/saml/post-basic/pom.xml
@@ -0,0 +1,99 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.picketlink.quickstarts</groupId>
+    <artifactId>picketlink-federation-saml-sp-post-basic</artifactId>
+    <version>2.7.0.Beta2</version>
+
+    <packaging>war</packaging>
+
+    <name>PicketLink Quickstart: picketlink-federation-saml-sp-post-basic</name>
+    <description>PicketLink Quickstart: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding</description>
+
+    <url>http://www.picketlink.org</url>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <distribution>repo</distribution>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+        </license>
+    </licenses>
+
+    <properties>
+        <!-- JBoss AS dependency versions -->
+        <version.jboss.maven.plugin>7.4.Final</version.jboss.maven.plugin>
+
+        <!-- WildFly dependency versions -->
+        <version.wildfly.maven.plugin>1.0.1.Final</version.wildfly.maven.plugin>
+
+        <!-- PicketLink dependency versions -->
+        <version.picketlink.javaee.bom>2.7.0.Beta2</version.picketlink.javaee.bom>
+
+        <!-- Default target container. -->
+        <target.container>jboss-eap</target.container>
+
+        <!-- maven-war-plugin -->
+        <version.war.plugin>2.1.1</version.war.plugin>
+
+        <!-- maven-compiler-plugin -->
+        <version.compiler.plugin>3.1</version.compiler.plugin>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <maven.compiler.source>1.6</maven.compiler.source>
+    </properties>
+
+    <build>
+        <!-- Set the name of the war, used as the context root when the app is deployed -->
+        <finalName>${project.artifactId}</finalName>
+        <plugins>
+            <plugin>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>${version.war.plugin}</version>
+                <configuration>
+                    <!-- Java EE 6 doesn't require web.xml, Maven needs to catch up! -->
+                    <failOnMissingWebXml>false</failOnMissingWebXml>
+
+                    <!-- We need to get the configuration resources for the provided target container. -->
+                    <classifier>${target.container}</classifier>
+					<webResources>
+						<resource>
+							<directory>${basedir}/conf/${target.container}</directory>
+						</resource>
+					</webResources>
+                </configuration>
+            </plugin>
+            <!-- JBoss AS plugin to deploy war -->
+            <plugin>
+                <groupId>org.jboss.as.plugins</groupId>
+                <artifactId>jboss-as-maven-plugin</artifactId>
+                <version>${version.jboss.maven.plugin}</version>
+                <configuration>
+                    <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>wildfly</id>
+            <properties>
+                <target.container>wildfly</target.container>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.wildfly.plugins</groupId>
+                        <artifactId>wildfly-maven-plugin</artifactId>
+                        <version>${version.wildfly.maven.plugin}</version>
+                        <configuration>
+                            <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file

diff --git a/examples/saml/post-basic/README.md b/examples/saml/post-basic/README.md
new file mode 100755
index 0000000..70934a7
--- /dev/null
+++ b/examples/saml/post-basic/README.md
@@ -0,0 +1,273 @@
+picketlink-federation-saml-sp-post-basic: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding
+===============================
+Author: Pedro Igor  
+Level: Intermediate  
+Technologies: PicketLink Federation, SAML v2.0  
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding.  
+Source: <https://github.com/jboss-developer/jboss-picketlink-quickstarts/>
+
+
+What is it?
+-----------
+
+This example demonstrates Keycloak SAML 2.0 support in conjunction with a servlet secured by Picketlink's SAML SP client.
+
+
+Make sure you've set up the Keycloak Server
+--------------------------------------
+The Keycloak Appliance Distribution comes with a preconfigured Keycloak server (based on Wildfly).  You can use it out of
+the box to run these demos.  So, if you're using this, you can head to Step 2.
+
+Alternatively, you can install the Keycloak Server onto any JBoss AS 7.1.1, EAP 6.x, or Wildfly 8.x server, but there is
+a few steps you must follow.
+
+Obtain latest keycloak-war-dist-all.zip.  This distro is used to install Keycloak onto an existing JBoss installation.
+This installs the server.
+
+    $ cd ${wildfly.jboss.home}/standalone
+    $ cp -r ${keycloak-war-dist-all}/deployments .
+
+To be able to run the demos you also need to install the Keycloak client adapter. For Wildfly:
+
+    $ cd ${wildfly.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-wildfly-adapter-dist.zip
+
+For JBoss EAP 6.x
+
+    $ cd ${eap.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-eap6-adapter-dist.zip
+
+For JBoss AS 7.1.1:
+
+    $ cd ${as7.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-as7-adapter-dist.zip
+
+Unzipping the adapter ZIP only installs the JAR files.  You must also add the Keycloak Subsystem to the server's
+configuration (standalone/configuration/standalone.xml).
+
+For Wildfly:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+For JBoss 7.1.1 and EAP 6.x:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-as7-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+
+Boot Keycloak Server
+---------------------------------------
+Where you go to start up the Keycloak Server depends on which distro you installed.
+
+From appliance:
+
+```
+$ cd keycloak/bin
+$ ./standalone.sh
+```
+
+
+From existing Wildfly/EAP6/AS7 distro
+
+```
+$ cd ${wildfly.jboss.home}/bin
+$ ./standalone.sh
+```
+
+
+Import the Test Realm
+---------------------------------------
+Next thing you have to do is import the test realm for the demo.  Clicking on the below link will bring you to the
+create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
+create a new admin password before you can go to the create realm page.
+
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+
+Import the testsaml.json file that is in the saml/ example directory.
+
+
+
+Install Picketlink Modules into App server
+------------------------------------------
+
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+You may have to upgrade your picketlink modules in your JBoss EAP or Wildfly distribution.  See Picketlink docs for more details.
+
+Create the Security Domain for JBoss EAP
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-eap.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-eap.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-eap.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+Create the Security Domain for WildFly
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-wildfly.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-wildfly.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-wildfly.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+
+Review the Modified Server Configuration for EAP
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you want to review and understand newly added XML configuration, stop the JBoss server and open the  `JBOSS_HOME/standalone/configuration/standalone.xml` file.
+
+The following `sp` security-domain was added to the `security` subsystem.
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+The configuration above defines a security-domain which will be used by the SP to authenticate users based on a SAML Assertion previously issued by a Identity Provider.
+
+Review the Modified Server Configuration for WildFly
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you are using Wildfly, the security-domain should have the following configuration:
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+
+SAML SP-Initiated Single Sign-On
+-----------------------------------
+
+The SAML v2.0 specification defines a specific SSO mode called *SP-Initiated SSO*. In this mode, the SSO flow starts at the Service Provider side.
+Please, take a look at the following documentation for more details:
+
+1. [SAML v2.0 SP-Initiated SSO](https://docs.jboss.org/author/display/PLINK/SP-Initiated+SSO)
+
+
+Start JBoss Enterprise Application Platform 6 or WildFly with the Web Profile
+-------------------------
+
+1. Open a command line and navigate to the root of the JBoss server directory.
+2. The following shows the command line to start the server with the web profile:
+
+        For Linux:   JBOSS_HOME/bin/standalone.sh
+        For Windows: JBOSS_HOME\bin\standalone.bat
+
+ 
+Build and Deploy the Quickstart
+-------------------------
+
+_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#build-and-deploy-the-quickstarts) for complete instructions and additional options._
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. Type this command to build and deploy the archive:
+
+        For EAP 6:     mvn clean package jboss-as:deploy
+        For WildFly:   mvn -Pwildfly clean package wildfly:deploy
+
+4. This will deploy `target/picketlink-federation-saml-sp-post-basic.war` to the running instance of the server.
+
+
+Access the application
+---------------------
+
+The application will be running at the following URL: <http://localhost:8080/sales-post>.
+
+*Note: A Service Provider alone is not very useful without an Identity Provider to authenticate users and issue SAML Assertions. Once you get this application deployed, please take a look at [About the PicketLink Federation Quickstarts](../README.md#about-the-picketlink-federation-quickstarts).*
+
+
+Undeploy the Archive
+--------------------
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. When you are finished testing, type this command to undeploy the archive:
+
+        For EAP 6:     mvn jboss-as:undeploy
+        For WildFly:   mvn -Pwildfly wildfly:undeploy
+
+
+Run the Quickstart in JBoss Developer Studio or Eclipse
+-------------------------------------
+You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#use-jboss-developer-studio-or-eclipse-to-run-the-quickstarts) 
+
+
+Debug the Application
+------------------------------------
+
+If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
+
+        mvn dependency:sources
+        mvn dependency:resolve -Dclassifier=javadoc
\ No newline at end of file

diff --git a/examples/saml/post-basic/remove-security-domain.cli b/examples/saml/post-basic/remove-security-domain.cli
new file mode 100644
index 0000000..9487613
--- /dev/null
+++ b/examples/saml/post-basic/remove-security-domain.cli
@@ -0,0 +1,13 @@
+# Batch script to remove the quickstart-domain security domain from the JBoss server
+
+# Start batching commands
+batch
+
+# Remove the security domain
+/subsystem=security/security-domain=sp:remove
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
\ No newline at end of file

diff --git a/examples/saml/post-basic/src/main/webapp/css/idp.css b/examples/saml/post-basic/src/main/webapp/css/idp.css
new file mode 100644
index 0000000..afb49ea
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/css/idp.css
@@ -0,0 +1,78 @@
+/*
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+body {
+	background: url(images/rh_bg.png) repeat-x scroll 0 0 #F3F3F3;
+	color: #555555;
+	font: 12px/1.4 "Lucida Sans Unicode", "Lucida Grande", sans-serif;
+}
+
+.loginBox {
+	position:absolute;
+	top: 50%;
+	left: 50%;
+	width:30em;
+	height:3em;
+	margin-top: -9em; /*set to a negative number 1/2 of your height*/
+	margin-left: -15em; /*set to a negative number 1/2 of your width*/
+	border: 1px solid #ccc;
+	background-color: #f3f3f3;
+}
+
+.wrapper {
+	margin-left: auto;
+	margin-right: auto;
+	width: 50em;
+	text-align: left;
+}
+
+a {
+	text-decoration: none;
+	color: #5e8a9a;
+}
+
+h1 {
+	padding-top: 20px;
+	color: #7b1e1e;
+}
+
+a:hover {
+	text-decoration: underline;
+	color: #8ec6d9;
+}
+
+.content {
+	margin-left: 230px;
+}
+
+.dualbrand {
+	padding-top: 20px;
+}
+
+.as7 {
+	float: left;
+	margin-left: 10px;
+}
+
+.note {
+	font-size: 8pt;
+	color: #aaaaaa;
+}
\ No newline at end of file

diff --git a/examples/saml/post-basic/src/main/webapp/error.jsp b/examples/saml/post-basic/src/main/webapp/error.jsp
new file mode 100644
index 0000000..7a78c2f
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/error.jsp
@@ -0,0 +1,43 @@
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>PicketLink Example Application</title>
+<link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
+<link rel="StyleSheet" href="css/idp.css" type="text/css">
+</head>
+
+<body>
+	<img src="images/picketlink-banner-1180px.png"
+		style="margin-top: -10px; margin-left: -10px; opacity: 0.4; filter: alpha(opacity =   40);" />
+	<div class="loginBox"
+		style="margin-bottom: 80px; border: 1px solid #000000; width: 440px; background-color: #F8F8F8; align: center;">
+		<center>
+			<p>
+				<b>The Service Provider could not process the request.</b>
+			</p>
+		</center>
+	</div>
+</body>
+</html>
\ No newline at end of file

diff --git a/examples/saml/post-basic/src/main/webapp/favicon.ico b/examples/saml/post-basic/src/main/webapp/favicon.ico
new file mode 100644
index 0000000..c31d0fa
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/favicon.ico differ

diff --git a/examples/saml/post-basic/src/main/webapp/images/bkg.gif b/examples/saml/post-basic/src/main/webapp/images/bkg.gif
new file mode 100644
index 0000000..523877c
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/bkg.gif differ

diff --git a/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png b/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png
new file mode 100644
index 0000000..2509ff4
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/picketlink-banner-1180px.png differ

diff --git a/examples/saml/post-basic/src/main/webapp/images/rh_bg.png b/examples/saml/post-basic/src/main/webapp/images/rh_bg.png
new file mode 100644
index 0000000..b0e6a00
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/images/rh_bg.png differ

diff --git a/examples/saml/post-basic/src/main/webapp/index.jsp b/examples/saml/post-basic/src/main/webapp/index.jsp
new file mode 100644
index 0000000..199bdb0
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/index.jsp
@@ -0,0 +1,14 @@
+<div align="center">
+<h1>SalesTool</h1>
+<br/>
+Welcome to the Sales Tool, <%=request.getUserPrincipal().getName()%>
+
+<br/>
+Here is your sales chart:
+<br/>
+<img src="piechart.gif"/>
+
+<br/>
+<a href="?GLO=true">Click to LogOut</a>
+
+</div>

diff --git a/examples/saml/post-basic/src/main/webapp/logout.jsp b/examples/saml/post-basic/src/main/webapp/logout.jsp
new file mode 100644
index 0000000..05ef7d3
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/logout.jsp
@@ -0,0 +1,44 @@
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>PicketLink Example Application</title>
+<META HTTP-EQUIV="refresh" CONTENT="1;URL=<%= request.getContextPath() %>">
+<link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
+<link rel="StyleSheet" href="css/idp.css" type="text/css">
+</head>
+
+<body>
+	<img src="images/picketlink-banner-1180px.png"
+		style="margin-top: -10px; margin-left: -10px; opacity: 0.4; filter: alpha(opacity =   40);" />
+	<div class="loginBox"
+		style="margin-bottom: 80px; border: 1px solid #000000; width: 440px; background-color: #F8F8F8; align: center;">
+		<center>
+			<p>
+				<b>Logout in progress. You will be redirected to the Login Page.</b>
+			</p>
+		</center>
+	</div>
+</body>
+</html>
\ No newline at end of file

diff --git a/examples/saml/post-basic/src/main/webapp/piechart.gif b/examples/saml/post-basic/src/main/webapp/piechart.gif
new file mode 100644
index 0000000..57bfe37
Binary files /dev/null and b/examples/saml/post-basic/src/main/webapp/piechart.gif differ

diff --git a/examples/saml/post-basic/src/main/webapp/WEB-INF/picketlink.xml b/examples/saml/post-basic/src/main/webapp/WEB-INF/picketlink.xml
new file mode 100755
index 0000000..269f4d3
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/WEB-INF/picketlink.xml
@@ -0,0 +1,20 @@
+<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
+	<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
+		ServerEnvironment="tomcat" BindingType="POST">
+		<IdentityURL>${idp.url::http://localhost:8080/auth/realms/saml-demo/protocol/saml}</IdentityURL>
+		<ServiceURL>${sales-post.url::http://localhost:8080/sales-post/}</ServiceURL>
+        <Trust>
+			<Domains>localhost,jboss.com,jboss.org,amazonaws.com</Domains>
+		</Trust>
+	</PicketLinkSP>
+	<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
+        <Handler
+            class="org.picketlink.identity.federation.web.handlers.saml2.SAML2IssuerTrustHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
+	</Handlers>
+</PicketLink>
\ No newline at end of file

diff --git a/examples/saml/post-basic/src/main/webapp/WEB-INF/web.xml b/examples/saml/post-basic/src/main/webapp/WEB-INF/web.xml
new file mode 100644
index 0000000..1bb001c
--- /dev/null
+++ b/examples/saml/post-basic/src/main/webapp/WEB-INF/web.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
+	version="2.5">
+
+    <display-name>PicketLink Sales Service Provider</display-name>
+
+    <description>PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding</description>
+
+	<!-- Define a Security Constraint on this Application -->
+	<security-constraint>
+		<web-resource-collection>
+			<web-resource-name>SALES Application</web-resource-name>
+			<url-pattern>/*</url-pattern>
+		</web-resource-collection>
+		<auth-constraint>
+			<role-name>manager</role-name>
+		</auth-constraint>
+	</security-constraint>
+
+	<!-- Define a security constraint that gives unlimted access to freezone -->
+	<security-constraint>
+		<web-resource-collection>
+			<web-resource-name>freezone</web-resource-name>
+			<url-pattern>/freezone/*</url-pattern>
+		</web-resource-collection>
+		<web-resource-collection>
+			<web-resource-name>images</web-resource-name>
+			<url-pattern>/images/*</url-pattern>
+		</web-resource-collection>
+		<web-resource-collection>
+			<web-resource-name>css</web-resource-name>
+			<url-pattern>/css/*</url-pattern>
+		</web-resource-collection>
+	</security-constraint>
+
+    <!-- Define the Login Configuration for this Application -->
+    <login-config>
+		<auth-method>FORM</auth-method>
+		<realm-name>Tomcat SALES Application</realm-name>
+		<form-login-config>
+			<form-login-page>/jsp/login.jsp</form-login-page>
+			<form-error-page>/jsp/loginerror.jsp</form-error-page>
+		</form-login-config>
+	</login-config>
+
+	<!-- Security roles referenced by this web application -->
+	<security-role>
+		<description>The role that is required to log in to the Manager Application</description>
+		<role-name>manager</role-name>
+	</security-role>
+</web-app>

diff --git a/examples/saml/post-with-encryption/conf/jboss-eap/META-INF/jboss-deployment-structure.xml b/examples/saml/post-with-encryption/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-with-encryption/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-with-encryption/conf/jboss-eap/WEB-INF/jboss-web.xml b/examples/saml/post-with-encryption/conf/jboss-eap/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..8ef85ba
--- /dev/null
+++ b/examples/saml/post-with-encryption/conf/jboss-eap/WEB-INF/jboss-web.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post-enc</context-root>
+
+    <!-- You must configure one of the PicketLink Authenticators to get enable SAML-based SSO. Identity Providers and Service Providers
+    have different authenticators. In this case we're configuring an Service Provider, so we authenticator above is required. -->
+    <valve>
+        <class-name>org.picketlink.identity.federation.bindings.tomcat.sp.ServiceProviderAuthenticator</class-name>
+    </valve>
+</jboss-web>

diff --git a/examples/saml/post-with-encryption/conf/wildfly/META-INF/jboss-deployment-structure.xml b/examples/saml/post-with-encryption/conf/wildfly/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-with-encryption/conf/wildfly/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension b/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
new file mode 100644
index 0000000..ffaf42c
--- /dev/null
+++ b/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
@@ -0,0 +1 @@
+org.picketlink.identity.federation.bindings.wildfly.sp.SPServletExtension
\ No newline at end of file

diff --git a/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/jboss-web.xml b/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..cafc722
--- /dev/null
+++ b/examples/saml/post-with-encryption/conf/wildfly/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post-enc</context-root>
+</jboss-web>

diff --git a/examples/saml/post-with-encryption/configure-security-domain-eap.cli b/examples/saml/post-with-encryption/configure-security-domain-eap.cli
new file mode 100644
index 0000000..9f9777c
--- /dev/null
+++ b/examples/saml/post-with-encryption/configure-security-domain-eap.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-with-encryption/configure-security-domain-wildfly.cli b/examples/saml/post-with-encryption/configure-security-domain-wildfly.cli
new file mode 100644
index 0000000..6b65d5e
--- /dev/null
+++ b/examples/saml/post-with-encryption/configure-security-domain-wildfly.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-with-encryption/pom.xml b/examples/saml/post-with-encryption/pom.xml
new file mode 100755
index 0000000..497bea4
--- /dev/null
+++ b/examples/saml/post-with-encryption/pom.xml
@@ -0,0 +1,116 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.picketlink.quickstarts</groupId>
+    <artifactId>picketlink-federation-saml-sp-with-encryption</artifactId>
+    <version>2.7.0.Beta2</version>
+
+    <packaging>war</packaging>
+
+    <name>PicketLink Quickstart: picketlink-federation-saml-sp-with-encryption</name>
+    <description>PicketLink Quickstart: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding With Encryption Support</description>
+
+    <url>http://www.picketlink.org</url>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <distribution>repo</distribution>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+        </license>
+    </licenses>
+
+    <properties>
+        <!-- JBoss AS dependency versions -->
+        <version.jboss.maven.plugin>7.4.Final</version.jboss.maven.plugin>
+
+        <!-- WildFly dependency versions -->
+        <version.wildfly.maven.plugin>1.0.1.Final</version.wildfly.maven.plugin>
+
+        <!-- PicketLink dependency versions -->
+        <version.picketlink.javaee.bom>2.7.0.Beta2</version.picketlink.javaee.bom>
+
+        <!-- Default target container. -->
+        <target.container>jboss-eap</target.container>
+
+        <!-- maven-war-plugin -->
+        <version.war.plugin>2.1.1</version.war.plugin>
+
+        <!-- maven-compiler-plugin -->
+        <version.compiler.plugin>3.1</version.compiler.plugin>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <maven.compiler.source>1.6</maven.compiler.source>
+    </properties>
+
+    <build>
+        <!-- Set the name of the war, used as the context root when the app is deployed -->
+        <finalName>${project.artifactId}</finalName>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+            </resource>
+            <resource>
+                <directory>../post-basic/src/main/resources</directory>
+            </resource>
+        </resources>
+        <plugins>
+            <plugin>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>${version.war.plugin}</version>
+                <configuration>
+                    <!-- Java EE 6 doesn't require web.xml, Maven needs to catch up! -->
+                    <failOnMissingWebXml>false</failOnMissingWebXml>
+
+                    <!-- We need to get the configuration resources for the provided target container. -->
+                    <classifier>${target.container}</classifier>
+
+                    <!-- Instead of duplicating resources for each example application, we just reuse all resources from the
+                    base application. -->
+                    <webResources>
+                        <resource>
+                            <directory>src/main/webapp</directory>
+                        </resource>
+                        <resource>
+                            <directory>../post-basic/src/main/webapp</directory>
+                        </resource>
+						<resource>
+							<directory>${basedir}/conf/${target.container}</directory>
+						</resource>
+                    </webResources>
+                </configuration>
+            </plugin>
+            <!-- JBoss AS plugin to deploy war -->
+            <plugin>
+                <groupId>org.jboss.as.plugins</groupId>
+                <artifactId>jboss-as-maven-plugin</artifactId>
+                <version>${version.jboss.maven.plugin}</version>
+                <configuration>
+                    <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>wildfly</id>
+            <properties>
+                <target.container>wildfly</target.container>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.wildfly.plugins</groupId>
+                        <artifactId>wildfly-maven-plugin</artifactId>
+                        <version>${version.wildfly.maven.plugin}</version>
+                        <configuration>
+                            <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file

diff --git a/examples/saml/post-with-encryption/README.md b/examples/saml/post-with-encryption/README.md
new file mode 100755
index 0000000..0888515
--- /dev/null
+++ b/examples/saml/post-with-encryption/README.md
@@ -0,0 +1,269 @@
+picketlink-federation-saml-sp-with-encryption: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding With Encryption Support
+===============================
+Author: Pedro Igor  
+Level: Intermediate  
+Technologies: PicketLink Federation, SAML v2.0  
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support.  
+Source: <https://github.com/jboss-developer/jboss-picketlink-quickstarts/>
+
+
+What is it?
+-----------
+
+This example demonstrates Keycloak SAML 2.0 support in conjunction with a servlet secured by Picketlink's SAML SP client.
+
+
+Make sure you've set up the Keycloak Server
+--------------------------------------
+The Keycloak Appliance Distribution comes with a preconfigured Keycloak server (based on Wildfly).  You can use it out of
+the box to run these demos.  So, if you're using this, you can head to Step 2.
+
+Alternatively, you can install the Keycloak Server onto any JBoss AS 7.1.1, EAP 6.x, or Wildfly 8.x server, but there is
+a few steps you must follow.
+
+Obtain latest keycloak-war-dist-all.zip.  This distro is used to install Keycloak onto an existing JBoss installation.
+This installs the server.
+
+    $ cd ${wildfly.jboss.home}/standalone
+    $ cp -r ${keycloak-war-dist-all}/deployments .
+
+To be able to run the demos you also need to install the Keycloak client adapter. For Wildfly:
+
+    $ cd ${wildfly.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-wildfly-adapter-dist.zip
+
+For JBoss EAP 6.x
+
+    $ cd ${eap.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-eap6-adapter-dist.zip
+
+For JBoss AS 7.1.1:
+
+    $ cd ${as7.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-as7-adapter-dist.zip
+
+Unzipping the adapter ZIP only installs the JAR files.  You must also add the Keycloak Subsystem to the server's
+configuration (standalone/configuration/standalone.xml).
+
+For Wildfly:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+For JBoss 7.1.1 and EAP 6.x:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-as7-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+
+Boot Keycloak Server
+---------------------------------------
+Where you go to start up the Keycloak Server depends on which distro you installed.
+
+From appliance:
+
+```
+$ cd keycloak/bin
+$ ./standalone.sh
+```
+
+
+From existing Wildfly/EAP6/AS7 distro
+
+```
+$ cd ${wildfly.jboss.home}/bin
+$ ./standalone.sh
+```
+
+
+Import the Test Realm
+---------------------------------------
+Next thing you have to do is import the test realm for the demo.  Clicking on the below link will bring you to the
+create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
+create a new admin password before you can go to the create realm page.
+
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+
+Import the testsaml.json file that is in the saml/ example directory.
+
+Install Picketlink Modules into App server
+------------------------------------------
+
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+You may have to upgrade your picketlink modules in your JBoss EAP or Wildfly distribution.  See Picketlink docs for more details.
+
+Create the Security Domain for JBoss EAP
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-eap.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-eap.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-eap.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+Create the Security Domain for WildFly
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-wildfly.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-wildfly.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-wildfly.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+
+Review the Modified Server Configuration for EAP
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you want to review and understand newly added XML configuration, stop the JBoss server and open the  `JBOSS_HOME/standalone/configuration/standalone.xml` file.
+
+The following `sp` security-domain was added to the `security` subsystem.
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+The configuration above defines a security-domain which will be used by the SP to authenticate users based on a SAML Assertion previously issued by a Identity Provider.
+
+Review the Modified Server Configuration for WildFly
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you are using Wildfly, the security-domain should have the following configuration:
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+SAML SP-Initiated Single Sign-On
+-----------------------------------
+
+The SAML v2.0 specification defines a specific SSO mode called *SP-Initiated SSO*. In this mode, the SSO flow starts at the Service Provider side.
+Please, take a look at the following documentation for more details:
+
+1. [SAML v2.0 SP-Initiated SSO](https://docs.jboss.org/author/display/PLINK/SP-Initiated+SSO)
+
+
+Start JBoss Enterprise Application Platform 6 or WildFly with the Web Profile
+-------------------------
+
+1. Open a command line and navigate to the root of the JBoss server directory.
+2. The following shows the command line to start the server with the web profile:
+
+        For Linux:   JBOSS_HOME/bin/standalone.sh
+        For Windows: JBOSS_HOME\bin\standalone.bat
+
+ 
+Build and Deploy the Quickstart
+-------------------------
+
+_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#build-and-deploy-the-quickstarts) for complete instructions and additional options._
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. Type this command to build and deploy the archive:
+
+        For EAP 6:     mvn clean package jboss-as:deploy
+        For WildFly:   mvn -Pwildfly clean package wildfly:deploy
+
+4. This will deploy `target/picketlink-federation-saml-sp-with-encryption.war` to the running instance of the server.
+
+
+Access the application
+---------------------
+
+The application will be running at the following URL: <http://localhost:8080/sales-post-enc>.
+
+*Note: A Service Provider alone is not very useful without an Identity Provider to authenticate users and issue SAML Assertions. Once you get this application deployed, please take a look at [About the PicketLink Federation Quickstarts](../README.md#about-the-picketlink-federation-quickstarts).*
+
+Undeploy the Archive
+--------------------
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. When you are finished testing, type this command to undeploy the archive:
+
+        For EAP 6:     mvn jboss-as:undeploy
+        For WildFly:   mvn -Pwildfly wildfly:undeploy
+
+
+Run the Quickstart in JBoss Developer Studio or Eclipse
+-------------------------------------
+You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#use-jboss-developer-studio-or-eclipse-to-run-the-quickstarts) 
+
+
+Debug the Application
+------------------------------------
+
+If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
+
+        mvn dependency:sources
+        mvn dependency:resolve -Dclassifier=javadoc
\ No newline at end of file

diff --git a/examples/saml/post-with-encryption/remove-security-domain.cli b/examples/saml/post-with-encryption/remove-security-domain.cli
new file mode 100644
index 0000000..9487613
--- /dev/null
+++ b/examples/saml/post-with-encryption/remove-security-domain.cli
@@ -0,0 +1,13 @@
+# Batch script to remove the quickstart-domain security domain from the JBoss server
+
+# Start batching commands
+batch
+
+# Remove the security domain
+/subsystem=security/security-domain=sp:remove
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
\ No newline at end of file

diff --git a/examples/saml/post-with-encryption/src/main/resources/keystore.jks b/examples/saml/post-with-encryption/src/main/resources/keystore.jks
new file mode 100755
index 0000000..d70c862
Binary files /dev/null and b/examples/saml/post-with-encryption/src/main/resources/keystore.jks differ

diff --git a/examples/saml/post-with-encryption/src/main/webapp/WEB-INF/picketlink.xml b/examples/saml/post-with-encryption/src/main/webapp/WEB-INF/picketlink.xml
new file mode 100755
index 0000000..3a431b7
--- /dev/null
+++ b/examples/saml/post-with-encryption/src/main/webapp/WEB-INF/picketlink.xml
@@ -0,0 +1,31 @@
+<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
+	<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
+		ServerEnvironment="tomcat" BindingType="POST" SupportsSignatures="true">
+        <IdentityURL>${idp-sig.url::http://localhost:8080/auth/realms/saml-demo/protocol/saml}
+        </IdentityURL>
+		<ServiceURL>${sales-post-sig.url::http://localhost:8080/sales-post-enc/}
+		</ServiceURL>
+        <KeyProvider
+            ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager">
+            <Auth Key="KeyStoreURL" Value="/keystore.jks" />
+            <Auth Key="KeyStorePass" Value="store123" />
+            <Auth Key="SigningKeyPass" Value="test123" />
+            <Auth Key="SigningKeyAlias" Value="http://localhost:8080/sales-post-enc/" />
+            <ValidatingAlias Key="localhost" Value="saml-demo" />
+            <ValidatingAlias Key="127.0.0.1" Value="saml-demo" />
+        </KeyProvider>
+
+	</PicketLinkSP>
+	<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureValidationHandler" />
+	</Handlers>
+</PicketLink>

diff --git a/examples/saml/post-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml b/examples/saml/post-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml b/examples/saml/post-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..10562b8
--- /dev/null
+++ b/examples/saml/post-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post-sig</context-root>
+
+    <!-- You must configure one of the PicketLink Authenticators to get enable SAML-based SSO. Identity Providers and Service Providers
+    have different authenticators. In this case we're configuring an Service Provider, so we authenticator above is required. -->
+    <valve>
+        <class-name>org.picketlink.identity.federation.bindings.tomcat.sp.ServiceProviderAuthenticator</class-name>
+    </valve>
+</jboss-web>

diff --git a/examples/saml/post-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml b/examples/saml/post-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/post-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/post-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension b/examples/saml/post-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
new file mode 100644
index 0000000..ffaf42c
--- /dev/null
+++ b/examples/saml/post-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
@@ -0,0 +1 @@
+org.picketlink.identity.federation.bindings.wildfly.sp.SPServletExtension
\ No newline at end of file

diff --git a/examples/saml/post-with-signature/conf/wildfly/WEB-INF/jboss-web.xml b/examples/saml/post-with-signature/conf/wildfly/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..284b87a
--- /dev/null
+++ b/examples/saml/post-with-signature/conf/wildfly/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>sales-post-sig</context-root>
+</jboss-web>

diff --git a/examples/saml/post-with-signature/configure-security-domain-eap.cli b/examples/saml/post-with-signature/configure-security-domain-eap.cli
new file mode 100644
index 0000000..9f9777c
--- /dev/null
+++ b/examples/saml/post-with-signature/configure-security-domain-eap.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-with-signature/configure-security-domain-wildfly.cli b/examples/saml/post-with-signature/configure-security-domain-wildfly.cli
new file mode 100644
index 0000000..6b65d5e
--- /dev/null
+++ b/examples/saml/post-with-signature/configure-security-domain-wildfly.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/post-with-signature/pom.xml b/examples/saml/post-with-signature/pom.xml
new file mode 100755
index 0000000..2c644a7
--- /dev/null
+++ b/examples/saml/post-with-signature/pom.xml
@@ -0,0 +1,116 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.picketlink.quickstarts</groupId>
+    <artifactId>picketlink-federation-saml-sp-post-with-signature</artifactId>
+    <version>2.7.0.Beta2</version>
+
+    <packaging>war</packaging>
+
+    <name>PicketLink Quickstart: picketlink-federation-saml-sp-post-with-signature</name>
+    <description>PicketLink Quickstart: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding With Signature Support</description>
+
+    <url>http://www.picketlink.org</url>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <distribution>repo</distribution>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+        </license>
+    </licenses>
+
+    <properties>
+        <!-- JBoss AS dependency versions -->
+        <version.jboss.maven.plugin>7.4.Final</version.jboss.maven.plugin>
+
+        <!-- WildFly dependency versions -->
+        <version.wildfly.maven.plugin>1.0.1.Final</version.wildfly.maven.plugin>
+
+        <!-- PicketLink dependency versions -->
+        <version.picketlink.javaee.bom>2.7.0.Beta2</version.picketlink.javaee.bom>
+
+        <!-- Default target container. -->
+        <target.container>jboss-eap</target.container>
+
+        <!-- maven-war-plugin -->
+        <version.war.plugin>2.1.1</version.war.plugin>
+
+        <!-- maven-compiler-plugin -->
+        <version.compiler.plugin>3.1</version.compiler.plugin>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <maven.compiler.source>1.6</maven.compiler.source>
+    </properties>
+
+    <build>
+        <!-- Set the name of the war, used as the context root when the app is deployed -->
+        <finalName>${project.artifactId}</finalName>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+            </resource>
+            <resource>
+                <directory>../post-basic/src/main/resources</directory>
+            </resource>
+        </resources>
+        <plugins>
+            <plugin>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>${version.war.plugin}</version>
+                <configuration>
+                    <!-- Java EE 6 doesn't require web.xml, Maven needs to catch up! -->
+                    <failOnMissingWebXml>false</failOnMissingWebXml>
+
+                    <!-- We need to get the configuration resources for the provided target container. -->
+                    <classifier>${target.container}</classifier>
+
+                    <!-- Instead of duplicating resources for each example application, we just reuse all resources from the
+                    base application. -->
+                    <webResources>
+                        <resource>
+                            <directory>src/main/webapp</directory>
+                        </resource>
+                        <resource>
+                            <directory>../post-basic/src/main/webapp</directory>
+                        </resource>
+						<resource>
+							<directory>${basedir}/conf/${target.container}</directory>
+						</resource>
+                    </webResources>
+                </configuration>
+            </plugin>
+            <!-- JBoss AS plugin to deploy war -->
+            <plugin>
+                <groupId>org.jboss.as.plugins</groupId>
+                <artifactId>jboss-as-maven-plugin</artifactId>
+                <version>${version.jboss.maven.plugin}</version>
+                <configuration>
+                    <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>wildfly</id>
+            <properties>
+                <target.container>wildfly</target.container>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.wildfly.plugins</groupId>
+                        <artifactId>wildfly-maven-plugin</artifactId>
+                        <version>${version.wildfly.maven.plugin}</version>
+                        <configuration>
+                            <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file

diff --git a/examples/saml/post-with-signature/README.md b/examples/saml/post-with-signature/README.md
new file mode 100755
index 0000000..971e071
--- /dev/null
+++ b/examples/saml/post-with-signature/README.md
@@ -0,0 +1,270 @@
+picketlink-federation-saml-sp-post-with-signature: PicketLink Service Provider With a Basic Configuration using SAML HTTP POST Binding With Signature Support
+===============================
+Author: Pedro Igor  
+Level: Intermediate  
+Technologies: PicketLink Federation, SAML v2.0  
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support.  
+Source: <https://github.com/jboss-developer/jboss-picketlink-quickstarts/>
+
+
+What is it?
+-----------
+
+This example demonstrates Keycloak SAML 2.0 support in conjunction with a servlet secured by Picketlink's SAML SP client.
+
+
+Make sure you've set up the Keycloak Server
+--------------------------------------
+The Keycloak Appliance Distribution comes with a preconfigured Keycloak server (based on Wildfly).  You can use it out of
+the box to run these demos.  So, if you're using this, you can head to Step 2.
+
+Alternatively, you can install the Keycloak Server onto any JBoss AS 7.1.1, EAP 6.x, or Wildfly 8.x server, but there is
+a few steps you must follow.
+
+Obtain latest keycloak-war-dist-all.zip.  This distro is used to install Keycloak onto an existing JBoss installation.
+This installs the server.
+
+    $ cd ${wildfly.jboss.home}/standalone
+    $ cp -r ${keycloak-war-dist-all}/deployments .
+
+To be able to run the demos you also need to install the Keycloak client adapter. For Wildfly:
+
+    $ cd ${wildfly.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-wildfly-adapter-dist.zip
+
+For JBoss EAP 6.x
+
+    $ cd ${eap.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-eap6-adapter-dist.zip
+
+For JBoss AS 7.1.1:
+
+    $ cd ${as7.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-as7-adapter-dist.zip
+
+Unzipping the adapter ZIP only installs the JAR files.  You must also add the Keycloak Subsystem to the server's
+configuration (standalone/configuration/standalone.xml).
+
+For Wildfly:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+For JBoss 7.1.1 and EAP 6.x:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-as7-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+
+Boot Keycloak Server
+---------------------------------------
+Where you go to start up the Keycloak Server depends on which distro you installed.
+
+From appliance:
+
+```
+$ cd keycloak/bin
+$ ./standalone.sh
+```
+
+
+From existing Wildfly/EAP6/AS7 distro
+
+```
+$ cd ${wildfly.jboss.home}/bin
+$ ./standalone.sh
+```
+
+
+Import the Test Realm
+---------------------------------------
+Next thing you have to do is import the test realm for the demo.  Clicking on the below link will bring you to the
+create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
+create a new admin password before you can go to the create realm page.
+
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+
+Import the testsaml.json file that is in the saml/ example directory.
+
+Install Picketlink Modules into App server
+------------------------------------------
+
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+You may have to upgrade your picketlink modules in your JBoss EAP or Wildfly distribution.  See Picketlink docs for more details.
+
+Create the Security Domain for JBoss EAP
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-eap.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-eap.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-eap.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+Create the Security Domain for WildFly
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-wildfly.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-wildfly.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-wildfly.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+
+Review the Modified Server Configuration for EAP
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you want to review and understand newly added XML configuration, stop the JBoss server and open the  `JBOSS_HOME/standalone/configuration/standalone.xml` file.
+
+The following `sp` security-domain was added to the `security` subsystem.
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+The configuration above defines a security-domain which will be used by the SP to authenticate users based on a SAML Assertion previously issued by a Identity Provider.
+
+Review the Modified Server Configuration for WildFly
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you are using Wildfly, the security-domain should have the following configuration:
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+
+SAML SP-Initiated Single Sign-On
+-----------------------------------
+
+The SAML v2.0 specification defines a specific SSO mode called *SP-Initiated SSO*. In this mode, the SSO flow starts at the Service Provider side.
+Please, take a look at the following documentation for more details:
+
+1. [SAML v2.0 SP-Initiated SSO](https://docs.jboss.org/author/display/PLINK/SP-Initiated+SSO)
+
+
+Start JBoss Enterprise Application Platform 6 or WildFly with the Web Profile
+-------------------------
+
+1. Open a command line and navigate to the root of the JBoss server directory.
+2. The following shows the command line to start the server with the web profile:
+
+        For Linux:   JBOSS_HOME/bin/standalone.sh
+        For Windows: JBOSS_HOME\bin\standalone.bat
+
+ 
+Build and Deploy the Quickstart
+-------------------------
+
+_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#build-and-deploy-the-quickstarts) for complete instructions and additional options._
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. Type this command to build and deploy the archive:
+
+        For EAP 6:     mvn clean package jboss-as:deploy
+        For WildFly:   mvn -Pwildfly clean package wildfly:deploy
+
+4. This will deploy `target/picketlink-federation-saml-sp-post-with-signature.war` to the running instance of the server.
+
+
+Access the application
+---------------------
+
+The application will be running at the following URL: <http://localhost:8080/sales-post-sig>.
+
+*Note: A Service Provider alone is not very useful without an Identity Provider to authenticate users and issue SAML Assertions. Once you get this application deployed, please take a look at [About the PicketLink Federation Quickstarts](../README.md#about-the-picketlink-federation-quickstarts).*
+
+Undeploy the Archive
+--------------------
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. When you are finished testing, type this command to undeploy the archive:
+
+        For EAP 6:     mvn jboss-as:undeploy
+        For WildFly:   mvn -Pwildfly wildfly:undeploy
+
+
+Run the Quickstart in JBoss Developer Studio or Eclipse
+-------------------------------------
+You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#use-jboss-developer-studio-or-eclipse-to-run-the-quickstarts) 
+
+
+Debug the Application
+------------------------------------
+
+If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
+
+        mvn dependency:sources
+        mvn dependency:resolve -Dclassifier=javadoc
\ No newline at end of file

diff --git a/examples/saml/post-with-signature/remove-security-domain.cli b/examples/saml/post-with-signature/remove-security-domain.cli
new file mode 100644
index 0000000..9487613
--- /dev/null
+++ b/examples/saml/post-with-signature/remove-security-domain.cli
@@ -0,0 +1,13 @@
+# Batch script to remove the quickstart-domain security domain from the JBoss server
+
+# Start batching commands
+batch
+
+# Remove the security domain
+/subsystem=security/security-domain=sp:remove
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
\ No newline at end of file

diff --git a/examples/saml/post-with-signature/src/main/resources/keystore.jks b/examples/saml/post-with-signature/src/main/resources/keystore.jks
new file mode 100755
index 0000000..4185d3c
Binary files /dev/null and b/examples/saml/post-with-signature/src/main/resources/keystore.jks differ

diff --git a/examples/saml/post-with-signature/src/main/webapp/WEB-INF/picketlink.xml b/examples/saml/post-with-signature/src/main/webapp/WEB-INF/picketlink.xml
new file mode 100755
index 0000000..05293a5
--- /dev/null
+++ b/examples/saml/post-with-signature/src/main/webapp/WEB-INF/picketlink.xml
@@ -0,0 +1,31 @@
+<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
+	<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
+		ServerEnvironment="tomcat" BindingType="POST" SupportsSignatures="true">
+		<IdentityURL>${idp-sig.url::http://localhost:8080/auth/realms/saml-demo/protocol/saml}
+		</IdentityURL>
+		<ServiceURL>${sales-post-sig.url::http://localhost:8080/sales-post-sig/}
+		</ServiceURL>
+		<KeyProvider
+			ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager">
+			<Auth Key="KeyStoreURL" Value="/keystore.jks" />
+			<Auth Key="KeyStorePass" Value="store123" />
+			<Auth Key="SigningKeyPass" Value="test123" />
+			<Auth Key="SigningKeyAlias" Value="http://localhost:8080/sales-post-sig/" />
+			<ValidatingAlias Key="localhost" Value="saml-demo" />
+			<ValidatingAlias Key="127.0.0.1" Value="saml-demo" />
+		</KeyProvider>
+
+	</PicketLinkSP>
+	<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureValidationHandler" />
+	</Handlers>
+</PicketLink>

diff --git a/examples/saml/redirect-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml b/examples/saml/redirect-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/redirect-basic/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/redirect-basic/conf/jboss-eap/WEB-INF/jboss-web.xml b/examples/saml/redirect-basic/conf/jboss-eap/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..f603c9a
--- /dev/null
+++ b/examples/saml/redirect-basic/conf/jboss-eap/WEB-INF/jboss-web.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>employee</context-root>
+
+    <!-- You must configure one of the PicketLink Authenticators to get enable SAML-based SSO. Identity Providers and Service Providers
+    have different authenticators. In this case we're configuring an Service Provider, so we authenticator above is required. -->
+    <valve>
+        <class-name>org.picketlink.identity.federation.bindings.tomcat.sp.ServiceProviderAuthenticator</class-name>
+    </valve>
+</jboss-web>

diff --git a/examples/saml/redirect-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml b/examples/saml/redirect-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/redirect-basic/conf/wildfly/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/redirect-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension b/examples/saml/redirect-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
new file mode 100644
index 0000000..ffaf42c
--- /dev/null
+++ b/examples/saml/redirect-basic/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
@@ -0,0 +1 @@
+org.picketlink.identity.federation.bindings.wildfly.sp.SPServletExtension
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/conf/wildfly/WEB-INF/jboss-web.xml b/examples/saml/redirect-basic/conf/wildfly/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..309b91b
--- /dev/null
+++ b/examples/saml/redirect-basic/conf/wildfly/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>employee</context-root>
+</jboss-web>

diff --git a/examples/saml/redirect-basic/configure-security-domain-eap.cli b/examples/saml/redirect-basic/configure-security-domain-eap.cli
new file mode 100644
index 0000000..9f9777c
--- /dev/null
+++ b/examples/saml/redirect-basic/configure-security-domain-eap.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/redirect-basic/configure-security-domain-wildfly.cli b/examples/saml/redirect-basic/configure-security-domain-wildfly.cli
new file mode 100644
index 0000000..6b65d5e
--- /dev/null
+++ b/examples/saml/redirect-basic/configure-security-domain-wildfly.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/redirect-basic/pom.xml b/examples/saml/redirect-basic/pom.xml
new file mode 100644
index 0000000..98c3a40
--- /dev/null
+++ b/examples/saml/redirect-basic/pom.xml
@@ -0,0 +1,102 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.picketlink.quickstarts</groupId>
+    <artifactId>picketlink-federation-saml-sp-redirect-basic</artifactId>
+    <version>2.7.0.Beta2</version>
+
+    <packaging>war</packaging>
+
+    <name>PicketLink Quickstart: picketlink-federation-saml-sp-redirect-basic</name>
+    <description>PicketLink Quickstart: PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding</description>
+
+    <url>http://www.picketlink.org</url>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <distribution>repo</distribution>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+        </license>
+    </licenses>
+
+    <properties>
+        <!-- JBoss AS dependency versions -->
+        <version.jboss.maven.plugin>7.4.Final</version.jboss.maven.plugin>
+
+        <!-- WildFly dependency versions -->
+        <version.wildfly.maven.plugin>1.0.1.Final</version.wildfly.maven.plugin>
+
+        <!-- PicketLink dependency versions -->
+        <version.picketlink.javaee.bom>2.7.0.Beta2</version.picketlink.javaee.bom>
+
+        <!-- Default target container. -->
+        <target.container>jboss-eap</target.container>
+
+        <!-- maven-war-plugin -->
+        <version.war.plugin>2.1.1</version.war.plugin>
+
+        <!-- maven-compiler-plugin -->
+        <version.compiler.plugin>3.1</version.compiler.plugin>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <maven.compiler.source>1.6</maven.compiler.source>
+    </properties>
+
+    <build>
+        <!-- Set the name of the war, used as the context root when the app is deployed -->
+        <finalName>${project.artifactId}</finalName>
+        <plugins>
+            <plugin>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>${version.war.plugin}</version>
+                <configuration>
+                    <!-- Java EE 6 doesn't require web.xml, Maven needs to catch up! -->
+                    <failOnMissingWebXml>false</failOnMissingWebXml>
+
+                    <!-- We need to get the configuration resources for the provided target container. -->
+                    <classifier>${target.container}</classifier>
+
+                    <!-- Instead of duplicating resources for each example application, we just reuse all resources from the
+                    base application. -->
+                    <webResources>
+						<resource>
+							<directory>${basedir}/conf/${target.container}</directory>
+						</resource>
+                    </webResources>
+                </configuration>
+            </plugin>
+            <!-- JBoss AS plugin to deploy war -->
+            <plugin>
+                <groupId>org.jboss.as.plugins</groupId>
+                <artifactId>jboss-as-maven-plugin</artifactId>
+                <version>${version.jboss.maven.plugin}</version>
+                <configuration>
+                    <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>wildfly</id>
+            <properties>
+                <target.container>wildfly</target.container>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.wildfly.plugins</groupId>
+                        <artifactId>wildfly-maven-plugin</artifactId>
+                        <version>${version.wildfly.maven.plugin}</version>
+                        <configuration>
+                            <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/README.md b/examples/saml/redirect-basic/README.md
new file mode 100755
index 0000000..9cf014c
--- /dev/null
+++ b/examples/saml/redirect-basic/README.md
@@ -0,0 +1,270 @@
+picketlink-federation-saml-sp-redirect-basic: PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding
+===============================
+Author: Pedro Igor  
+Level: Intermediate  
+Technologies: PicketLink Federation, SAML v2.0  
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP Redirect Binding.  
+Source: <https://github.com/jboss-developer/jboss-picketlink-quickstarts/>
+
+
+What is it?
+-----------
+
+This example demonstrates Keycloak SAML 2.0 support in conjunction with a servlet secured by Picketlink's SAML SP client.
+
+
+Make sure you've set up the Keycloak Server
+--------------------------------------
+The Keycloak Appliance Distribution comes with a preconfigured Keycloak server (based on Wildfly).  You can use it out of
+the box to run these demos.  So, if you're using this, you can head to Step 2.
+
+Alternatively, you can install the Keycloak Server onto any JBoss AS 7.1.1, EAP 6.x, or Wildfly 8.x server, but there is
+a few steps you must follow.
+
+Obtain latest keycloak-war-dist-all.zip.  This distro is used to install Keycloak onto an existing JBoss installation.
+This installs the server.
+
+    $ cd ${wildfly.jboss.home}/standalone
+    $ cp -r ${keycloak-war-dist-all}/deployments .
+
+To be able to run the demos you also need to install the Keycloak client adapter. For Wildfly:
+
+    $ cd ${wildfly.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-wildfly-adapter-dist.zip
+
+For JBoss EAP 6.x
+
+    $ cd ${eap.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-eap6-adapter-dist.zip
+
+For JBoss AS 7.1.1:
+
+    $ cd ${as7.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-as7-adapter-dist.zip
+
+Unzipping the adapter ZIP only installs the JAR files.  You must also add the Keycloak Subsystem to the server's
+configuration (standalone/configuration/standalone.xml).
+
+For Wildfly:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+For JBoss 7.1.1 and EAP 6.x:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-as7-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+
+Boot Keycloak Server
+---------------------------------------
+Where you go to start up the Keycloak Server depends on which distro you installed.
+
+From appliance:
+
+```
+$ cd keycloak/bin
+$ ./standalone.sh
+```
+
+
+From existing Wildfly/EAP6/AS7 distro
+
+```
+$ cd ${wildfly.jboss.home}/bin
+$ ./standalone.sh
+```
+
+
+Import the Test Realm
+---------------------------------------
+Next thing you have to do is import the test realm for the demo.  Clicking on the below link will bring you to the
+create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
+create a new admin password before you can go to the create realm page.
+
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+
+Import the testsaml.json file that is in the saml/ example directory.
+
+Install Picketlink Modules into App server
+------------------------------------------
+
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+You may have to upgrade your picketlink modules in your JBoss EAP or Wildfly distribution.  See Picketlink docs for more details.
+
+Create the Security Domain for JBoss EAP
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-eap.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-eap.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-eap.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+Create the Security Domain for WildFly
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-wildfly.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-wildfly.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-wildfly.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+
+Review the Modified Server Configuration for EAP
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you want to review and understand newly added XML configuration, stop the JBoss server and open the  `JBOSS_HOME/standalone/configuration/standalone.xml` file.
+
+The following `sp` security-domain was added to the `security` subsystem.
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+The configuration above defines a security-domain which will be used by the SP to authenticate users based on a SAML Assertion previously issued by a Identity Provider.
+
+Review the Modified Server Configuration for WildFly
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you are using Wildfly, the security-domain should have the following configuration:
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+
+SAML SP-Initiated Single Sign-On
+-----------------------------------
+
+The SAML v2.0 specification defines a specific SSO mode called *SP-Initiated SSO*. In this mode, the SSO flow starts at the Service Provider side.
+Please, take a look at the following documentation for more details:
+
+1. [SAML v2.0 SP-Initiated SSO](https://docs.jboss.org/author/display/PLINK/SP-Initiated+SSO)
+
+
+Start JBoss Enterprise Application Platform 6 or WildFly with the Web Profile
+-------------------------
+
+1. Open a command line and navigate to the root of the JBoss server directory.
+2. The following shows the command line to start the server with the web profile:
+
+        For Linux:   JBOSS_HOME/bin/standalone.sh
+        For Windows: JBOSS_HOME\bin\standalone.bat
+
+ 
+Build and Deploy the Quickstart
+-------------------------
+
+_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#build-and-deploy-the-quickstarts) for complete instructions and additional options._
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. Type this command to build and deploy the archive:
+
+        For EAP 6:     mvn clean package jboss-as:deploy
+        For WildFly:   mvn -Pwildfly clean package wildfly:deploy
+
+4. This will deploy `target/picketlink-federation-saml-sp-redirect-basic.war` to the running instance of the server.
+
+
+Access the application
+---------------------
+
+The application will be running at the following URL: <http://localhost:8080/employee>.
+
+*Note: A Service Provider alone is not very useful without an Identity Provider to authenticate users and issue SAML Assertions. Once you get this application deployed, please take a look at [About the PicketLink Federation Quickstarts](../README.md#about-the-picketlink-federation-quickstarts).*
+
+Undeploy the Archive
+--------------------
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. When you are finished testing, type this command to undeploy the archive:
+
+        For EAP 6:     mvn jboss-as:undeploy
+        For WildFly:   mvn -Pwildfly wildfly:undeploy
+
+
+Run the Quickstart in JBoss Developer Studio or Eclipse
+-------------------------------------
+You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#use-jboss-developer-studio-or-eclipse-to-run-the-quickstarts) 
+
+
+Debug the Application
+------------------------------------
+
+If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
+
+        mvn dependency:sources
+        mvn dependency:resolve -Dclassifier=javadoc
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/remove-security-domain.cli b/examples/saml/redirect-basic/remove-security-domain.cli
new file mode 100644
index 0000000..9487613
--- /dev/null
+++ b/examples/saml/redirect-basic/remove-security-domain.cli
@@ -0,0 +1,13 @@
+# Batch script to remove the quickstart-domain security domain from the JBoss server
+
+# Start batching commands
+batch
+
+# Remove the security domain
+/subsystem=security/security-domain=sp:remove
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/src/main/webapp/careermap.jpg b/examples/saml/redirect-basic/src/main/webapp/careermap.jpg
new file mode 100644
index 0000000..4a012a7
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/careermap.jpg differ

diff --git a/examples/saml/redirect-basic/src/main/webapp/css/idp.css b/examples/saml/redirect-basic/src/main/webapp/css/idp.css
new file mode 100644
index 0000000..afb49ea
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/css/idp.css
@@ -0,0 +1,78 @@
+/*
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+body {
+	background: url(images/rh_bg.png) repeat-x scroll 0 0 #F3F3F3;
+	color: #555555;
+	font: 12px/1.4 "Lucida Sans Unicode", "Lucida Grande", sans-serif;
+}
+
+.loginBox {
+	position:absolute;
+	top: 50%;
+	left: 50%;
+	width:30em;
+	height:3em;
+	margin-top: -9em; /*set to a negative number 1/2 of your height*/
+	margin-left: -15em; /*set to a negative number 1/2 of your width*/
+	border: 1px solid #ccc;
+	background-color: #f3f3f3;
+}
+
+.wrapper {
+	margin-left: auto;
+	margin-right: auto;
+	width: 50em;
+	text-align: left;
+}
+
+a {
+	text-decoration: none;
+	color: #5e8a9a;
+}
+
+h1 {
+	padding-top: 20px;
+	color: #7b1e1e;
+}
+
+a:hover {
+	text-decoration: underline;
+	color: #8ec6d9;
+}
+
+.content {
+	margin-left: 230px;
+}
+
+.dualbrand {
+	padding-top: 20px;
+}
+
+.as7 {
+	float: left;
+	margin-left: 10px;
+}
+
+.note {
+	font-size: 8pt;
+	color: #aaaaaa;
+}
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/src/main/webapp/error.jsp b/examples/saml/redirect-basic/src/main/webapp/error.jsp
new file mode 100644
index 0000000..7a78c2f
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/error.jsp
@@ -0,0 +1,43 @@
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>PicketLink Example Application</title>
+<link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
+<link rel="StyleSheet" href="css/idp.css" type="text/css">
+</head>
+
+<body>
+	<img src="images/picketlink-banner-1180px.png"
+		style="margin-top: -10px; margin-left: -10px; opacity: 0.4; filter: alpha(opacity =   40);" />
+	<div class="loginBox"
+		style="margin-bottom: 80px; border: 1px solid #000000; width: 440px; background-color: #F8F8F8; align: center;">
+		<center>
+			<p>
+				<b>The Service Provider could not process the request.</b>
+			</p>
+		</center>
+	</div>
+</body>
+</html>
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/src/main/webapp/favicon.ico b/examples/saml/redirect-basic/src/main/webapp/favicon.ico
new file mode 100644
index 0000000..c31d0fa
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/favicon.ico differ

diff --git a/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif b/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif
new file mode 100644
index 0000000..523877c
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/bkg.gif differ

diff --git a/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png b/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png
new file mode 100644
index 0000000..2509ff4
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/picketlink-banner-1180px.png differ

diff --git a/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png b/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png
new file mode 100644
index 0000000..b0e6a00
Binary files /dev/null and b/examples/saml/redirect-basic/src/main/webapp/images/rh_bg.png differ

diff --git a/examples/saml/redirect-basic/src/main/webapp/index.jsp b/examples/saml/redirect-basic/src/main/webapp/index.jsp
new file mode 100644
index 0000000..5b3ecd4
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/index.jsp
@@ -0,0 +1,10 @@
+<div align="center">
+<h1>EmployeeDashboard</h1>
+<br/>
+Welcome to the Employee Tool, <b><%=request.getUserPrincipal().getName()%></b>.
+<br/>
+<img src="careermap.jpg"/>
+<br/>
+<a href="?GLO=true">Click to LogOut</a>
+
+</div>

diff --git a/examples/saml/redirect-basic/src/main/webapp/logout.jsp b/examples/saml/redirect-basic/src/main/webapp/logout.jsp
new file mode 100644
index 0000000..05ef7d3
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/logout.jsp
@@ -0,0 +1,44 @@
+<!--
+  ~ JBoss, Home of Professional Open Source.
+  ~ Copyright (c) 2011, Red Hat, Inc., and individual contributors
+  ~ as indicated by the @author tags. See the copyright.txt file in the
+  ~ distribution for a full listing of individual contributors.
+  ~
+  ~ This is free software; you can redistribute it and/or modify it
+  ~ under the terms of the GNU Lesser General Public License as
+  ~ published by the Free Software Foundation; either version 2.1 of
+  ~ the License, or (at your option) any later version.
+  ~
+  ~ This software is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  ~ Lesser General Public License for more details.
+  ~
+  ~ You should have received a copy of the GNU Lesser General Public
+  ~ License along with this software; if not, write to the Free
+  ~ Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+  ~ 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+  -->
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>PicketLink Example Application</title>
+<META HTTP-EQUIV="refresh" CONTENT="1;URL=<%= request.getContextPath() %>">
+<link rel="shortcut icon" href="favicon.ico" type="image/x-icon">
+<link rel="StyleSheet" href="css/idp.css" type="text/css">
+</head>
+
+<body>
+	<img src="images/picketlink-banner-1180px.png"
+		style="margin-top: -10px; margin-left: -10px; opacity: 0.4; filter: alpha(opacity =   40);" />
+	<div class="loginBox"
+		style="margin-bottom: 80px; border: 1px solid #000000; width: 440px; background-color: #F8F8F8; align: center;">
+		<center>
+			<p>
+				<b>Logout in progress. You will be redirected to the Login Page.</b>
+			</p>
+		</center>
+	</div>
+</body>
+</html>
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/src/main/webapp/META-INF/jboss-deployment-structure.xml b/examples/saml/redirect-basic/src/main/webapp/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/redirect-basic/src/main/webapp/WEB-INF/picketlink.xml b/examples/saml/redirect-basic/src/main/webapp/WEB-INF/picketlink.xml
new file mode 100755
index 0000000..78e8c93
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/WEB-INF/picketlink.xml
@@ -0,0 +1,20 @@
+<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
+	<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
+		ServerEnvironment="tomcat" BindingType="REDIRECT" RelayState="someURL">
+		<IdentityURL>${idp.url::http://localhost:8080/auth/realms/saml-demo/protocol/saml}</IdentityURL>
+		<ServiceURL>${employee.url::http://localhost:8080/employee/}
+		</ServiceURL>
+	</PicketLinkSP>
+	<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler">
+			
+			<Option Key="ASSERTION_SESSION_ATTRIBUTE_NAME" Value="org.picketlink.sp.assertion"/>
+			
+		</Handler>
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
+	</Handlers>
+</PicketLink>
\ No newline at end of file

diff --git a/examples/saml/redirect-basic/src/main/webapp/WEB-INF/web.xml b/examples/saml/redirect-basic/src/main/webapp/WEB-INF/web.xml
new file mode 100644
index 0000000..d1b8e11
--- /dev/null
+++ b/examples/saml/redirect-basic/src/main/webapp/WEB-INF/web.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
+	version="2.5">
+
+	<display-name>PicketLink Employee Service Provider</display-name>
+
+	<description>PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding</description>
+
+	<!-- Define a Security Constraint on this Application -->
+	<security-constraint>
+		<web-resource-collection>
+			<web-resource-name>EMPLOYEE Application</web-resource-name>
+			<url-pattern>/*</url-pattern>
+		</web-resource-collection>
+		<auth-constraint>
+			<role-name>manager</role-name>
+		</auth-constraint>
+	</security-constraint>
+
+	<!-- Define a security constraint that gives unlimted access to freezone -->
+	<security-constraint>
+		<web-resource-collection>
+			<web-resource-name>freezone</web-resource-name>
+			<url-pattern>/freezone/*</url-pattern>
+		</web-resource-collection>
+		<web-resource-collection>
+			<web-resource-name>images</web-resource-name>
+			<url-pattern>/images/*</url-pattern>
+		</web-resource-collection>
+		<web-resource-collection>
+			<web-resource-name>css</web-resource-name>
+			<url-pattern>/css/*</url-pattern>
+		</web-resource-collection>
+	</security-constraint>
+
+    <!-- Define the Login Configuration for this Application -->
+    <login-config>
+		<auth-method>FORM</auth-method>
+		<realm-name>Tomcat SALES Application</realm-name>
+		<form-login-config>
+			<form-login-page>/jsp/login.jsp</form-login-page>
+			<form-error-page>/jsp/loginerror.jsp</form-error-page>
+		</form-login-config>
+	</login-config>
+
+	<!-- Security roles referenced by this web application -->
+	<security-role>
+		<description>The role that is required to log in to the EMPLOYEE Application</description>
+		<role-name>manager</role-name>
+	</security-role>
+</web-app>

diff --git a/examples/saml/redirect-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml b/examples/saml/redirect-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/redirect-with-signature/conf/jboss-eap/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/redirect-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml b/examples/saml/redirect-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..4d1aef2
--- /dev/null
+++ b/examples/saml/redirect-with-signature/conf/jboss-eap/WEB-INF/jboss-web.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>employee-sig</context-root>
+
+    <!-- You must configure one of the PicketLink Authenticators to get enable SAML-based SSO. Identity Providers and Service Providers
+    have different authenticators. In this case we're configuring an Service Provider, so we authenticator above is required. -->
+    <valve>
+        <class-name>org.picketlink.identity.federation.bindings.tomcat.sp.ServiceProviderAuthenticator</class-name>
+    </valve>
+</jboss-web>

diff --git a/examples/saml/redirect-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml b/examples/saml/redirect-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml
new file mode 100644
index 0000000..7b07a02
--- /dev/null
+++ b/examples/saml/redirect-with-signature/conf/wildfly/META-INF/jboss-deployment-structure.xml
@@ -0,0 +1,10 @@
+<jboss-deployment-structure>
+    <deployment>
+        <!-- You must configure the PicketLink dependency to your deployment. The dependency above is a reference to a static module
+        from JBoss EAP modules directory. -->
+        <dependencies>
+            <module name="org.picketlink"/>
+        </dependencies>
+    </deployment>
+</jboss-deployment-structure>
+

diff --git a/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension b/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
new file mode 100644
index 0000000..ffaf42c
--- /dev/null
+++ b/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/classes/META-INF/services/io.undertow.servlet.ServletExtension
@@ -0,0 +1 @@
+org.picketlink.identity.federation.bindings.wildfly.sp.SPServletExtension
\ No newline at end of file

diff --git a/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/jboss-web.xml b/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/jboss-web.xml
new file mode 100644
index 0000000..b6279d9
--- /dev/null
+++ b/examples/saml/redirect-with-signature/conf/wildfly/WEB-INF/jboss-web.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <!-- You must have a security-domain configured in your JBoss EAP instance. The security-domain is necessary to provide user
+    authentication and roles mappings. In this case,we need a specific JAAS LoginModule that knows how to extract user's information from a SAML Assertion previously
+    issued by the Identity Provider. -->
+    <security-domain>sp</security-domain>
+
+    <!-- Here we just define the context path of the deployment. -->
+    <context-root>employee-sig</context-root>
+</jboss-web>

diff --git a/examples/saml/redirect-with-signature/configure-security-domain-eap.cli b/examples/saml/redirect-with-signature/configure-security-domain-eap.cli
new file mode 100644
index 0000000..9f9777c
--- /dev/null
+++ b/examples/saml/redirect-with-signature/configure-security-domain-eap.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/redirect-with-signature/configure-security-domain-wildfly.cli b/examples/saml/redirect-with-signature/configure-security-domain-wildfly.cli
new file mode 100644
index 0000000..6b65d5e
--- /dev/null
+++ b/examples/saml/redirect-with-signature/configure-security-domain-wildfly.cli
@@ -0,0 +1,16 @@
+# Batch script to add and configure the quickstart-domain security domain in the JBoss server
+
+# Start batching commands
+batch
+
+# Add and configure the security domain, then add the PicketLink SAML2LoginModule. Which wil be used to extract user's information from the SAML Assertion and authenticate the user.
+/subsystem=security/security-domain=sp:add(cache-type=default)
+/subsystem=security/security-domain=sp/authentication=classic:add
+/subsystem=security/security-domain=sp/authentication=classic/login-module=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule:add(code=org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule,flag=required)
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
+

diff --git a/examples/saml/redirect-with-signature/pom.xml b/examples/saml/redirect-with-signature/pom.xml
new file mode 100755
index 0000000..d491d8e
--- /dev/null
+++ b/examples/saml/redirect-with-signature/pom.xml
@@ -0,0 +1,116 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.picketlink.quickstarts</groupId>
+    <artifactId>picketlink-federation-saml-sp-redirect-with-signature</artifactId>
+    <version>2.7.0.Beta2</version>
+
+    <packaging>war</packaging>
+
+    <name>PicketLink Quickstart: picketlink-federation-saml-sp-redirect-with-signature</name>
+    <description>PicketLink Quickstart: PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding With Signature Support</description>
+
+    <url>http://www.picketlink.org</url>
+
+    <licenses>
+        <license>
+            <name>Apache License, Version 2.0</name>
+            <distribution>repo</distribution>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+        </license>
+    </licenses>
+
+    <properties>
+        <!-- JBoss AS dependency versions -->
+        <version.jboss.maven.plugin>7.4.Final</version.jboss.maven.plugin>
+
+        <!-- WildFly dependency versions -->
+        <version.wildfly.maven.plugin>1.0.1.Final</version.wildfly.maven.plugin>
+
+        <!-- PicketLink dependency versions -->
+        <version.picketlink.javaee.bom>2.7.0.Beta2</version.picketlink.javaee.bom>
+
+        <!-- Default target container. -->
+        <target.container>jboss-eap</target.container>
+
+        <!-- maven-war-plugin -->
+        <version.war.plugin>2.1.1</version.war.plugin>
+
+        <!-- maven-compiler-plugin -->
+        <version.compiler.plugin>3.1</version.compiler.plugin>
+        <maven.compiler.target>1.6</maven.compiler.target>
+        <maven.compiler.source>1.6</maven.compiler.source>
+    </properties>
+
+    <build>
+        <!-- Set the name of the war, used as the context root when the app is deployed -->
+        <finalName>${project.artifactId}</finalName>
+        <resources>
+            <resource>
+                <directory>src/main/resources</directory>
+            </resource>
+            <resource>
+                <directory>../redirect-basic/src/main/resources</directory>
+            </resource>
+        </resources>
+        <plugins>
+            <plugin>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>${version.war.plugin}</version>
+                <configuration>
+                    <!-- Java EE 6 doesn't require web.xml, Maven needs to catch up! -->
+                    <failOnMissingWebXml>false</failOnMissingWebXml>
+
+                    <!-- We need to get the configuration resources for the provided target container. -->
+                    <classifier>${target.container}</classifier>
+
+                    <!-- Instead of duplicating resources for each example application, we just reuse all resources from the
+                    base application. -->
+                    <webResources>
+                        <resource>
+                            <directory>src/main/webapp</directory>
+                        </resource>
+                        <resource>
+                            <directory>../redirect-basic/src/main/webapp</directory>
+                        </resource>
+						<resource>
+							<directory>${basedir}/conf/${target.container}</directory>
+						</resource>
+                    </webResources>
+                </configuration>
+            </plugin>
+            <!-- JBoss AS plugin to deploy war -->
+            <plugin>
+                <groupId>org.jboss.as.plugins</groupId>
+                <artifactId>jboss-as-maven-plugin</artifactId>
+                <version>${version.jboss.maven.plugin}</version>
+                <configuration>
+                    <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>wildfly</id>
+            <properties>
+                <target.container>wildfly</target.container>
+            </properties>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.wildfly.plugins</groupId>
+                        <artifactId>wildfly-maven-plugin</artifactId>
+                        <version>${version.wildfly.maven.plugin}</version>
+                        <configuration>
+                            <filename>${project.build.finalName}-${target.container}.${project.packaging}</filename>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+</project>
\ No newline at end of file

diff --git a/examples/saml/redirect-with-signature/README.md b/examples/saml/redirect-with-signature/README.md
new file mode 100755
index 0000000..329f554
--- /dev/null
+++ b/examples/saml/redirect-with-signature/README.md
@@ -0,0 +1,270 @@
+picketlink-federation-saml-sp-redirect-with-signature: PicketLink Service Provider With a Basic Configuration using SAML HTTP Redirect Binding With Signature Support
+===============================
+Author: Pedro Igor  
+Level: Intermediate  
+Technologies: PicketLink Federation, SAML v2.0  
+Summary: Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP Redirect Binding With Signature Support.  
+Source: <https://github.com/jboss-developer/jboss-picketlink-quickstarts/>
+
+
+What is it?
+-----------
+
+This example demonstrates Keycloak SAML 2.0 support in conjunction with a servlet secured by Picketlink's SAML SP client.
+
+
+Make sure you've set up the Keycloak Server
+--------------------------------------
+The Keycloak Appliance Distribution comes with a preconfigured Keycloak server (based on Wildfly).  You can use it out of
+the box to run these demos.  So, if you're using this, you can head to Step 2.
+
+Alternatively, you can install the Keycloak Server onto any JBoss AS 7.1.1, EAP 6.x, or Wildfly 8.x server, but there is
+a few steps you must follow.
+
+Obtain latest keycloak-war-dist-all.zip.  This distro is used to install Keycloak onto an existing JBoss installation.
+This installs the server.
+
+    $ cd ${wildfly.jboss.home}/standalone
+    $ cp -r ${keycloak-war-dist-all}/deployments .
+
+To be able to run the demos you also need to install the Keycloak client adapter. For Wildfly:
+
+    $ cd ${wildfly.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-wildfly-adapter-dist.zip
+
+For JBoss EAP 6.x
+
+    $ cd ${eap.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-eap6-adapter-dist.zip
+
+For JBoss AS 7.1.1:
+
+    $ cd ${as7.home}
+    $ unzip ${keycloak-war-dist-all}/adapters/keycloak-as7-adapter-dist.zip
+
+Unzipping the adapter ZIP only installs the JAR files.  You must also add the Keycloak Subsystem to the server's
+configuration (standalone/configuration/standalone.xml).
+
+For Wildfly:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-wildfly-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+For JBoss 7.1.1 and EAP 6.x:
+
+    <server xmlns="urn:jboss:domain:1.4">
+
+        <extensions>
+            <extension module="org.keycloak.keycloak-as7-subsystem"/>
+            ...
+        </extensions>
+
+        <profile>
+            <subsystem xmlns="urn:jboss:domain:keycloak:1.0"/>
+            ...
+        </profile>
+
+
+Boot Keycloak Server
+---------------------------------------
+Where you go to start up the Keycloak Server depends on which distro you installed.
+
+From appliance:
+
+```
+$ cd keycloak/bin
+$ ./standalone.sh
+```
+
+
+From existing Wildfly/EAP6/AS7 distro
+
+```
+$ cd ${wildfly.jboss.home}/bin
+$ ./standalone.sh
+```
+
+
+Import the Test Realm
+---------------------------------------
+Next thing you have to do is import the test realm for the demo.  Clicking on the below link will bring you to the
+create realm page in the Admin UI.  The username/password is admin/admin to login in.  Keycloak will ask you to
+create a new admin password before you can go to the create realm page.
+
+[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
+
+Import the testsaml.json file that is in the saml/ example directory.
+
+Install Picketlink Modules into App server
+------------------------------------------
+
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+You may have to upgrade your picketlink modules in your JBoss EAP or Wildfly distribution.  See Picketlink docs for more details.
+
+Create the Security Domain for JBoss EAP
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-eap.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-eap.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-eap.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+Create the Security Domain for WildFly
+---------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+These steps assume you are running the server in standalone mode and using the default standalone.xml supplied with the distribution.
+
+You configure the security domain by running JBoss CLI commands. For your convenience, this quickstart batches the commands into a `configure-security-domain-wildfly.cli` script provided in the root directory of this quickstart.
+
+1. Before you begin, back up your server configuration file
+    * If it is running, stop the JBoss server.
+    * Backup the file: `JBOSS_HOME/standalone/configuration/standalone.xml`
+    * After you have completed testing this quickstart, you can replace this file to restore the server to its original configuration.
+
+2. Start the JBoss server by typing the following:
+
+        For Linux:  JBOSS_HOME/bin/standalone.sh
+        For Windows:  JBOSS_HOME\bin\standalone.bat
+3. Review the `configure-security-domain-wildfly.cli` file in the root of this quickstart directory. This script adds the `sp` domain to the `security` subsystem in the server configuration and configures authentication access. Comments in the script describe the purpose of each block of commands.
+
+4. Open a new command prompt, navigate to the root directory of this quickstart, and run the following command, replacing JBOSS_HOME with the path to your server:
+
+        JBOSS_HOME/bin/jboss-cli.sh --connect --file=configure-security-domain-wildfly.cli
+
+You should see the following result when you run the script:
+
+        The batch executed successfully
+        {
+            "outcome" => "success",
+        }
+
+
+
+Review the Modified Server Configuration for EAP
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you want to review and understand newly added XML configuration, stop the JBoss server and open the  `JBOSS_HOME/standalone/configuration/standalone.xml` file.
+
+The following `sp` security-domain was added to the `security` subsystem.
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.jboss.auth.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+The configuration above defines a security-domain which will be used by the SP to authenticate users based on a SAML Assertion previously issued by a Identity Provider.
+
+Review the Modified Server Configuration for WildFly
+-----------------------------------
+If you are running this example with the Keycloak application distribution, you can skip this step.
+
+If you are using Wildfly, the security-domain should have the following configuration:
+
+        <security-domain name="sp" cache-type="default">
+            <authentication>
+                <login-module code="org.picketlink.identity.federation.bindings.wildfly.SAML2LoginModule" flag="required"/>
+            </authentication>
+        </security-domain>
+
+
+SAML SP-Initiated Single Sign-On
+-----------------------------------
+
+The SAML v2.0 specification defines a specific SSO mode called *SP-Initiated SSO*. In this mode, the SSO flow starts at the Service Provider side.
+Please, take a look at the following documentation for more details:
+
+1. [SAML v2.0 SP-Initiated SSO](https://docs.jboss.org/author/display/PLINK/SP-Initiated+SSO)
+
+
+Start JBoss Enterprise Application Platform 6 or WildFly with the Web Profile
+-------------------------
+
+1. Open a command line and navigate to the root of the JBoss server directory.
+2. The following shows the command line to start the server with the web profile:
+
+        For Linux:   JBOSS_HOME/bin/standalone.sh
+        For Windows: JBOSS_HOME\bin\standalone.bat
+
+ 
+Build and Deploy the Quickstart
+-------------------------
+
+_NOTE: The following build command assumes you have configured your Maven user settings. If you have not, you must include Maven setting arguments on the command line. See [Build and Deploy the Quickstarts](../README.md#build-and-deploy-the-quickstarts) for complete instructions and additional options._
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. Type this command to build and deploy the archive:
+
+        For EAP 6:     mvn clean package jboss-as:deploy
+        For WildFly:   mvn -Pwildfly clean package wildfly:deploy
+
+4. This will deploy `target/picketlink-federation-saml-sp-redirect-with-signature.war` to the running instance of the server.
+
+
+Access the application
+---------------------
+
+The application will be running at the following URL: <http://localhost:8080/employee-sig>.
+
+*Note: A Service Provider alone is not very useful without an Identity Provider to authenticate users and issue SAML Assertions. Once you get this application deployed, please take a look at [About the PicketLink Federation Quickstarts](../README.md#about-the-picketlink-federation-quickstarts).*
+
+Undeploy the Archive
+--------------------
+
+1. Make sure you have started the JBoss Server as described above.
+2. Open a command line and navigate to the root directory of this quickstart.
+3. When you are finished testing, type this command to undeploy the archive:
+
+        For EAP 6:     mvn jboss-as:undeploy
+        For WildFly:   mvn -Pwildfly wildfly:undeploy
+
+
+Run the Quickstart in JBoss Developer Studio or Eclipse
+-------------------------------------
+You can also start the server and deploy the quickstarts from Eclipse using JBoss tools. For more information, see [Use JBoss Developer Studio or Eclipse to Run the Quickstarts](../README.md#use-jboss-developer-studio-or-eclipse-to-run-the-quickstarts) 
+
+
+Debug the Application
+------------------------------------
+
+If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
+
+        mvn dependency:sources
+        mvn dependency:resolve -Dclassifier=javadoc
\ No newline at end of file

diff --git a/examples/saml/redirect-with-signature/remove-security-domain.cli b/examples/saml/redirect-with-signature/remove-security-domain.cli
new file mode 100644
index 0000000..9487613
--- /dev/null
+++ b/examples/saml/redirect-with-signature/remove-security-domain.cli
@@ -0,0 +1,13 @@
+# Batch script to remove the quickstart-domain security domain from the JBoss server
+
+# Start batching commands
+batch
+
+# Remove the security domain
+/subsystem=security/security-domain=sp:remove
+
+# Run the batch commands
+run-batch
+
+# Reload the server configuration
+:reload
\ No newline at end of file

diff --git a/examples/saml/redirect-with-signature/src/main/resources/keystore.jks b/examples/saml/redirect-with-signature/src/main/resources/keystore.jks
new file mode 100755
index 0000000..f044ece
Binary files /dev/null and b/examples/saml/redirect-with-signature/src/main/resources/keystore.jks differ

diff --git a/examples/saml/redirect-with-signature/src/main/webapp/WEB-INF/picketlink.xml b/examples/saml/redirect-with-signature/src/main/webapp/WEB-INF/picketlink.xml
new file mode 100755
index 0000000..609b428
--- /dev/null
+++ b/examples/saml/redirect-with-signature/src/main/webapp/WEB-INF/picketlink.xml
@@ -0,0 +1,36 @@
+<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
+	<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
+		ServerEnvironment="tomcat" BindingType="REDIRECT" SupportsSignatures="true">
+		<IdentityURL>${idp-sig.url::http://localhost:8080/auth/realms/saml-demo/protocol/saml}
+		</IdentityURL>
+		<ServiceURL>${employee-sig.url::http://localhost:8080/employee-sig/}
+		</ServiceURL>
+		<KeyProvider
+			ClassName="org.picketlink.identity.federation.core.impl.KeyStoreKeyManager">
+			<Auth Key="KeyStoreURL" Value="/keystore.jks" />
+			<Auth Key="KeyStorePass" Value="store123" />
+			<Auth Key="SigningKeyPass" Value="test123" />
+			<Auth Key="SigningKeyAlias" Value="http://localhost:8080/employee-sig/" />
+			<ValidatingAlias Key="localhost" Value="saml-demo" />
+			<ValidatingAlias Key="127.0.0.1" Value="saml-demo" />
+		</KeyProvider>
+	</PicketLinkSP>
+	<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler" />
+		<Handler
+			class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler" />
+		<Handler
+            class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureGenerationHandler">
+            <!--
+                This is a optional configuration. By default, method http://www.w3.org/2000/09/xmldsig#rsa-sha1
+                and digest http://www.w3.org/2000/09/xmldsig#sha1 are used. -->
+            <Option Key="SIGN_METHOD" Value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
+            <Option Key="SIGN_DIGEST" Value="http://www.w3.org/2001/04/xmlenc#sha256"/>
+        </Handler>
+        <Handler
+            class="org.picketlink.identity.federation.web.handlers.saml2.SAML2SignatureValidationHandler" />
+	</Handlers>
+</PicketLink>
\ No newline at end of file

diff --git a/examples/saml/testsaml.json b/examples/saml/testsaml.json
new file mode 100755
index 0000000..210c459
--- /dev/null
+++ b/examples/saml/testsaml.json
@@ -0,0 +1,118 @@
+{
+    "id": "saml-demo",
+    "realm": "saml-demo",
+    "enabled": true,
+    "sslRequired": "external",
+    "passwordCredentialGrantAllowed": true,
+    "privateKey": "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=",
+    "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
+    "requiredCredentials": [ "password" ],
+    "defaultRoles": [ "user" ],
+    "smtpServer": {
+        "from": "auto@keycloak.org",
+        "host": "localhost",
+        "port":"3025"
+    },
+    "users" : [
+        {
+            "username" : "bburke",
+            "enabled": true,
+            "email" : "bburke@redhat.com",
+            "credentials" : [
+                { "type" : "password",
+                  "value" : "password" }
+            ],
+            "realmRoles": ["manager"]
+        }
+    ],
+    "applications": [
+        {
+            "name": "http://localhost:8080/sales-post/",
+            "enabled": true,
+            "fullScopeAllowed": true,
+            "protocol": "saml",
+            "baseUrl": "http://localhost:8080/sales-post",
+            "adminUrl": "http://localhost:8080/sales-post",
+            "redirectUris": [
+                "http://localhost:8080/sales-post/*"
+            ]
+        },
+        {
+            "name": "http://localhost:8080/sales-post-sig/",
+            "enabled": true,
+            "protocol": "saml",
+            "fullScopeAllowed": true,
+            "baseUrl": "http://localhost:8080/sales-post-sig",
+            "adminUrl": "http://localhost:8080/sales-post-sig",
+            "redirectUris": [
+                "http://localhost:8080/sales-post-sig/*"
+            ],
+            "attributes": {
+                "saml.server.signature": "true",
+                "saml.signature.algorithm": "RSA_SHA256",
+                "saml.client.signature": "true",
+                "privateKey": "MIICWwIBAAKBgQDVG8a7xGN6ZIkDbeecySygcDfsypjUMNPE4QJjis8B316CvsZQ0hcTTLUyiRpHlHZys2k3xEhHBHymFC1AONcvzZzpb40tAhLHO1qtAnut00khjAdjR3muLVdGkM/zMC7G5s9iIwBVhwOQhy+VsGnCH91EzkjZ4SVEr55KJoyQJQIDAQABAoGADaTtoG/+foOZUiLjRWKL/OmyavK9vjgyFtThNkZY4qHOh0h3og0RdSbgIxAsIpEa1FUwU2W5yvI6mNeJ3ibFgCgcxqPk6GkAC7DWfQfdQ8cS+dCuaFTs8ObIQEvU50YzeNPiiFxRA+MnauCUXaKm/PnDfjd4tPgru7XZvlGh0wECQQDsBbN2cKkBKpr/b5oJiBcBaSZtWiMNuYBDn9x8uORj+Gy/49BUIMHF2EWyxOWz6ocP5YiynNRkPe21Zus7PEr1AkEA5yWQOkxUTIg43s4pxNSeHtL+Ebqcg54lY2xOQK0yufxUVZI8ODctAKmVBMiCKpU3mZQquOaQicuGtocpgxlScQI/YM31zZ5nsxLGf/5GL6KhzPJT0IYn2nk7IoFu7bjn9BjwgcPurpLA52TNMYWQsTqAKwT6DEhG1NaRqNWNpb4VAkBehObAYBwMm5udyHIeEc+CzUalm0iLLa0eRdiN7AUVNpCJ2V2Uo0NcxPux1AgeP5xXydXafDXYkwhINWcNO9qRAkEA58ckAC5loUGwU5dLaugsGH/a2Q8Ac8bmPglwfCstYDpl8Gp/eimb1eKyvDEELOhyImAv4/uZV9wN85V0xZXWsw==",
+                "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVG8a7xGN6ZIkDbeecySygcDfsypjUMNPE4QJjis8B316CvsZQ0hcTTLUyiRpHlHZys2k3xEhHBHymFC1AONcvzZzpb40tAhLHO1qtAnut00khjAdjR3muLVdGkM/zMC7G5s9iIwBVhwOQhy+VsGnCH91EzkjZ4SVEr55KJoyQJQIDAQAB",
+                "X509Certificate": "MIIB1DCCAT0CBgFJGP5dZDANBgkqhkiG9w0BAQsFADAwMS4wLAYDVQQDEyVodHRwOi8vbG9jYWxob3N0OjgwODAvc2FsZXMtcG9zdC1zaWcvMB4XDTE0MTAxNjEyNDQyM1oXDTI0MTAxNjEyNDYwM1owMDEuMCwGA1UEAxMlaHR0cDovL2xvY2FsaG9zdDo4MDgwL3NhbGVzLXBvc3Qtc2lnLzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1RvGu8RjemSJA23nnMksoHA37MqY1DDTxOECY4rPAd9egr7GUNIXE0y1MokaR5R2crNpN8RIRwR8phQtQDjXL82c6W+NLQISxztarQJ7rdNJIYwHY0d5ri1XRpDP8zAuxubPYiMAVYcDkIcvlbBpwh/dRM5I2eElRK+eSiaMkCUCAwEAATANBgkqhkiG9w0BAQsFAAOBgQCLms6htnPaY69k1ntm9a5jgwSn/K61cdai8R8B0ccY7zvinn9AfRD7fiROQpFyY29wKn8WCLrJ86NBXfgFUGyR5nLNHVy3FghE36N2oHy53uichieMxffE6vhkKJ4P8ChfJMMOZlmCPsQPDvjoAghHt4mriFiQgRdPgIy/zDjSNw=="
+            }
+        },
+        {
+            "name": "http://localhost:8080/sales-post-enc/",
+            "enabled": true,
+            "protocol": "saml",
+            "fullScopeAllowed": true,
+            "baseUrl": "http://localhost:8080/sales-post-enc",
+            "adminUrl": "http://localhost:8080/sales-post-enc",
+            "redirectUris": [
+                "http://localhost:8080/sales-post-enc/*"
+            ],
+            "attributes": {
+                "saml.server.signature": "true",
+                "saml.signature.algorithm": "RSA_SHA512",
+                "saml.client.signature": "true",
+                "saml.encrypt": "true",
+                "privateKey": "MIICXQIBAAKBgQDb7kwJPkGdU34hicplwfp6/WmNcaLh94TSc7Jyr9Undp5pkyLgb0DE7EIE+6kSs4LsqCb8HDkB0nLD5DXbBJFd8n0WGoKstelvtg6FtVJMnwN7k7yZbfkPECWH9zF70VeOo9vbzrApNRnct8ZhH5fbflRB4JMA9L9R+LbURdoSKQIDAQABAoGBANtbZG9bruoSGp2s5zhzLzd4hczT6Jfk3o9hYjzNb5Z60ymN3Z1omXtQAdEiiNHkRdNxK+EM7TcKBfmoJqcaeTkW8cksVEAW23ip8W9/XsLqmbU2mRrJiKa+KQNDSHqJi1VGyimi4DDApcaqRZcaKDFXg2KDr/Qt5JFD/o9IIIPZAkEA+ZENdBIlpbUfkJh6Ln+bUTss/FZ1FsrcPZWu13rChRMrsmXsfzu9kZUWdUeQ2Dj5AoW2Q7L/cqdGXS7Mm5XhcwJBAOGZq9axJY5YhKrsksvYRLhQbStmGu5LG75suF+rc/44sFq+aQM7+oeRr4VY88Mvz7mk4esdfnk7ae+cCazqJvMCQQCx1L1cZw3yfRSn6S6u8XjQMjWE/WpjulujeoRiwPPY9WcesOgLZZtYIH8nRL6ehEJTnMnahbLmlPFbttxPRUanAkA11MtSIVcKzkhp2KV2ipZrPJWwI18NuVJXb+3WtjypTrGWFZVNNkSjkLnHIeCYlJIGhDd8OL9zAiBXEm6kmgLNAkBWAg0tK2hCjvzsaA505gWQb4X56uKWdb0IzN+fOLB3Qt7+fLqbVQNQoNGzqey6B4MoS1fUKAStqdGTFYPG/+9t",
+                "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDb7kwJPkGdU34hicplwfp6/WmNcaLh94TSc7Jyr9Undp5pkyLgb0DE7EIE+6kSs4LsqCb8HDkB0nLD5DXbBJFd8n0WGoKstelvtg6FtVJMnwN7k7yZbfkPECWH9zF70VeOo9vbzrApNRnct8ZhH5fbflRB4JMA9L9R+LbURdoSKQIDAQAB",
+                "X509Certificate": "MIIB1DCCAT0CBgFJGVacCDANBgkqhkiG9w0BAQsFADAwMS4wLAYDVQQDEyVodHRwOi8vbG9jYWxob3N0OjgwODAvc2FsZXMtcG9zdC1lbmMvMB4XDTE0MTAxNjE0MjA0NloXDTI0MTAxNjE0MjIyNlowMDEuMCwGA1UEAxMlaHR0cDovL2xvY2FsaG9zdDo4MDgwL3NhbGVzLXBvc3QtZW5jLzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA2+5MCT5BnVN+IYnKZcH6ev1pjXGi4feE0nOycq/VJ3aeaZMi4G9AxOxCBPupErOC7Kgm/Bw5AdJyw+Q12wSRXfJ9FhqCrLXpb7YOhbVSTJ8De5O8mW35DxAlh/cxe9FXjqPb286wKTUZ3LfGYR+X235UQeCTAPS/Ufi21EXaEikCAwEAATANBgkqhkiG9w0BAQsFAAOBgQBMrfGD9QFfx5v7ld/OAto5rjkTe3R1Qei8XRXfcs83vLaqEzjEtTuLGrJEi55kXuJgBpVmQpnwCCkkjSy0JxbqLDdVi9arfWUxEGmOr01ZHycELhDNaQcFqVMPr5kRHIHgktT8hK2IgCvd3Fy9/JCgUgCPxKfhwecyEOKxUc857g=="
+            }
+        },
+        {
+            "name": "http://localhost:8080/employee/",
+            "enabled": true,
+            "fullScopeAllowed": true,
+            "protocol": "saml",
+            "baseUrl": "http://localhost:8080/employee",
+            "adminUrl": "http://localhost:8080/employee",
+            "redirectUris": [
+                "http://localhost:8080/employee/*"
+            ]
+        },
+        {
+            "name": "http://localhost:8080/employee-sig/",
+            "enabled": true,
+            "protocol": "saml",
+            "fullScopeAllowed": true,
+            "baseUrl": "http://localhost:8080/employee-sig",
+            "adminUrl": "http://localhost:8080/employee-sig",
+            "redirectUris": [
+                "http://localhost:8080/employee-sig/*"
+            ],
+            "attributes": {
+                "saml.server.signature": "true",
+                "saml.client.signature": "true",
+                "saml.signature.algorithm": "RSA_SHA1",
+                "privateKey": "MIICXQIBAAKBgQC+9kVgPFpshjS2aT2g52lqTv2lqb1jgvXZVk7iFF4LAO6SdCXKXRZI4SuzIRkVNpE1a42V1kQRlaozoFklgvX5sje8tkpa9ylq+bxGXM9RRycqRu2B+oWUV7Aqq7Bs0Xud0WeHQYRcEoCjqsFKGy65qkLRDdT70FTJgpSHts+gDwIDAQABAoGANU1efgc6ojIvwn7Lsf8GAKN9z2D6uS0T3I9nw1k2CtI+xWhgKAUltEANx5lEfBRYIdYclidRpqrk8DYgzASrDYTHXzqVBJfAk1VrAGpqyRq+TNMLUHkXiTiSDOQ6WqhX93UGMmAgQm1RsLa6+fy1BO/B2y85+Yf2OUylsKS6avECQQDslRDiNFdtEjdvyOL20tQ7+W+eKVxVxKAyQ3gFjIIDizELZt+Jq1Wz6XV9NhK1JFtlVugeD1tlW/+K16fEmDYXAkEAzqKoN/JeGb20rfQldAUWdQbb0jrQAYlgoSU/9fYH9YVJT8vnkfhPBTwIw9H9euf1//lRP/jHltHd5ch4230YyQJBAN3rOkoltPiABPZbpuLGgwS7BwOCYrWlWmurtBLoaTCvyVKbrgXybNL1pBrOtR+rufvGWLeRyja65Gs1vY6BBQMCQQCTsNq/MjJj/522f7yNUl2cw4w2lOa7Um+IflFbAcDqkZu2ty0Kvgns2d4B6INeZ5ECpjaWnMA7YkFRzZnkd2NRAkB8lEY56ScnNigoZkkjtEUd2ejdhZPYuS9SKfv9zHwN+I+DE2vVFZz8GPq/iLcMx13PkZaYaJNQ4FtQY/hRLSn5",
+                "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+9kVgPFpshjS2aT2g52lqTv2lqb1jgvXZVk7iFF4LAO6SdCXKXRZI4SuzIRkVNpE1a42V1kQRlaozoFklgvX5sje8tkpa9ylq+bxGXM9RRycqRu2B+oWUV7Aqq7Bs0Xud0WeHQYRcEoCjqsFKGy65qkLRDdT70FTJgpSHts+gDwIDAQAB",
+                "X509Certificate": "MIIB0DCCATkCBgFJH5u0EDANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNodHRwOi8vbG9jYWxob3N0OjgwODAvZW1wbG95ZWUtc2lnLzAeFw0xNDEwMTcxOTMzNThaFw0yNDEwMTcxOTM1MzhaMC4xLDAqBgNVBAMTI2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9lbXBsb3llZS1zaWcvMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+9kVgPFpshjS2aT2g52lqTv2lqb1jgvXZVk7iFF4LAO6SdCXKXRZI4SuzIRkVNpE1a42V1kQRlaozoFklgvX5sje8tkpa9ylq+bxGXM9RRycqRu2B+oWUV7Aqq7Bs0Xud0WeHQYRcEoCjqsFKGy65qkLRDdT70FTJgpSHts+gDwIDAQABMA0GCSqGSIb3DQEBCwUAA4GBACKyPLGqMX8GsIrCfJU8eVnpaqzTXMglLVo/nTcfAnWe9UAdVe8N3a2PXpDBvuqNA/DEAhVcQgxdlOTWnB6s8/yLTRuH0bZgb3qGdySif+lU+E7zZ/SiDzavAvn+ABqemnzHcHyhYO+hNRGHvUbW5OAii9Vdjhm8BI32YF1NwhKp"
+            }
+        }
+    ],
+    "roles" : {
+        "realm" : [
+            {
+                "name": "manager",
+                "description": "Have Manager privileges"
+            }
+        ]
+    }
+}

diff --git a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
index 60d7ae5..590f78c 100755
--- a/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
+++ b/forms/common-themes/src/main/resources/theme/admin/base/resources/partials/application-detail.html
@@ -84,7 +84,7 @@
                     <span tooltip-placement="right" tooltip="Should SAML asserts be encrypted with client's public key?" class="fa fa-info-circle"></span>
                 </div>
                 <div class="form-group clearfix block" data-ng-show="protocol == 'saml'">
-                    <label class="col-sm-2 control-label" for="samlClientSignature">Client Signatures</label>
+                    <label class="col-sm-2 control-label" for="samlClientSignature">Client Signature Required</label>
                     <div class="col-sm-6">
                         <input ng-model="samlClientSignature" ng-click="switchChange()" name="samlClientSignature" id="samlClientSignature" onoffswitch />
                     </div>

diff --git a/pom.xml b/pom.xml
index 623b0e0..5b3f154 100755
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,8 @@
         <resteasy.version>2.3.7.Final</resteasy.version>
         <resteasy.version.latest>3.0.9.Final</resteasy.version.latest>
         <undertow.version>1.0.15.Final</undertow.version>
-        <picketlink.version>2.7.0.CR1-20140924</picketlink.version>
+<!--        <picketlink.version>2.7.0.CR1-20140924</picketlink.version>  -->
+        <picketlink.version>2.7.0.CR1</picketlink.version>
         <picketbox.ldap.version>1.0.2.Final</picketbox.ldap.version>
         <mongo.driver.version>2.11.3</mongo.driver.version>
         <jboss.logging.version>3.1.4.GA</jboss.logging.version>
@@ -252,6 +253,16 @@
                 <version>${picketlink.version}</version>
             </dependency>
             <dependency>
+                <groupId>org.picketlink</groupId>
+                <artifactId>picketlink-api</artifactId>
+                <version>${picketlink.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.picketlink</groupId>
+                <artifactId>picketlink-impl</artifactId>
+                <version>${picketlink.version}</version>
+            </dependency>
+            <dependency>
                 <groupId>org.picketbox</groupId>
                 <artifactId>picketbox-ldap</artifactId>
                 <version>${picketbox.ldap.version}</version>

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
index 6ed495d..3d53c66 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SALM2LoginResponseBuilder.java
@@ -53,7 +53,11 @@ public class SALM2LoginResponseBuilder extends SAML2BindingBuilder<SALM2LoginRes
     }
 
     public SALM2LoginResponseBuilder attribute(String name, Object value) {
-        this.attributes.put(name, value);
+        if (value == null) {
+            attributes.remove(name);
+        } else {
+            this.attributes.put(name, value);
+        }
         return this;
     }
 
@@ -99,11 +103,16 @@ public class SALM2LoginResponseBuilder extends SAML2BindingBuilder<SALM2LoginRes
         return this;
     }
 
-    public BindingBuilder binding() throws ConfigurationException, ProcessingException {
+    public RedirectBindingBuilder redirectBinding()  throws ConfigurationException, ProcessingException {
+        Document samlResponseDocument = buildDocument();
+        return new RedirectBindingBuilder(samlResponseDocument);
+
+    }
 
+    public PostBindingBuilder postBinding()  throws ConfigurationException, ProcessingException {
         Document samlResponseDocument = buildDocument();
+        return new PostBindingBuilder(samlResponseDocument);
 
-        return new BindingBuilder(samlResponseDocument);
     }
 
     public Document buildDocument() throws ConfigurationException, ProcessingException {
@@ -167,7 +176,7 @@ public class SALM2LoginResponseBuilder extends SAML2BindingBuilder<SALM2LoginRes
             throw logger.samlAssertionMarshallError(e);
         }
 
-        encryptAndSign(samlResponseDocument);
+        if (encrypt) encryptDocument(samlResponseDocument);
         return samlResponseDocument;
     }
 

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2BindingBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2BindingBuilder.java
index 74408f6..c255021 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2BindingBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2BindingBuilder.java
@@ -109,26 +109,49 @@ public class SAML2BindingBuilder<T extends SAML2BindingBuilder> {
         return (T)this;
     }
 
-    public class BindingBuilder {
+    public class PostBindingBuilder {
         protected Document document;
 
-        public BindingBuilder(Document document) {
+        public PostBindingBuilder(Document document) throws ProcessingException {
             this.document = document;
+            if (signed) {
+                signDocument(document);
+            }
         }
 
+        public String encoded() throws ProcessingException, ConfigurationException, IOException {
+            byte[] responseBytes = org.picketlink.identity.federation.core.saml.v2.util.DocumentUtil.getDocumentAsString(document).getBytes("UTF-8");
+            return PostBindingUtil.base64Encode(new String(responseBytes));
+        }
         public Document getDocument() {
             return document;
         }
-        public Response postResponse() throws ConfigurationException, ProcessingException, IOException {
+
+        public String htmlResponse() throws ProcessingException, ConfigurationException, IOException {
+            return buildHtml(encoded());
+
+        }
+        public Response response() throws ConfigurationException, ProcessingException, IOException {
             return buildResponse(document);
         }
+    }
 
-        public URI redirectResponseUri() throws ConfigurationException, ProcessingException, IOException {
-            return generateRedirectUri("SAMLResponse", document);
+
+    public class RedirectBindingBuilder {
+        protected Document document;
+
+        public RedirectBindingBuilder(Document document) {
+            this.document = document;
         }
 
-        public Response redirectResponse() throws ProcessingException, ConfigurationException, IOException {
-            URI uri = redirectResponseUri();
+        public Document getDocument() {
+            return document;
+        }
+        public URI responseUri() throws ConfigurationException, ProcessingException, IOException {
+            return generateRedirectUri("SAMLResponse", document);
+        }
+        public Response response() throws ProcessingException, ConfigurationException, IOException {
+            URI uri = responseUri();
 
             CacheControl cacheControl = new CacheControl();
             cacheControl.setNoCache(true);
@@ -140,6 +163,7 @@ public class SAML2BindingBuilder<T extends SAML2BindingBuilder> {
     }
 
 
+
     private String getSAMLNSPrefix(Document samlResponseDocument) {
         Node assertionElement = samlResponseDocument.getDocumentElement()
                 .getElementsByTagNameNS(JBossSAMLURIConstants.ASSERTION_NSURI.get(), JBossSAMLConstants.ASSERTION.get()).item(0);
@@ -171,18 +195,6 @@ public class SAML2BindingBuilder<T extends SAML2BindingBuilder> {
 
     }
 
-    protected void encryptAndSign(Document samlDocument) throws ProcessingException {
-        if (encrypt) {
-            encryptDocument(samlDocument);
-            signDocument(samlDocument);
-            return;
-        }
-        if (signed) {
-            signDocument(samlDocument);
-            return;
-        }
-    }
-
     protected void signDocument(Document samlDocument) throws ProcessingException {
         SamlProtocolUtils.signDocument(samlDocument, signingKeyPair, signatureAlgorithm.getXmlSignatureMethod(), signatureAlgorithm.getXmlSignatureDigestMethod(), signingCertificate);
     }
@@ -201,6 +213,10 @@ public class SAML2BindingBuilder<T extends SAML2BindingBuilder> {
         byte[] responseBytes = DocumentUtil.getDocumentAsString(responseDoc).getBytes("UTF-8");
         String samlResponse = PostBindingUtil.base64Encode(new String(responseBytes));
 
+        return buildHtml(samlResponse);
+    }
+
+    protected String buildHtml(String samlResponse) {
         if (destination == null) {
             throw SALM2LoginResponseBuilder.logger.nullValueError("Destination is null");
         }

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
index 8d7a815..c4a2c2b 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2ErrorResponseBuilder.java
@@ -18,7 +18,27 @@ import org.w3c.dom.Document;
  */
 public class SAML2ErrorResponseBuilder extends SAML2BindingBuilder<SAML2ErrorResponseBuilder> {
 
-    public Document buildDocument(String status) throws ProcessingException {
+    protected String status;
+
+    public SAML2ErrorResponseBuilder status(String status) {
+        this.status = status;
+        return this;
+    }
+
+    public RedirectBindingBuilder redirectBinding()  throws ConfigurationException, ProcessingException {
+        Document samlResponseDocument = buildDocument();
+        return new RedirectBindingBuilder(samlResponseDocument);
+
+    }
+
+    public PostBindingBuilder postBinding()  throws ConfigurationException, ProcessingException {
+        Document samlResponseDocument = buildDocument();
+        return new PostBindingBuilder(samlResponseDocument);
+
+    }
+
+
+    public Document buildDocument() throws ProcessingException {
         Document samlResponse = null;
         ResponseType responseType = null;
 
@@ -41,15 +61,9 @@ public class SAML2ErrorResponseBuilder extends SAML2BindingBuilder<SAML2ErrorRes
         responseType.setStatus(JBossSAMLAuthnResponseFactory.createStatusTypeForResponder(status));
         responseType.setDestination(destination);
 
-        encryptAndSign(samlResponse);
+        if (encrypt) encryptDocument(samlResponse);
         return samlResponse;
     }
 
-    public BindingBuilder binding(String status) throws ConfigurationException, ProcessingException {
-
-        Document samlResponseDocument = buildDocument(status);
-
-        return new BindingBuilder(samlResponseDocument);
-    }
 
 }

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2LogoutRequestBuilder.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2LogoutRequestBuilder.java
index 39c23c7..045b318 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2LogoutRequestBuilder.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SAML2LogoutRequestBuilder.java
@@ -2,6 +2,8 @@ package org.keycloak.protocol.saml;
 
 import org.picketlink.common.constants.JBossSAMLURIConstants;
 import org.picketlink.common.exceptions.ConfigurationException;
+import org.picketlink.common.exceptions.ParsingException;
+import org.picketlink.common.exceptions.ProcessingException;
 import org.picketlink.identity.federation.api.saml.v2.request.SAML2Request;
 import org.picketlink.identity.federation.core.saml.v2.util.DocumentUtil;
 import org.picketlink.identity.federation.core.saml.v2.util.XMLTimeUtil;
@@ -11,6 +13,7 @@ import org.picketlink.identity.federation.saml.v2.protocol.LogoutRequestType;
 import org.picketlink.identity.federation.web.util.PostBindingUtil;
 import org.w3c.dom.Document;
 
+import java.io.IOException;
 import java.net.URI;
 
 /**
@@ -25,15 +28,21 @@ public class SAML2LogoutRequestBuilder extends SAML2BindingBuilder<SAML2LogoutRe
         return this;
     }
 
-    public String buildRequestString() {
-        try {
-            Document logoutRequestDocument = new SAML2Request().convert(createLogoutRequest());
-            encryptAndSign(logoutRequestDocument);
-            byte[] responseBytes = DocumentUtil.getDocumentAsString(logoutRequestDocument).getBytes("UTF-8");
-            return PostBindingUtil.base64Encode(new String(responseBytes));
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
+    public RedirectBindingBuilder redirectBinding()  throws ConfigurationException, ProcessingException, ParsingException {
+        Document samlResponseDocument = buildDocument();
+        return new RedirectBindingBuilder(samlResponseDocument);
+
+    }
+
+    public PostBindingBuilder postBinding()  throws ConfigurationException, ProcessingException, ParsingException {
+        Document samlResponseDocument = buildDocument();
+        return new PostBindingBuilder(samlResponseDocument);
+
+    }
+    public Document buildDocument() throws ProcessingException, ConfigurationException, ParsingException {
+        Document document = new SAML2Request().convert(createLogoutRequest());
+        if (encrypt) encryptDocument(document);
+        return document;
     }
 
     private LogoutRequestType createLogoutRequest() throws ConfigurationException {

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
index 5021d0c..e2c0fd5 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlProtocolFactory.java
@@ -22,7 +22,7 @@ public class SamlProtocolFactory implements LoginProtocolFactory {
 
     @Override
     public LoginProtocol create(KeycloakSession session) {
-        return new SalmProtocol().setSession(session);
+        return new SamlProtocol().setSession(session);
     }
 
     @Override

diff --git a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
index 1ccfba1..2b42828 100755
--- a/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
+++ b/saml/saml-protocol/src/main/java/org/keycloak/protocol/saml/SamlService.java
@@ -42,11 +42,9 @@ import javax.ws.rs.core.SecurityContext;
 import javax.ws.rs.core.UriBuilder;
 import javax.ws.rs.core.UriInfo;
 import javax.ws.rs.ext.Providers;
-import java.io.IOException;
 import java.net.URI;
 import java.security.PublicKey;
 import java.security.Signature;
-import java.security.SignatureException;
 
 /**
  * Resource class for the oauth/openid connect token service
@@ -195,10 +193,10 @@ public class SamlService {
 
 
             ClientSessionModel clientSession = session.sessions().createClientSession(realm, client);
-            clientSession.setAuthMethod(SalmProtocol.LOGIN_PROTOCOL);
+            clientSession.setAuthMethod(SamlProtocol.LOGIN_PROTOCOL);
             clientSession.setRedirectUri(redirect);
             clientSession.setAction(ClientSessionModel.Action.AUTHENTICATE);
-            clientSession.setNote(SalmProtocol.SAML_BINDING, getBindingType());
+            clientSession.setNote(SamlProtocol.SAML_BINDING, getBindingType());
             clientSession.setNote(GeneralConstants.RELAY_STATE, relayState);
             clientSession.setNote("REQUEST_ID", requestAbstractType.getID());
 
@@ -278,7 +276,7 @@ public class SamlService {
 
         @Override
         protected String getBindingType() {
-            return SalmProtocol.SAML_POST_BINDING;
+            return SamlProtocol.SAML_POST_BINDING;
         }
 
 
@@ -307,7 +305,9 @@ public class SamlService {
             if (algorithm == null) throw new VerificationException("SigAlg as null");
             if (signature == null) throw new VerificationException("Signature as null");
 
-            SamlProtocolUtils.verifyDocumentSignature(client, documentHolder.getSamlDocument());
+            // Shibboleth doesn't sign the document for redirect binding.
+            // todo maybe a flag?
+            // SamlProtocolUtils.verifyDocumentSignature(client, documentHolder.getSamlDocument());
 
             PublicKey publicKey = SamlProtocolUtils.getPublicKey(client);
 
@@ -323,7 +323,8 @@ public class SamlService {
             try {
                 byte[] decodedSignature = RedirectBindingUtil.urlBase64Decode(signature);
 
-                Signature validator = SignatureAlgorithm.RSA_SHA1.createSignature(); // todo plugin signature alg
+                SignatureAlgorithm signatureAlgorithm = SamlProtocol.getSignatureAlgorithm(client);
+                Signature validator = signatureAlgorithm.createSignature(); // todo plugin signature alg
                 validator.initVerify(publicKey);
                 validator.update(rawQuery.getBytes("UTF-8"));
                 if (!validator.verify(decodedSignature)) {
@@ -343,7 +344,7 @@ public class SamlService {
 
         @Override
         protected String getBindingType() {
-            return SalmProtocol.SAML_GET_BINDING;
+            return SamlProtocol.SAML_GET_BINDING;
         }