diff --git a/openid-connect-client/pom.xml b/openid-connect-client/pom.xml
index 25903b93c..6ce1e7c6d 100644
--- a/openid-connect-client/pom.xml
+++ b/openid-connect-client/pom.xml
@@ -22,7 +22,7 @@
openid-connect-parent
org.mitre
- 1.3.5.cnaf
+ 1.3.5.cnaf-SNAPSHOT
..
openid-connect-client
diff --git a/openid-connect-common/pom.xml b/openid-connect-common/pom.xml
index f90290212..184451c64 100644
--- a/openid-connect-common/pom.xml
+++ b/openid-connect-common/pom.xml
@@ -22,7 +22,7 @@
openid-connect-parent
org.mitre
- 1.3.5.cnaf
+ 1.3.5.cnaf-SNAPSHOT
..
openid-connect-common
diff --git a/openid-connect-common/src/main/java/org/mitre/oauth2/model/SavedUserAuthentication.java b/openid-connect-common/src/main/java/org/mitre/oauth2/model/SavedUserAuthentication.java
index 032d4ea94..e1698a55f 100644
--- a/openid-connect-common/src/main/java/org/mitre/oauth2/model/SavedUserAuthentication.java
+++ b/openid-connect-common/src/main/java/org/mitre/oauth2/model/SavedUserAuthentication.java
@@ -54,7 +54,7 @@ public class SavedUserAuthentication implements Authentication {
private String name;
- private Collection extends GrantedAuthority> authorities;
+ private Collection authorities;
private boolean authenticated;
@@ -117,7 +117,7 @@ public class SavedUserAuthentication implements Authentication {
joinColumns = @JoinColumn(name = "owner_id") )
@Convert(converter = SimpleGrantedAuthorityStringConverter.class)
@Column(name = "authority")
- public Collection extends GrantedAuthority> getAuthorities() {
+ public Collection getAuthorities() {
return authorities;
}
diff --git a/openid-connect-server-webapp/.gitignore b/openid-connect-server-webapp/.gitignore
new file mode 100644
index 000000000..016a3b8f8
--- /dev/null
+++ b/openid-connect-server-webapp/.gitignore
@@ -0,0 +1,12 @@
+local-values.conf
+target
+*~
+bin
+*.idea
+*.iml
+*.eml
+.project
+.settings
+.classpath
+/target
+.springBeans
diff --git a/openid-connect-server-webapp/pom.xml b/openid-connect-server-webapp/pom.xml
new file mode 100644
index 000000000..9a4c45bc3
--- /dev/null
+++ b/openid-connect-server-webapp/pom.xml
@@ -0,0 +1,152 @@
+
+
+
+ 4.0.0
+
+ org.mitre
+ openid-connect-parent
+ 1.3.3-SNAPSHOT
+
+ openid-connect-server-webapp
+ war
+ OpenID Connect Server Webapp
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ ${java-version}
+ ${java-version}
+
+
+
+ org.apache.maven.plugins
+ maven-war-plugin
+
+ openid-connect-server-webapp
+
+
+ src/main/webapp
+ true
+
+ **/*.tag
+ **/*.jsp
+
+
+
+ src/main/webapp
+ false
+
+ **/*.tag
+ **/*.jsp
+
+
+
+ less/**
+
+
+
+ org.apache.maven.plugins
+ maven-dependency-plugin
+
+
+ install
+ install
+
+ sources
+
+
+
+
+
+ org.eclipse.jetty
+ jetty-maven-plugin
+
+ ${project.build.directory}/openid-connect-server-webapp.war
+
+ /openid-connect-server-webapp
+
+
+
+
+ ro.isdc.wro4j
+ wro4j-maven-plugin
+
+ bootstrap,bootstrap-responsive
+ ${project.build.directory}/${project.build.finalName}
+ ${project.build.directory}/${project.build.finalName}/resources/bootstrap2/css/
+ ${project.build.directory}/${project.build.finalName}/js/
+ ro.isdc.wro.maven.plugin.manager.factory.ConfigurableWroManagerFactory
+
+
+
+
+
+
+
+ org.mitre
+ openid-connect-server
+
+
+ org.springframework
+ spring-orm
+
+
+ commons-logging
+ commons-logging
+
+
+
+
+ org.slf4j
+ jcl-over-slf4j
+
+
+ org.slf4j
+ slf4j-log4j12
+
+
+ log4j
+ log4j
+
+
+ org.hsqldb
+ hsqldb
+
+
+ org.eclipse.persistence
+ org.eclipse.persistence.jpa
+
+
+ org.springframework.security
+ spring-security-taglibs
+
+
+ javax.servlet
+ jstl
+
+
+
+ com.zaxxer
+ HikariCP
+
+
+ Deployable package of the OpenID Connect server
+
diff --git a/openid-connect-server-webapp/pom.xml.versionsBackup b/openid-connect-server-webapp/pom.xml.versionsBackup
new file mode 100644
index 000000000..3053bf020
--- /dev/null
+++ b/openid-connect-server-webapp/pom.xml.versionsBackup
@@ -0,0 +1,137 @@
+
+
+
+ 4.0.0
+
+ org.mitre
+ openid-connect-parent
+ 1.2.7-SNAPSHOT
+
+ openid-connect-server-webapp
+ war
+ OpenID Connect Server Webapp
+
+
+
+ org.apache.maven.plugins
+ maven-compiler-plugin
+
+ ${java-version}
+ ${java-version}
+
+
+
+ org.apache.maven.plugins
+ maven-war-plugin
+
+ openid-connect-server-webapp
+
+
+ src/main/webapp
+ true
+
+ **/*.tag
+ **/*.jsp
+
+
+
+ src/main/webapp
+ false
+
+ **/*.tag
+ **/*.jsp
+
+
+
+
+
+
+ org.apache.maven.plugins
+ maven-dependency-plugin
+
+
+ install
+ install
+
+ sources
+
+
+
+
+
+ org.eclipse.jetty
+ jetty-maven-plugin
+
+ ${project.build.directory}/openid-connect-server-webapp.war
+
+ /openid-connect-server-webapp
+
+
+
+
+
+
+
+ org.mitre
+ openid-connect-server
+
+
+ org.springframework
+ spring-orm
+
+
+ commons-logging
+ commons-logging
+
+
+
+
+ org.slf4j
+ jcl-over-slf4j
+
+
+ org.slf4j
+ slf4j-log4j12
+
+
+ log4j
+ log4j
+
+
+ org.hsqldb
+ hsqldb
+
+
+ org.eclipse.persistence
+ org.eclipse.persistence.jpa
+
+
+ org.springframework.security
+ spring-security-taglibs
+
+
+ javax.servlet
+ jstl
+
+
+
+ com.zaxxer
+ HikariCP
+
+
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/clients.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/clients.sql
new file mode 100644
index 000000000..1410f7bd1
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/clients.sql
@@ -0,0 +1,70 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT FALSE;
+
+START TRANSACTION;
+
+--
+-- Insert client information into the temporary tables. To add clients to the HSQL database, edit things here.
+--
+
+INSERT INTO client_details_TEMP (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection) VALUES
+ ('client', 'secret', 'Test Client', false, null, 3600, 600, true);
+
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES
+ ('client', 'openid'),
+ ('client', 'profile'),
+ ('client', 'email'),
+ ('client', 'address'),
+ ('client', 'phone'),
+ ('client', 'offline_access');
+
+INSERT INTO client_redirect_uri_TEMP (owner_id, redirect_uri) VALUES
+ ('client', 'http://localhost/'),
+ ('client', 'http://localhost:8080/');
+
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES
+ ('client', 'authorization_code'),
+ ('client', 'urn:ietf:params:oauth:grant_type:redelegate'),
+ ('client', 'urn:ietf:params:oauth:grant-type:device_code'),
+ ('client', 'implicit'),
+ ('client', 'refresh_token');
+
+--
+-- Merge the temporary clients safely into the database. This is a two-step process to keep clients from being created on every startup with a persistent store.
+--
+
+MERGE INTO client_details
+ USING (SELECT client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection FROM client_details_TEMP) AS vals(client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection)
+ ON vals.client_id = client_details.client_id
+ WHEN NOT MATCHED THEN
+ INSERT (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection) VALUES(client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection);
+
+MERGE INTO client_scope
+ USING (SELECT id, scope FROM client_scope_TEMP, client_details WHERE client_details.client_id = client_scope_TEMP.owner_id) AS vals(id, scope)
+ ON vals.id = client_scope.owner_id AND vals.scope = client_scope.scope
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, scope) values (vals.id, vals.scope);
+
+MERGE INTO client_redirect_uri
+ USING (SELECT id, redirect_uri FROM client_redirect_uri_TEMP, client_details WHERE client_details.client_id = client_redirect_uri_TEMP.owner_id) AS vals(id, redirect_uri)
+ ON vals.id = client_redirect_uri.owner_id AND vals.redirect_uri = client_redirect_uri.redirect_uri
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, redirect_uri) values (vals.id, vals.redirect_uri);
+
+MERGE INTO client_grant_type
+ USING (SELECT id, grant_type FROM client_grant_type_TEMP, client_details WHERE client_details.client_id = client_grant_type_TEMP.owner_id) AS vals(id, grant_type)
+ ON vals.id = client_grant_type.owner_id AND vals.grant_type = client_grant_type.grant_type
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, grant_type) values (vals.id, vals.grant_type);
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+SET AUTOCOMMIT TRUE;
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_index.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_index.sql
new file mode 100644
index 000000000..38636a96f
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_index.sql
@@ -0,0 +1,19 @@
+--
+-- Indexes for HSQLDB
+--
+
+CREATE INDEX IF NOT EXISTS at_tv_idx ON access_token(token_value);
+CREATE INDEX IF NOT EXISTS ts_oi_idx ON token_scope(owner_id);
+CREATE INDEX IF NOT EXISTS at_exp_idx ON access_token(expiration);
+CREATE INDEX IF NOT EXISTS rf_ahi_idx ON refresh_token(auth_holder_id);
+CREATE INDEX IF NOT EXISTS rf_tv_idx ON refresh_token(token_value);
+CREATE INDEX IF NOT EXISTS cd_ci_idx ON client_details(client_id);
+CREATE INDEX IF NOT EXISTS at_ahi_idx ON access_token(auth_holder_id);
+CREATE INDEX IF NOT EXISTS aha_oi_idx ON authentication_holder_authority(owner_id);
+CREATE INDEX IF NOT EXISTS ahe_oi_idx ON authentication_holder_extension(owner_id);
+CREATE INDEX IF NOT EXISTS ahrp_oi_idx ON authentication_holder_request_parameter(owner_id);
+CREATE INDEX IF NOT EXISTS ahri_oi_idx ON authentication_holder_resource_id(owner_id);
+CREATE INDEX IF NOT EXISTS ahrt_oi_idx ON authentication_holder_response_type(owner_id);
+CREATE INDEX IF NOT EXISTS ahs_oi_idx ON authentication_holder_scope(owner_id);
+CREATE INDEX IF NOT EXISTS ac_ahi_idx ON authorization_code(auth_holder_id);
+CREATE INDEX IF NOT EXISTS suaa_oi_idx ON saved_user_auth_authority(owner_id);
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_tables.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_tables.sql
new file mode 100644
index 000000000..2a0175629
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/hsql_database_tables.sql
@@ -0,0 +1,384 @@
+--
+-- Tables for OIDC Server functionality, HSQL
+--
+
+CREATE TABLE IF NOT EXISTS access_token (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP,
+ token_type VARCHAR(256),
+ refresh_token_id BIGINT,
+ client_id BIGINT,
+ auth_holder_id BIGINT,
+ approved_site_id BIGINT,
+ UNIQUE(token_value)
+);
+
+CREATE TABLE IF NOT EXISTS access_token_permissions (
+ access_token_id BIGINT NOT NULL,
+ permission_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS address (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ formatted VARCHAR(256),
+ street_address VARCHAR(256),
+ locality VARCHAR(256),
+ region VARCHAR(256),
+ postal_code VARCHAR(256),
+ country VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS approved_site (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ user_id VARCHAR(256),
+ client_id VARCHAR(256),
+ creation_date TIMESTAMP,
+ access_date TIMESTAMP,
+ timeout_date TIMESTAMP,
+ whitelisted_site_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS approved_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ user_auth_id BIGINT,
+ approved BOOLEAN,
+ redirect_uri VARCHAR(2048),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_resource_id (
+ owner_id BIGINT,
+ resource_id VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_extension (
+ owner_id BIGINT,
+ extension VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ name VARCHAR(1024),
+ authenticated BOOLEAN,
+ source_class VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authorization_code (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ code VARCHAR(256),
+ auth_holder_id BIGINT,
+ expiration TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS client_grant_type (
+ owner_id BIGINT,
+ grant_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS blacklisted_site (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_details (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+
+ client_description VARCHAR(1024),
+ reuse_refresh_tokens BOOLEAN DEFAULT true NOT NULL,
+ dynamically_registered BOOLEAN DEFAULT false NOT NULL,
+ allow_introspection BOOLEAN DEFAULT false NOT NULL,
+ id_token_validity_seconds BIGINT DEFAULT 600 NOT NULL,
+ device_code_validity_seconds BIGINT,
+
+ client_id VARCHAR(256),
+ client_secret VARCHAR(2048),
+ access_token_validity_seconds BIGINT,
+ refresh_token_validity_seconds BIGINT,
+
+ application_type VARCHAR(256),
+ client_name VARCHAR(256),
+ token_endpoint_auth_method VARCHAR(256),
+ subject_type VARCHAR(256),
+
+ logo_uri VARCHAR(2048),
+ policy_uri VARCHAR(2048),
+ client_uri VARCHAR(2048),
+ tos_uri VARCHAR(2048),
+
+ jwks_uri VARCHAR(2048),
+ jwks VARCHAR(8192),
+ sector_identifier_uri VARCHAR(2048),
+
+ request_object_signing_alg VARCHAR(256),
+
+ user_info_signed_response_alg VARCHAR(256),
+ user_info_encrypted_response_alg VARCHAR(256),
+ user_info_encrypted_response_enc VARCHAR(256),
+
+ id_token_signed_response_alg VARCHAR(256),
+ id_token_encrypted_response_alg VARCHAR(256),
+ id_token_encrypted_response_enc VARCHAR(256),
+
+ token_endpoint_auth_signing_alg VARCHAR(256),
+
+ default_max_age BIGINT,
+ require_auth_time BOOLEAN,
+ created_at TIMESTAMP,
+ initiate_login_uri VARCHAR(2048),
+ clear_access_tokens_on_refresh BOOLEAN DEFAULT true NOT NULL,
+
+ software_statement VARCHAR(4096),
+ software_id VARCHAR(2048),
+ software_version VARCHAR(2048),
+
+ code_challenge_method VARCHAR(256),
+
+ UNIQUE (client_id)
+);
+
+CREATE TABLE IF NOT EXISTS client_request_uri (
+ owner_id BIGINT,
+ request_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_post_logout_redirect_uri (
+ owner_id BIGINT,
+ post_logout_redirect_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_default_acr_value (
+ owner_id BIGINT,
+ default_acr_value VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_contact (
+ owner_id BIGINT,
+ contact VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_claims_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS refresh_token (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP,
+ auth_holder_id BIGINT,
+ client_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS client_resource (
+ owner_id BIGINT,
+ resource_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS token_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS system_scope (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ scope VARCHAR(256) NOT NULL,
+ description VARCHAR(4096),
+ icon VARCHAR(256),
+ restricted BOOLEAN DEFAULT false NOT NULL,
+ default_scope BOOLEAN DEFAULT false NOT NULL,
+ UNIQUE (scope)
+);
+
+CREATE TABLE IF NOT EXISTS user_info (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ sub VARCHAR(256),
+ preferred_username VARCHAR(256),
+ name VARCHAR(256),
+ given_name VARCHAR(256),
+ family_name VARCHAR(256),
+ middle_name VARCHAR(256),
+ nickname VARCHAR(256),
+ profile VARCHAR(256),
+ picture VARCHAR(256),
+ website VARCHAR(256),
+ email VARCHAR(256),
+ email_verified BOOLEAN,
+ gender VARCHAR(256),
+ zone_info VARCHAR(256),
+ locale VARCHAR(256),
+ phone_number VARCHAR(256),
+ phone_number_verified BOOLEAN,
+ address_id VARCHAR(256),
+ updated_time VARCHAR(256),
+ birthdate VARCHAR(256),
+ src VARCHAR(4096)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ creator_user_id VARCHAR(256),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS pairwise_identifier (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ identifier VARCHAR(256),
+ sub VARCHAR(256),
+ sector_identifier VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ name VARCHAR(1024) NOT NULL,
+ uri VARCHAR(1024),
+ icon_uri VARCHAR(1024),
+ rs_type VARCHAR(256),
+ owner VARCHAR(256) NOT NULL,
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS permission_ticket (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ ticket VARCHAR(256) NOT NULL,
+ permission_id BIGINT NOT NULL,
+ expiration TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS permission (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS permission_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ name VARCHAR(256),
+ friendly_name VARCHAR(1024),
+ claim_type VARCHAR(1024),
+ claim_value VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_policy (
+ policy_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_permission_ticket (
+ permission_ticket_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS policy (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ name VARCHAR(1024),
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS policy_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_token_format (
+ owner_id BIGINT NOT NULL,
+ claim_token_format VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_issuer (
+ owner_id BIGINT NOT NULL,
+ issuer VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS saved_registered_client (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ issuer VARCHAR(1024),
+ registered_client VARCHAR(8192)
+);
+
+CREATE TABLE IF NOT EXISTS device_code (
+ id BIGINT GENERATED BY DEFAULT AS IDENTITY(START WITH 1) PRIMARY KEY,
+ device_code VARCHAR(1024),
+ user_code VARCHAR(1024),
+ expiration TIMESTAMP,
+ client_id VARCHAR(256),
+ approved BOOLEAN,
+ auth_holder_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS device_code_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS device_code_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/loading_temp_tables.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/loading_temp_tables.sql
new file mode 100644
index 000000000..37b0092e7
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/loading_temp_tables.sql
@@ -0,0 +1,73 @@
+--
+-- Temporary tables used during the bootstrapping process to safely load users and clients.
+-- These are not needed if you're not using the users.sql/clients.sql files to bootstrap the database.
+--
+
+CREATE TEMPORARY TABLE IF NOT EXISTS authorities_TEMP (
+ username varchar(50) not null,
+ authority varchar(50) not null,
+ constraint ix_authority_TEMP unique (username,authority));
+
+CREATE TEMPORARY TABLE IF NOT EXISTS users_TEMP (
+ username varchar(50) not null primary key,
+ password varchar(50) not null,
+ enabled boolean not null);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS user_info_TEMP (
+ sub VARCHAR(256) not null primary key,
+ preferred_username VARCHAR(256),
+ name VARCHAR(256),
+ given_name VARCHAR(256),
+ family_name VARCHAR(256),
+ middle_name VARCHAR(256),
+ nickname VARCHAR(256),
+ profile VARCHAR(256),
+ picture VARCHAR(256),
+ website VARCHAR(256),
+ email VARCHAR(256),
+ email_verified BOOLEAN,
+ gender VARCHAR(256),
+ zone_info VARCHAR(256),
+ locale VARCHAR(256),
+ phone_number VARCHAR(256),
+ address_id VARCHAR(256),
+ updated_time VARCHAR(256),
+ birthdate VARCHAR(256)
+);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS client_details_TEMP (
+ client_description VARCHAR(256),
+ dynamically_registered BOOLEAN,
+ id_token_validity_seconds BIGINT,
+
+ client_id VARCHAR(256),
+ client_secret VARCHAR(2048),
+ access_token_validity_seconds BIGINT,
+ refresh_token_validity_seconds BIGINT,
+ allow_introspection BOOLEAN,
+
+ client_name VARCHAR(256)
+);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS client_scope_TEMP (
+ owner_id VARCHAR(256),
+ scope VARCHAR(2048)
+);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS client_redirect_uri_TEMP (
+ owner_id VARCHAR(256),
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS client_grant_type_TEMP (
+ owner_id VARCHAR(256),
+ grant_type VARCHAR(2000)
+);
+
+CREATE TEMPORARY TABLE IF NOT EXISTS system_scope_TEMP (
+ scope VARCHAR(256),
+ description VARCHAR(4096),
+ icon VARCHAR(256),
+ restricted BOOLEAN,
+ default_scope BOOLEAN
+);
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/scopes.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/scopes.sql
new file mode 100644
index 000000000..8e72c88c7
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/scopes.sql
@@ -0,0 +1,33 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT FALSE;
+
+START TRANSACTION;
+
+--
+-- Insert scope information into the temporary tables.
+--
+
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('openid', 'log in using your identity', 'user', false, true),
+ ('profile', 'basic profile information', 'list-alt', false, true),
+ ('email', 'email address', 'envelope', false, true),
+ ('address', 'physical address', 'home', false, true),
+ ('phone', 'telephone number', 'bell', false, true),
+ ('offline_access', 'offline access', 'time', false, false);
+
+--
+-- Merge the temporary scopes safely into the database. This is a two-step process to keep scopes from being created on every startup with a persistent store.
+--
+
+MERGE INTO system_scope
+ USING (SELECT scope, description, icon, restricted, default_scope FROM system_scope_TEMP) AS vals(scope, description, icon, restricted, default_scope)
+ ON vals.scope = system_scope.scope
+ WHEN NOT MATCHED THEN
+ INSERT (scope, description, icon, restricted, default_scope) VALUES(vals.scope, vals.description, vals.icon, vals.restricted, vals.default_scope);
+
+COMMIT;
+
+SET AUTOCOMMIT TRUE;
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/security-schema.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/security-schema.sql
new file mode 100644
index 000000000..bc5d70b88
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/security-schema.sql
@@ -0,0 +1,14 @@
+--
+-- Tables for Spring Security's user details service
+--
+
+create table IF NOT EXISTS users(
+ username varchar(50) not null primary key,
+ password varchar(50) not null,
+ enabled boolean not null);
+
+ create table IF NOT EXISTS authorities (
+ username varchar(50) not null,
+ authority varchar(50) not null,
+ constraint fk_authorities_users foreign key(username) references users(username),
+ constraint ix_authority unique (username,authority));
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/hsql/users.sql b/openid-connect-server-webapp/src/main/resources/db/hsql/users.sql
new file mode 100644
index 000000000..6e6958e1f
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/hsql/users.sql
@@ -0,0 +1,59 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT FALSE;
+
+START TRANSACTION;
+
+--
+-- Insert user information into the temporary tables. To add users to the HSQL database, edit things here.
+--
+
+INSERT INTO users_TEMP (username, password, enabled) VALUES
+ ('admin','password',true),
+ ('user','password',true);
+
+
+INSERT INTO authorities_TEMP (username, authority) VALUES
+ ('admin','ROLE_ADMIN'),
+ ('admin','ROLE_USER'),
+ ('user','ROLE_USER');
+
+-- By default, the username column here has to match the username column in the users table, above
+INSERT INTO user_info_TEMP (sub, preferred_username, name, email, email_verified) VALUES
+ ('90342.ASDFJWFA','admin','Demo Admin','admin@example.com', true),
+ ('01921.FLANRJQW','user','Demo User','user@example.com', true);
+
+
+--
+-- Merge the temporary users safely into the database. This is a two-step process to keep users from being created on every startup with a persistent store.
+--
+
+MERGE INTO users
+ USING (SELECT username, password, enabled FROM users_TEMP) AS vals(username, password, enabled)
+ ON vals.username = users.username
+ WHEN NOT MATCHED THEN
+ INSERT (username, password, enabled) VALUES(vals.username, vals.password, vals.enabled);
+
+MERGE INTO authorities
+ USING (SELECT username, authority FROM authorities_TEMP) AS vals(username, authority)
+ ON vals.username = authorities.username AND vals.authority = authorities.authority
+ WHEN NOT MATCHED THEN
+ INSERT (username,authority) values (vals.username, vals.authority);
+
+MERGE INTO user_info
+ USING (SELECT sub, preferred_username, name, email, email_verified FROM user_info_TEMP) AS vals(sub, preferred_username, name, email, email_verified)
+ ON vals.preferred_username = user_info.preferred_username
+ WHEN NOT MATCHED THEN
+ INSERT (sub, preferred_username, name, email, email_verified) VALUES (vals.sub, vals.preferred_username, vals.name, vals.email, vals.email_verified);
+
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+SET AUTOCOMMIT TRUE;
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/clients.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/clients.sql
new file mode 100644
index 000000000..7f0255789
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/clients.sql
@@ -0,0 +1,61 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT = 0;
+
+START TRANSACTION;
+
+--
+-- Insert client information into the temporary tables. To add clients to the HSQL database, edit things here.
+--
+
+INSERT INTO client_details_TEMP (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection) VALUES
+ ('client', 'secret', 'Test Client', false, null, 3600, 600, true);
+
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES
+ ('client', 'openid'),
+ ('client', 'profile'),
+ ('client', 'email'),
+ ('client', 'address'),
+ ('client', 'phone'),
+ ('client', 'offline_access');
+
+INSERT INTO client_redirect_uri_TEMP (owner_id, redirect_uri) VALUES
+ ('client', 'http://localhost/'),
+ ('client', 'http://localhost:8080/');
+
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES
+ ('client', 'authorization_code'),
+ ('client', 'urn:ietf:params:oauth:grant_type:redelegate'),
+ ('client', 'implicit'),
+ ('client', 'refresh_token');
+
+--
+-- Merge the temporary clients safely into the database. This is a two-step process to keep clients from being created on every startup with a persistent store.
+--
+
+INSERT INTO client_details (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection)
+ SELECT client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection FROM client_details_TEMP
+ ON DUPLICATE KEY UPDATE client_details.client_id = client_details.client_id;
+
+INSERT INTO client_scope (owner_id, scope)
+ SELECT id, scope FROM client_scope_TEMP, client_details WHERE client_details.client_id = client_scope_TEMP.owner_id
+ ON DUPLICATE KEY UPDATE client_scope.owner_id = client_scope.owner_id;
+
+INSERT INTO client_redirect_uri (owner_id, redirect_uri)
+ SELECT id, redirect_uri FROM client_redirect_uri_TEMP, client_details WHERE client_details.client_id = client_redirect_uri_TEMP.owner_id
+ ON DUPLICATE KEY UPDATE client_redirect_uri.owner_id = client_redirect_uri.owner_id;
+
+INSERT INTO client_grant_type (owner_id, grant_type)
+ SELECT id, grant_type FROM client_grant_type_TEMP, client_details WHERE client_details.client_id = client_grant_type_TEMP.owner_id
+ ON DUPLICATE KEY UPDATE client_grant_type.owner_id = client_grant_type.owner_id;
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+SET AUTOCOMMIT = 1;
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_index.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_index.sql
new file mode 100644
index 000000000..f5daf991d
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_index.sql
@@ -0,0 +1,19 @@
+--
+-- Indexes for MySQL
+--
+
+CREATE INDEX at_tv_idx ON access_token(token_value(767));
+CREATE INDEX ts_oi_idx ON token_scope(owner_id);
+CREATE INDEX at_exp_idx ON access_token(expiration);
+CREATE INDEX rf_ahi_idx ON refresh_token(auth_holder_id);
+CREATE INDEX rf_tv_idx ON refresh_token(token_value(105));
+CREATE INDEX cd_ci_idx ON client_details(client_id);
+CREATE INDEX at_ahi_idx ON access_token(auth_holder_id);
+CREATE INDEX aha_oi_idx ON authentication_holder_authority(owner_id);
+CREATE INDEX ahe_oi_idx ON authentication_holder_extension(owner_id);
+CREATE INDEX ahrp_oi_idx ON authentication_holder_request_parameter(owner_id);
+CREATE INDEX ahri_oi_idx ON authentication_holder_resource_id(owner_id);
+CREATE INDEX ahrt_oi_idx ON authentication_holder_response_type(owner_id);
+CREATE INDEX ahs_oi_idx ON authentication_holder_scope(owner_id);
+CREATE INDEX ac_ahi_idx ON authorization_code(auth_holder_id);
+CREATE INDEX suaa_oi_idx ON saved_user_auth_authority(owner_id);
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_tables.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_tables.sql
new file mode 100644
index 000000000..7e00cc876
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/mysql_database_tables.sql
@@ -0,0 +1,383 @@
+--
+-- Tables for OIDC Server functionality, MySQL
+--
+
+CREATE TABLE IF NOT EXISTS access_token (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP NULL,
+ token_type VARCHAR(256),
+ refresh_token_id BIGINT,
+ client_id BIGINT,
+ auth_holder_id BIGINT,
+ approved_site_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS access_token_permissions (
+ access_token_id BIGINT NOT NULL,
+ permission_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS address (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ formatted VARCHAR(256),
+ street_address VARCHAR(256),
+ locality VARCHAR(256),
+ region VARCHAR(256),
+ postal_code VARCHAR(256),
+ country VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS approved_site (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ user_id VARCHAR(256),
+ client_id VARCHAR(256),
+ creation_date TIMESTAMP NULL,
+ access_date TIMESTAMP NULL,
+ timeout_date TIMESTAMP NULL,
+ whitelisted_site_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS approved_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ user_auth_id BIGINT,
+ approved BOOLEAN,
+ redirect_uri VARCHAR(2048),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_resource_id (
+ owner_id BIGINT,
+ resource_id VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_extension (
+ owner_id BIGINT,
+ extension VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ name VARCHAR(1024),
+ authenticated BOOLEAN,
+ source_class VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authorization_code (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ code VARCHAR(256),
+ auth_holder_id BIGINT,
+ expiration TIMESTAMP NULL
+);
+
+CREATE TABLE IF NOT EXISTS client_grant_type (
+ owner_id BIGINT,
+ grant_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS blacklisted_site (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_details (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+
+ client_description VARCHAR(1024),
+ reuse_refresh_tokens BOOLEAN DEFAULT true NOT NULL,
+ dynamically_registered BOOLEAN DEFAULT false NOT NULL,
+ allow_introspection BOOLEAN DEFAULT false NOT NULL,
+ id_token_validity_seconds BIGINT DEFAULT 600 NOT NULL,
+ device_code_validity_seconds BIGINT,
+
+ client_id VARCHAR(256),
+ client_secret VARCHAR(2048),
+ access_token_validity_seconds BIGINT,
+ refresh_token_validity_seconds BIGINT,
+
+ application_type VARCHAR(256),
+ client_name VARCHAR(256),
+ token_endpoint_auth_method VARCHAR(256),
+ subject_type VARCHAR(256),
+
+ logo_uri VARCHAR(2048),
+ policy_uri VARCHAR(2048),
+ client_uri VARCHAR(2048),
+ tos_uri VARCHAR(2048),
+
+ jwks_uri VARCHAR(2048),
+ jwks VARCHAR(8192),
+ sector_identifier_uri VARCHAR(2048),
+
+ request_object_signing_alg VARCHAR(256),
+
+ user_info_signed_response_alg VARCHAR(256),
+ user_info_encrypted_response_alg VARCHAR(256),
+ user_info_encrypted_response_enc VARCHAR(256),
+
+ id_token_signed_response_alg VARCHAR(256),
+ id_token_encrypted_response_alg VARCHAR(256),
+ id_token_encrypted_response_enc VARCHAR(256),
+
+ token_endpoint_auth_signing_alg VARCHAR(256),
+
+ default_max_age BIGINT,
+ require_auth_time BOOLEAN,
+ created_at TIMESTAMP NULL,
+ initiate_login_uri VARCHAR(2048),
+ clear_access_tokens_on_refresh BOOLEAN DEFAULT true NOT NULL,
+
+ software_statement VARCHAR(4096),
+ software_id VARCHAR(2048),
+ software_version VARCHAR(2048),
+
+ code_challenge_method VARCHAR(256),
+
+ UNIQUE (client_id)
+);
+
+CREATE TABLE IF NOT EXISTS client_request_uri (
+ owner_id BIGINT,
+ request_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_post_logout_redirect_uri (
+ owner_id BIGINT,
+ post_logout_redirect_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_default_acr_value (
+ owner_id BIGINT,
+ default_acr_value VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_contact (
+ owner_id BIGINT,
+ contact VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_claims_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS refresh_token (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP NULL,
+ auth_holder_id BIGINT,
+ client_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS client_resource (
+ owner_id BIGINT,
+ resource_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS token_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS system_scope (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ scope VARCHAR(256) NOT NULL,
+ description VARCHAR(4096),
+ icon VARCHAR(256),
+ restricted BOOLEAN DEFAULT false NOT NULL,
+ default_scope BOOLEAN DEFAULT false NOT NULL,
+ UNIQUE (scope)
+);
+
+CREATE TABLE IF NOT EXISTS user_info (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ sub VARCHAR(256),
+ preferred_username VARCHAR(256),
+ name VARCHAR(256),
+ given_name VARCHAR(256),
+ family_name VARCHAR(256),
+ middle_name VARCHAR(256),
+ nickname VARCHAR(256),
+ profile VARCHAR(256),
+ picture VARCHAR(256),
+ website VARCHAR(256),
+ email VARCHAR(256),
+ email_verified BOOLEAN,
+ gender VARCHAR(256),
+ zone_info VARCHAR(256),
+ locale VARCHAR(256),
+ phone_number VARCHAR(256),
+ phone_number_verified BOOLEAN,
+ address_id VARCHAR(256),
+ updated_time VARCHAR(256),
+ birthdate VARCHAR(256),
+ src VARCHAR(4096)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ creator_user_id VARCHAR(256),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS pairwise_identifier (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ identifier VARCHAR(256),
+ sub VARCHAR(256),
+ sector_identifier VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ name VARCHAR(1024) NOT NULL,
+ uri VARCHAR(1024),
+ icon_uri VARCHAR(1024),
+ rs_type VARCHAR(256),
+ owner VARCHAR(256) NOT NULL,
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS permission_ticket (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ ticket VARCHAR(256) NOT NULL,
+ permission_id BIGINT NOT NULL,
+ expiration TIMESTAMP NULL
+);
+
+CREATE TABLE IF NOT EXISTS permission (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS permission_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ name VARCHAR(256),
+ friendly_name VARCHAR(1024),
+ claim_type VARCHAR(1024),
+ claim_value VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_policy (
+ policy_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_permission_ticket (
+ permission_ticket_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS policy (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ name VARCHAR(1024),
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS policy_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_token_format (
+ owner_id BIGINT NOT NULL,
+ claim_token_format VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_issuer (
+ owner_id BIGINT NOT NULL,
+ issuer VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS saved_registered_client (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ issuer VARCHAR(1024),
+ registered_client VARCHAR(8192)
+);
+
+CREATE TABLE IF NOT EXISTS device_code (
+ id BIGINT AUTO_INCREMENT PRIMARY KEY,
+ device_code VARCHAR(1024),
+ user_code VARCHAR(1024),
+ expiration TIMESTAMP NULL,
+ client_id VARCHAR(256),
+ approved BOOLEAN,
+ auth_holder_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS device_code_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS device_code_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/scopes.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/scopes.sql
new file mode 100644
index 000000000..3768977ec
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/scopes.sql
@@ -0,0 +1,31 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT = 0;
+
+START TRANSACTION;
+
+--
+-- Insert scope information into the temporary tables.
+--
+
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('openid', 'log in using your identity', 'user', false, true),
+ ('profile', 'basic profile information', 'list-alt', false, true),
+ ('email', 'email address', 'envelope', false, true),
+ ('address', 'physical address', 'home', false, true),
+ ('phone', 'telephone number', 'bell', false, true),
+ ('offline_access', 'offline access', 'time', false, false);
+
+--
+-- Merge the temporary scopes safely into the database. This is a two-step process to keep scopes from being created on every startup with a persistent store.
+--
+
+INSERT INTO system_scope (scope, description, icon, restricted, default_scope, structured, structured_param_description)
+ SELECT scope, description, icon, restricted, default_scope, structured, structured_param_description FROM system_scope_TEMP
+ ON DUPLICATE KEY UPDATE system_scope.scope = system_scope.scope;
+
+COMMIT;
+
+SET AUTOCOMMIT = 1;
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/security-schema.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/security-schema.sql
new file mode 100644
index 000000000..bc5d70b88
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/security-schema.sql
@@ -0,0 +1,14 @@
+--
+-- Tables for Spring Security's user details service
+--
+
+create table IF NOT EXISTS users(
+ username varchar(50) not null primary key,
+ password varchar(50) not null,
+ enabled boolean not null);
+
+ create table IF NOT EXISTS authorities (
+ username varchar(50) not null,
+ authority varchar(50) not null,
+ constraint fk_authorities_users foreign key(username) references users(username),
+ constraint ix_authority unique (username,authority));
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/mysql/users.sql b/openid-connect-server-webapp/src/main/resources/db/mysql/users.sql
new file mode 100644
index 000000000..fc82e4800
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/mysql/users.sql
@@ -0,0 +1,52 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+SET AUTOCOMMIT = 0;
+
+START TRANSACTION;
+
+--
+-- Insert user information into the temporary tables. To add users to the HSQL database, edit things here.
+--
+
+INSERT INTO users_TEMP (username, password, enabled) VALUES
+ ('admin','password',true),
+ ('user','password',true);
+
+
+INSERT INTO authorities_TEMP (username, authority) VALUES
+ ('admin','ROLE_ADMIN'),
+ ('admin','ROLE_USER'),
+ ('user','ROLE_USER');
+
+-- By default, the username column here has to match the username column in the users table, above
+INSERT INTO user_info_TEMP (sub, preferred_username, name, email, email_verified) VALUES
+ ('90342.ASDFJWFA','admin','Demo Admin','admin@example.com', true),
+ ('01921.FLANRJQW','user','Demo User','user@example.com', true);
+
+
+--
+-- Merge the temporary users safely into the database. This is a two-step process to keep users from being created on every startup with a persistent store.
+--
+
+INSERT INTO users (username, password, enabled)
+ SELECT username, password, enabled FROM users_TEMP
+ ON DUPLICATE KEY UPDATE users.username = users.username;
+
+INSERT INTO authorities (username,authority)
+ SELECT username, authority FROM authorities_TEMP
+ ON DUPLICATE KEY UPDATE authorities.username = authorities.username;
+
+INSERT INTO user_info (sub, preferred_username, name, email, email_verified)
+ SELECT sub, preferred_username, name, email, email_verified FROM user_info_TEMP
+ ON DUPLICATE KEY UPDATE user_info.preferred_username = user_info.preferred_username;
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+SET AUTOCOMMIT = 1;
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/clients_oracle.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/clients_oracle.sql
new file mode 100644
index 000000000..488d92845
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/clients_oracle.sql
@@ -0,0 +1,51 @@
+--
+-- Insert client information into the temporary tables. To add clients to the Oracle database, edit things here.
+--
+
+INSERT INTO client_details_TEMP (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection) VALUES
+ ('client', 'secret', 'Test Client', 0, null, 3600, 600, 1);
+
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'openid');
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'profile');
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'email');
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'address');
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'phone');
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES ('client', 'offline_access');
+
+INSERT INTO client_redirect_uri_TEMP (owner_id, redirect_uri) VALUES ('client', 'http://localhost/');
+INSERT INTO client_redirect_uri_TEMP (owner_id, redirect_uri) VALUES ('client', 'http://localhost:8080/');
+
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES ('client', 'authorization_code');
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES ('client', 'urn:ietf:params:oauth:grant_type:redelegate');
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES ('client', 'implicit');
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES ('client', 'refresh_token');
+
+--
+-- Merge the temporary clients safely into the database. This is a two-step process to keep clients from being created on every startup with a persistent store.
+--
+
+MERGE INTO client_details
+ USING (SELECT client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection FROM client_details_TEMP) vals
+ ON (vals.client_id = client_details.client_id)
+ WHEN NOT MATCHED THEN
+ INSERT (id, client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds,
+ id_token_validity_seconds, allow_introspection) VALUES(client_details_seq.nextval, vals.client_id, vals.client_secret, vals.client_name, vals.dynamically_registered,
+ vals.refresh_token_validity_seconds, vals.access_token_validity_seconds, vals.id_token_validity_seconds, vals.allow_introspection);
+
+MERGE INTO client_scope
+ USING (SELECT id, scope FROM client_scope_TEMP, client_details WHERE client_details.client_id = client_scope_TEMP.owner_id) vals
+ ON (vals.id = client_scope.owner_id AND vals.scope = client_scope.scope)
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, scope) values (vals.id, vals.scope);
+
+MERGE INTO client_redirect_uri
+ USING (SELECT id, redirect_uri FROM client_redirect_uri_TEMP, client_details WHERE client_details.client_id = client_redirect_uri_TEMP.owner_id) vals
+ ON (vals.id = client_redirect_uri.owner_id AND vals.redirect_uri = client_redirect_uri.redirect_uri)
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, redirect_uri) values (vals.id, vals.redirect_uri);
+
+MERGE INTO client_grant_type
+ USING (SELECT id, grant_type FROM client_grant_type_TEMP, client_details WHERE client_details.client_id = client_grant_type_TEMP.owner_id) vals
+ ON (vals.id = client_grant_type.owner_id AND vals.grant_type = client_grant_type.grant_type)
+ WHEN NOT MATCHED THEN
+ INSERT (owner_id, grant_type) values (vals.id, vals.grant_type);
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/entity-mappings_oracle.xml b/openid-connect-server-webapp/src/main/resources/db/oracle/entity-mappings_oracle.xml
new file mode 100644
index 000000000..2aba62824
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/entity-mappings_oracle.xml
@@ -0,0 +1,281 @@
+
+
+
+ OpenID Connect Server entities
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/loading_temp_tables_oracle.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/loading_temp_tables_oracle.sql
new file mode 100644
index 000000000..c9a1e7f3d
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/loading_temp_tables_oracle.sql
@@ -0,0 +1,77 @@
+--
+-- Temporary tables used during the bootstrapping process to safely load users and clients.
+-- These are not needed if you're not using the users.sql/clients.sql files to bootstrap the database.
+--
+
+CREATE GLOBAL TEMPORARY TABLE authorities_TEMP (
+ username varchar2(50) not null,
+ authority varchar2(50) not null,
+ constraint ix_authority_TEMP unique (username,authority)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE users_TEMP (
+ username VARCHAR2(50) not null primary key,
+ password VARCHAR2(50) not null,
+ enabled NUMBER(1) not null
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE user_info_TEMP (
+ sub VARCHAR2(256) not null primary key,
+ preferred_username VARCHAR2(256),
+ name VARCHAR2(256),
+ given_name VARCHAR2(256),
+ family_name VARCHAR2(256),
+ middle_name VARCHAR2(256),
+ nickname VARCHAR2(256),
+ profile VARCHAR2(256),
+ picture VARCHAR2(256),
+ website VARCHAR2(256),
+ email VARCHAR2(256),
+ email_verified NUMBER(1),
+ gender VARCHAR2(256),
+ zone_info VARCHAR2(256),
+ locale VARCHAR2(256),
+ phone_number VARCHAR2(256),
+ address_id VARCHAR2(256),
+ updated_time VARCHAR2(256),
+ birthdate VARCHAR2(256)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE client_details_TEMP (
+ client_description VARCHAR2(256),
+ dynamically_registered NUMBER(1),
+ id_token_validity_seconds NUMBER(19),
+
+ client_id VARCHAR2(256),
+ client_secret VARCHAR2(2048),
+ access_token_validity_seconds NUMBER(19),
+ refresh_token_validity_seconds NUMBER(19),
+ allow_introspection NUMBER(1),
+
+ client_name VARCHAR2(256)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE client_scope_TEMP (
+ owner_id VARCHAR2(256),
+ scope VARCHAR2(2048)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE client_redirect_uri_TEMP (
+ owner_id VARCHAR2(256),
+ redirect_uri VARCHAR2(2048)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE client_grant_type_TEMP (
+ owner_id VARCHAR2(256),
+ grant_type VARCHAR2(2000)
+) ON COMMIT PRESERVE ROWS;
+
+CREATE GLOBAL TEMPORARY TABLE system_scope_TEMP (
+ scope VARCHAR2(256),
+ description VARCHAR2(4000),
+ icon VARCHAR2(256),
+ restricted NUMBER(1),
+ default_scope NUMBER(1),
+ structured NUMBER(1),
+ structured_param_description VARCHAR2(256)
+) ON COMMIT PRESERVE ROWS;
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_index.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_index.sql
new file mode 100644
index 000000000..fc70a7ae4
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_index.sql
@@ -0,0 +1,18 @@
+--
+-- Indexes for Oracle
+--
+
+CREATE INDEX at_tv_idx ON access_token(token_value);
+CREATE INDEX ts_oi_idx ON token_scope(owner_id);
+CREATE INDEX at_exp_idx ON access_token(expiration);
+CREATE INDEX rf_ahi_idx ON refresh_token(auth_holder_id);
+CREATE INDEX rf_tv_idx ON refresh_token(token_value);
+CREATE INDEX at_ahi_idx ON access_token(auth_holder_id);
+CREATE INDEX aha_oi_idx ON authentication_holder_authority(owner_id);
+CREATE INDEX ahe_oi_idx ON authentication_holder_extension(owner_id);
+CREATE INDEX ahrp_oi_idx ON authentication_holder_request_parameter(owner_id);
+CREATE INDEX ahri_oi_idx ON authentication_holder_resource_id(owner_id);
+CREATE INDEX ahrt_oi_idx ON authentication_holder_response_type(owner_id);
+CREATE INDEX ahs_oi_idx ON authentication_holder_scope(owner_id);
+CREATE INDEX ac_ahi_idx ON authorization_code(auth_holder_id);
+CREATE INDEX suaa_oi_idx ON saved_user_auth_authority(owner_id);
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_tables.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_tables.sql
new file mode 100644
index 000000000..9f430adac
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/oracle_database_tables.sql
@@ -0,0 +1,417 @@
+--
+-- Tables for OIDC Server functionality, Oracle
+--
+
+CREATE TABLE access_token (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ token_value VARCHAR2(4000),
+ expiration TIMESTAMP,
+ token_type VARCHAR2(256),
+ refresh_token_id NUMBER(19),
+ client_id NUMBER(19),
+ auth_holder_id NUMBER(19),
+ approved_site_id NUMBER(19)
+);
+CREATE SEQUENCE access_token_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE access_token_permissions (
+ access_token_id NUMBER(19) NOT NULL,
+ permission_id NUMBER(19) NOT NULL
+);
+
+CREATE TABLE address (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ formatted VARCHAR2(256),
+ street_address VARCHAR2(256),
+ locality VARCHAR2(256),
+ region VARCHAR2(256),
+ postal_code VARCHAR2(256),
+ country VARCHAR2(256)
+);
+CREATE SEQUENCE address_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE approved_site (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ user_id VARCHAR2(256),
+ client_id VARCHAR2(256),
+ creation_date TIMESTAMP,
+ access_date TIMESTAMP,
+ timeout_date TIMESTAMP,
+ whitelisted_site_id NUMBER(19)
+);
+CREATE SEQUENCE approved_site_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE approved_site_scope (
+ owner_id NUMBER(19),
+ scope VARCHAR2(256)
+);
+
+CREATE TABLE authentication_holder (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ user_auth_id NUMBER(19),
+ approved NUMBER(1),
+ redirect_uri VARCHAR2(2048),
+ client_id VARCHAR2(256),
+
+ CONSTRAINT approved_check CHECK (approved in (1,0))
+);
+CREATE SEQUENCE authentication_holder_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE auth_holder_authority (
+ owner_id NUMBER(19),
+ authority VARCHAR2(256)
+);
+
+CREATE TABLE auth_holder_resource_id (
+ owner_id NUMBER(19),
+ resource_id VARCHAR2(2048)
+);
+
+CREATE TABLE auth_holder_response_type (
+ owner_id NUMBER(19),
+ response_type VARCHAR2(2048)
+);
+
+CREATE TABLE auth_holder_extension (
+ owner_id NUMBER(19),
+ extension VARCHAR2(2048),
+ val VARCHAR2(2048)
+);
+
+CREATE TABLE authentication_holder_scope (
+ owner_id NUMBER(19),
+ scope VARCHAR2(2048)
+);
+
+CREATE TABLE auth_holder_request_parameter (
+ owner_id NUMBER(19),
+ param VARCHAR2(2048),
+ val VARCHAR2(2048)
+);
+
+CREATE TABLE saved_user_auth (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ name VARCHAR2(1024),
+ authenticated NUMBER(1),
+ source_class VARCHAR2(2048),
+
+ CONSTRAINT authenticated_check CHECK (authenticated in (1,0))
+);
+CREATE SEQUENCE saved_user_auth_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE saved_user_auth_authority (
+ owner_id NUMBER(19),
+ authority VARCHAR2(256)
+);
+
+CREATE TABLE client_authority (
+ owner_id NUMBER(19),
+ authority VARCHAR2(256)
+);
+
+CREATE TABLE authorization_code (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ code VARCHAR2(256),
+ auth_holder_id NUMBER(19),
+ expiration TIMESTAMP
+);
+CREATE SEQUENCE authorization_code_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE client_grant_type (
+ owner_id NUMBER(19),
+ grant_type VARCHAR2(2000)
+);
+
+CREATE TABLE client_response_type (
+ owner_id NUMBER(19),
+ response_type VARCHAR2(2000)
+);
+
+CREATE TABLE blacklisted_site (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ uri VARCHAR2(2048)
+);
+CREATE SEQUENCE blacklisted_site_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE client_details (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+
+ client_description VARCHAR2(1024),
+ reuse_refresh_tokens NUMBER(1) DEFAULT 1 NOT NULL,
+ dynamically_registered NUMBER(1) DEFAULT 0 NOT NULL,
+ allow_introspection NUMBER(1) DEFAULT 0 NOT NULL,
+ id_token_validity_seconds NUMBER(19) DEFAULT 600 NOT NULL,
+
+ client_id VARCHAR2(256),
+ client_secret VARCHAR2(2048),
+ access_token_validity_seconds NUMBER(19),
+ refresh_token_validity_seconds NUMBER(19),
+ device_code_validity_seconds NUMBER(19),
+
+ application_type VARCHAR2(256),
+ client_name VARCHAR2(256),
+ token_endpoint_auth_method VARCHAR2(256),
+ subject_type VARCHAR2(256),
+
+ logo_uri VARCHAR2(2048),
+ policy_uri VARCHAR2(2048),
+ client_uri VARCHAR2(2048),
+ tos_uri VARCHAR2(2048),
+
+ jwks_uri VARCHAR2(2048),
+ jwks CLOB,
+ sector_identifier_uri VARCHAR2(2048),
+
+ request_object_signing_alg VARCHAR2(256),
+
+ user_info_signed_response_alg VARCHAR2(256),
+ user_info_encrypted_resp_alg VARCHAR2(256),
+ user_info_encrypted_resp_enc VARCHAR2(256),
+
+ id_token_signed_response_alg VARCHAR2(256),
+ id_token_encrypted_resp_alg VARCHAR2(256),
+ id_token_encrypted_resp_enc VARCHAR2(256),
+
+ token_endpoint_auth_sign_alg VARCHAR2(256),
+
+ default_max_age NUMBER(19),
+ require_auth_time NUMBER(1),
+ created_at TIMESTAMP,
+ initiate_login_uri VARCHAR2(2048),
+ clear_access_tokens_on_refresh NUMBER(1) DEFAULT 1 NOT NULL,
+
+ software_statement VARCHAR(4096),
+ software_id VARCHAR(2048),
+ software_statement VARCHAR2(4000),
+
+ code_challenge_method VARCHAR2(256),
+
+ CONSTRAINT client_details_unique UNIQUE (client_id),
+ CONSTRAINT reuse_refresh_tokens_check CHECK (reuse_refresh_tokens in (1,0)),
+ CONSTRAINT dynamically_registered_check CHECK (dynamically_registered in (1,0)),
+ CONSTRAINT allow_introspection_check CHECK (allow_introspection in (1,0)),
+ CONSTRAINT require_auth_time_check CHECK (require_auth_time in (1,0)),
+ CONSTRAINT clear_acc_tok_on_refresh_check CHECK (clear_access_tokens_on_refresh in (1,0))
+);
+CREATE SEQUENCE client_details_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE client_request_uri (
+ owner_id NUMBER(19),
+ request_uri VARCHAR2(2000)
+);
+
+CREATE TABLE client_post_logout_redir_uri (
+ owner_id NUMBER(19),
+ post_logout_redirect_uri VARCHAR2(2000)
+);
+
+CREATE TABLE client_default_acr_value (
+ owner_id NUMBER(19),
+ default_acr_value VARCHAR2(2000)
+);
+
+CREATE TABLE client_contact (
+ owner_id NUMBER(19),
+ contact VARCHAR2(256)
+);
+
+CREATE TABLE client_redirect_uri (
+ owner_id NUMBER(19),
+ redirect_uri VARCHAR2(2048)
+);
+
+CREATE TABLE client_claims_redirect_uri (
+ owner_id NUMBER(19),
+ redirect_uri VARCHAR2(2048)
+);
+
+CREATE TABLE refresh_token (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ token_value VARCHAR2(4000),
+ expiration TIMESTAMP,
+ auth_holder_id NUMBER(19),
+ client_id NUMBER(19)
+);
+CREATE SEQUENCE refresh_token_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE client_resource (
+ owner_id NUMBER(19),
+ resource_id VARCHAR2(256)
+);
+
+CREATE TABLE client_scope (
+ owner_id NUMBER(19),
+ scope VARCHAR2(2048)
+);
+
+CREATE TABLE token_scope (
+ owner_id NUMBER(19),
+ scope VARCHAR2(2048)
+);
+
+CREATE TABLE system_scope (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ scope VARCHAR2(256) NOT NULL,
+ description VARCHAR2(4000),
+ icon VARCHAR2(256),
+ restricted NUMBER(1) DEFAULT 0 NOT NULL,
+ default_scope NUMBER(1) DEFAULT 0 NOT NULL
+
+ CONSTRAINT system_scope_unique UNIQUE (scope),
+ CONSTRAINT default_scope_check CHECK (default_scope in (1,0)),
+ CONSTRAINT restricted_check CHECK (restricted in (1,0))
+);
+CREATE SEQUENCE system_scope_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE user_info (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ sub VARCHAR2(256),
+ preferred_username VARCHAR2(256),
+ name VARCHAR2(256),
+ given_name VARCHAR2(256),
+ family_name VARCHAR2(256),
+ middle_name VARCHAR2(256),
+ nickname VARCHAR2(256),
+ profile VARCHAR2(256),
+ picture VARCHAR2(256),
+ website VARCHAR2(256),
+ email VARCHAR2(256),
+ email_verified NUMBER(1),
+ gender VARCHAR2(256),
+ zone_info VARCHAR2(256),
+ locale VARCHAR2(256),
+ phone_number VARCHAR2(256),
+ phone_number_verified NUMBER(1),
+ address_id VARCHAR2(256),
+ updated_time VARCHAR2(256),
+ birthdate VARCHAR2(256),
+ src VARCHAR2(4000),
+
+ CONSTRAINT email_verified_check CHECK (email_verified in (1,0)),
+ CONSTRAINT phone_number_verified_check CHECK (phone_number_verified in (1,0))
+);
+CREATE SEQUENCE user_info_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE whitelisted_site (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ creator_user_id VARCHAR2(256),
+ client_id VARCHAR2(256)
+);
+CREATE SEQUENCE whitelisted_site_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE whitelisted_site_scope (
+ owner_id NUMBER(19),
+ scope VARCHAR2(256)
+);
+
+CREATE TABLE pairwise_identifier (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ identifier VARCHAR2(256),
+ sub VARCHAR2(256),
+ sector_identifier VARCHAR2(2048)
+);
+CREATE SEQUENCE pairwise_identifier_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE resource_set (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ name VARCHAR2(1024) NOT NULL,
+ uri VARCHAR2(1024),
+ icon_uri VARCHAR2(1024),
+ rs_type VARCHAR2(256),
+ owner VARCHAR2(256) NOT NULL,
+ client_id VARCHAR2(256)
+);
+CREATE SEQUENCE resource_set_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE resource_set_scope (
+ owner_id NUMBER(19) NOT NULL,
+ scope VARCHAR2(256) NOT NULL
+);
+
+CREATE TABLE permission_ticket (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ ticket VARCHAR2(256) NOT NULL,
+ permission_id NUMBER(19) NOT NULL,
+ expiration TIMESTAMP
+);
+CREATE SEQUENCE permission_ticket_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE permission (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ resource_set_id NUMBER(19)
+);
+CREATE SEQUENCE permission_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE permission_scope (
+ owner_id NUMBER(19) NOT NULL,
+ scope VARCHAR2(256) NOT NULL
+);
+
+CREATE TABLE claim (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ name VARCHAR2(256),
+ friendly_name VARCHAR2(1024),
+ claim_type VARCHAR2(1024),
+ claim_value VARCHAR2(1024)
+);
+CREATE SEQUENCE claim_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE claim_to_policy (
+ policy_id NUMBER(19) NOT NULL,
+ claim_id NUMBER(19) NOT NULL
+);
+
+CREATE TABLE claim_to_permission_ticket (
+ permission_ticket_id NUMBER(19) NOT NULL,
+ claim_id NUMBER(19) NOT NULL
+);
+
+CREATE TABLE policy (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ name VARCHAR2(1024),
+ resource_set_id NUMBER(19)
+);
+CREATE SEQUENCE policy_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE policy_scope (
+ owner_id NUMBER(19) NOT NULL,
+ scope VARCHAR2(256) NOT NULL
+);
+
+CREATE TABLE claim_token_format (
+ owner_id NUMBER(19) NOT NULL,
+ claim_token_format VARCHAR2(1024) NOT NULL
+);
+
+CREATE TABLE claim_issuer (
+ owner_id NUMBER(19) NOT NULL,
+ issuer VARCHAR2(1024) NOT NULL
+);
+
+CREATE TABLE saved_registered_client (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ issuer VARCHAR2(1024),
+ registered_client CLOB
+);
+CREATE SEQUENCE saved_registered_client_seq START WITH 1 INCREMENT BY 1 NOCACHE NOCYCLE;
+
+CREATE TABLE IF NOT EXISTS device_code (
+ id NUMBER(19) NOT NULL PRIMARY KEY,
+ device_code VARCHAR2(1024),
+ user_code VARCHAR2(1024),
+ expiration TIMESTAMP,
+ client_id VARCHAR2(256),
+ approved BOOLEAN,
+ auth_holder_id NUMBER(19)
+);
+
+CREATE TABLE IF NOT EXISTS device_code_scope (
+ owner_id NUMBER(19) NOT NULL,
+ scope VARCHAR2(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS device_code_request_parameter (
+ owner_id NUMBER(19),
+ param VARCHAR2(2048),
+ val VARCHAR2(2048)
+);
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/scopes_oracle.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/scopes_oracle.sql
new file mode 100644
index 000000000..bb6bc82a2
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/scopes_oracle.sql
@@ -0,0 +1,26 @@
+--
+-- Insert scope information into the temporary tables.
+--
+
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('openid', 'log in using your identity', 'user', 0, 1);
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('profile', 'basic profile information', 'list-alt', 0, 1);
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('email', 'email address', 'envelope', 0, 1);
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('address', 'physical address', 'home', 0, 1);
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('phone', 'telephone number', 'bell', 0, 1, 0);
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('offline_access', 'offline access', 'time', 0, 0);
+--
+-- Merge the temporary scopes safely into the database. This is a two-step process to keep scopes from being created on every startup with a persistent store.
+--
+
+MERGE INTO system_scope
+ USING (SELECT scope, description, icon, restricted, default_scope FROM system_scope_TEMP) vals
+ ON (vals.scope = system_scope.scope)
+ WHEN NOT MATCHED THEN
+ INSERT (id, scope, description, icon, restricted, default_scope) VALUES(system_scope_seq.nextval, vals.scope,
+ vals.description, vals.icon, vals.restricted, vals.default_scope);
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/security-schema_oracle.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/security-schema_oracle.sql
new file mode 100644
index 000000000..5b67ef668
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/security-schema_oracle.sql
@@ -0,0 +1,18 @@
+--
+-- Tables for Spring Security's user details service
+--
+
+create table users(
+ username varchar2(50) not null primary key,
+ password varchar2(50) not null,
+ enabled number(1) not null,
+
+ constraint enabled_check check (enabled in (1, 0))
+);
+
+create table authorities (
+ username varchar2(50) not null,
+ authority varchar2(50) not null,
+ constraint fk_authorities_users foreign key(username) references users(username),
+ constraint ix_authority unique (username,authority)
+);
diff --git a/openid-connect-server-webapp/src/main/resources/db/oracle/users_oracle.sql b/openid-connect-server-webapp/src/main/resources/db/oracle/users_oracle.sql
new file mode 100644
index 000000000..732a13f16
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/oracle/users_oracle.sql
@@ -0,0 +1,39 @@
+--
+-- Insert user information into the temporary tables. To add users to the Oracle database, edit things here.
+--
+
+INSERT INTO users_TEMP (username, password, enabled) VALUES ('admin','password',1);
+INSERT INTO users_TEMP (username, password, enabled) VALUES ('user','password',1);
+
+
+INSERT INTO authorities_TEMP (username, authority) VALUES ('admin','ROLE_ADMIN');
+INSERT INTO authorities_TEMP (username, authority) VALUES('admin','ROLE_USER');
+INSERT INTO authorities_TEMP (username, authority) VALUES('user','ROLE_USER');
+
+-- By default, the username column here has to match the username column in the users table, above
+INSERT INTO user_info_TEMP (sub, preferred_username, name, email, email_verified) VALUES ('90342.ASDFJWFA','admin','Demo Admin','admin@example.com', 1);
+INSERT INTO user_info_TEMP (sub, preferred_username, name, email, email_verified) VALUES ('01921.FLANRJQW','user','Demo User','user@example.com', 1);
+
+
+--
+-- Merge the temporary users safely into the database. This is a two-step process to keep users from being created on every startup with a persistent store.
+--
+
+MERGE INTO users
+ USING (SELECT username, password, enabled FROM users_TEMP) vals
+ ON (vals.username = users.username)
+ WHEN NOT MATCHED THEN
+ INSERT (username, password, enabled) VALUES(vals.username, vals.password, vals.enabled);
+
+MERGE INTO authorities
+ USING (SELECT username, authority FROM authorities_TEMP) vals
+ ON (vals.username = authorities.username AND vals.authority = authorities.authority)
+ WHEN NOT MATCHED THEN
+ INSERT (username,authority) values (vals.username, vals.authority);
+
+MERGE INTO user_info
+ USING (SELECT sub, preferred_username, name, email, email_verified FROM user_info_TEMP) vals
+ ON (vals.preferred_username = user_info.preferred_username)
+ WHEN NOT MATCHED THEN
+ INSERT (id, sub, preferred_username, name, email, email_verified) VALUES (user_info_seq.nextval, vals.sub, vals.preferred_username, vals.name, vals.email,
+ vals.email_verified);
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/clients.sql b/openid-connect-server-webapp/src/main/resources/db/psql/clients.sql
new file mode 100644
index 000000000..bf14c2b2b
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/clients.sql
@@ -0,0 +1,66 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+--SET AUTOCOMMIT = OFF;
+
+START TRANSACTION;
+
+--
+-- Insert client information into the temporary tables. To add clients to the HSQL database, edit things here.
+--
+
+INSERT INTO client_details_TEMP (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection) VALUES
+ ('client', 'secret', 'Test Client', false, null, 3600, 600, true);
+
+INSERT INTO client_scope_TEMP (owner_id, scope) VALUES
+ ('client', 'openid'),
+ ('client', 'profile'),
+ ('client', 'email'),
+ ('client', 'address'),
+ ('client', 'phone'),
+ ('client', 'offline_access');
+
+INSERT INTO client_redirect_uri_TEMP (owner_id, redirect_uri) VALUES
+ ('client', 'http://localhost/'),
+ ('client', 'http://localhost:8080/');
+
+INSERT INTO client_grant_type_TEMP (owner_id, grant_type) VALUES
+ ('client', 'authorization_code'),
+ ('client', 'urn:ietf:params:oauth:grant_type:redelegate'),
+ ('client', 'implicit'),
+ ('client', 'refresh_token');
+
+--
+-- Merge the temporary clients safely into the database. This is a two-step process to keep clients from being created on every startup with a persistent store.
+--
+
+INSERT INTO client_details (client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection)
+ SELECT client_id, client_secret, client_name, dynamically_registered, refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection FROM client_details_TEMP
+ ON CONFLICT
+ DO NOTHING;
+
+INSERT INTO client_scope (scope)
+ SELECT scope FROM client_scope_TEMP, client_details WHERE client_details.client_id = client_scope_TEMP.owner_id
+ ON CONFLICT
+ DO NOTHING;
+
+INSERT INTO client_redirect_uri (redirect_uri)
+ SELECT redirect_uri FROM client_redirect_uri_TEMP, client_details WHERE client_details.client_id = client_redirect_uri_TEMP.owner_id
+ ON CONFLICT
+ DO NOTHING;
+
+INSERT INTO client_grant_type (grant_type)
+ SELECT grant_type FROM client_grant_type_TEMP, client_details WHERE client_details.client_id = client_grant_type_TEMP.owner_id
+ ON CONFLICT
+ DO NOTHING;
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+--SET AUTOCOMMIT = ON;
+
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_index.sql b/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_index.sql
new file mode 100644
index 000000000..a641ff821
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_index.sql
@@ -0,0 +1,19 @@
+--
+-- Indexes for PostgreSQL
+--
+
+CREATE INDEX IF NOT EXISTS at_tv_idx ON access_token(token_value);
+CREATE INDEX IF NOT EXISTS ts_oi_idx ON token_scope(owner_id);
+CREATE INDEX IF NOT EXISTS at_exp_idx ON access_token(expiration);
+CREATE INDEX IF NOT EXISTS rf_ahi_idx ON refresh_token(auth_holder_id);
+CREATE INDEX IF NOT EXISTS rf_tv_idx ON refresh_token(token_value);
+CREATE INDEX IF NOT EXISTS cd_ci_idx ON client_details(client_id);
+CREATE INDEX IF NOT EXISTS at_ahi_idx ON access_token(auth_holder_id);
+CREATE INDEX IF NOT EXISTS aha_oi_idx ON authentication_holder_authority(owner_id);
+CREATE INDEX IF NOT EXISTS ahe_oi_idx ON authentication_holder_extension(owner_id);
+CREATE INDEX IF NOT EXISTS ahrp_oi_idx ON authentication_holder_request_parameter(owner_id);
+CREATE INDEX IF NOT EXISTS ahri_oi_idx ON authentication_holder_resource_id(owner_id);
+CREATE INDEX IF NOT EXISTS ahrt_oi_idx ON authentication_holder_response_type(owner_id);
+CREATE INDEX IF NOT EXISTS ahs_oi_idx ON authentication_holder_scope(owner_id);
+CREATE INDEX IF NOT EXISTS ac_ahi_idx ON authorization_code(auth_holder_id);
+CREATE INDEX IF NOT EXISTS suaa_oi_idx ON saved_user_auth_authority(owner_id);
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_tables.sql b/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_tables.sql
new file mode 100644
index 000000000..be871b7e8
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/psql_database_tables.sql
@@ -0,0 +1,384 @@
+--
+-- Tables for OIDC Server functionality, PostgreSQL
+--
+
+CREATE TABLE IF NOT EXISTS access_token (
+ id BIGSERIAL PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP,
+ token_type VARCHAR(256),
+ refresh_token_id BIGINT,
+ client_id BIGINT,
+ auth_holder_id BIGINT,
+ approved_site_id BIGINT,
+ UNIQUE(token_value)
+);
+
+CREATE TABLE IF NOT EXISTS access_token_permissions (
+ access_token_id BIGINT NOT NULL,
+ permission_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS address (
+ id BIGSERIAL PRIMARY KEY,
+ formatted VARCHAR(256),
+ street_address VARCHAR(256),
+ locality VARCHAR(256),
+ region VARCHAR(256),
+ postal_code VARCHAR(256),
+ country VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS approved_site (
+ id BIGSERIAL PRIMARY KEY,
+ user_id VARCHAR(256),
+ client_id VARCHAR(256),
+ creation_date TIMESTAMP,
+ access_date TIMESTAMP,
+ timeout_date TIMESTAMP,
+ whitelisted_site_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS approved_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder (
+ id BIGSERIAL PRIMARY KEY,
+ user_auth_id BIGINT,
+ approved BOOLEAN,
+ redirect_uri VARCHAR(2048),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_resource_id (
+ owner_id BIGINT,
+ resource_id VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_extension (
+ owner_id BIGINT,
+ extension VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS authentication_holder_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth (
+ id BIGSERIAL PRIMARY KEY,
+ name VARCHAR(1024),
+ authenticated BOOLEAN,
+ source_class VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS saved_user_auth_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_authority (
+ owner_id BIGINT,
+ authority VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS authorization_code (
+ id BIGSERIAL PRIMARY KEY,
+ code VARCHAR(256),
+ auth_holder_id BIGINT,
+ expiration TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS client_grant_type (
+ owner_id BIGINT,
+ grant_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_response_type (
+ owner_id BIGINT,
+ response_type VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS blacklisted_site (
+ id BIGSERIAL PRIMARY KEY,
+ uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_details (
+ id BIGSERIAL PRIMARY KEY,
+
+ client_description VARCHAR(1024),
+ reuse_refresh_tokens BOOLEAN DEFAULT true NOT NULL,
+ dynamically_registered BOOLEAN DEFAULT false NOT NULL,
+ allow_introspection BOOLEAN DEFAULT false NOT NULL,
+ id_token_validity_seconds BIGINT DEFAULT 600 NOT NULL,
+ device_code_validity_seconds BIGINT,
+
+ client_id VARCHAR(256),
+ client_secret VARCHAR(2048),
+ access_token_validity_seconds BIGINT,
+ refresh_token_validity_seconds BIGINT,
+
+ application_type VARCHAR(256),
+ client_name VARCHAR(256),
+ token_endpoint_auth_method VARCHAR(256),
+ subject_type VARCHAR(256),
+
+ logo_uri VARCHAR(2048),
+ policy_uri VARCHAR(2048),
+ client_uri VARCHAR(2048),
+ tos_uri VARCHAR(2048),
+
+ jwks_uri VARCHAR(2048),
+ jwks VARCHAR(8192),
+ sector_identifier_uri VARCHAR(2048),
+
+ request_object_signing_alg VARCHAR(256),
+
+ user_info_signed_response_alg VARCHAR(256),
+ user_info_encrypted_response_alg VARCHAR(256),
+ user_info_encrypted_response_enc VARCHAR(256),
+
+ id_token_signed_response_alg VARCHAR(256),
+ id_token_encrypted_response_alg VARCHAR(256),
+ id_token_encrypted_response_enc VARCHAR(256),
+
+ token_endpoint_auth_signing_alg VARCHAR(256),
+
+ default_max_age BIGINT,
+ require_auth_time BOOLEAN,
+ created_at TIMESTAMP,
+ initiate_login_uri VARCHAR(2048),
+ clear_access_tokens_on_refresh BOOLEAN DEFAULT true NOT NULL,
+
+ software_statement VARCHAR(4096),
+ software_id VARCHAR(2048),
+ software_version VARCHAR(2048),
+
+ code_challenge_method VARCHAR(256),
+
+ UNIQUE (client_id)
+);
+
+CREATE TABLE IF NOT EXISTS client_request_uri (
+ owner_id BIGINT,
+ request_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_post_logout_redirect_uri (
+ owner_id BIGINT,
+ post_logout_redirect_uri VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_default_acr_value (
+ owner_id BIGINT,
+ default_acr_value VARCHAR(2000)
+);
+
+CREATE TABLE IF NOT EXISTS client_contact (
+ owner_id BIGINT,
+ contact VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS client_claims_redirect_uri (
+ owner_id BIGINT,
+ redirect_uri VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS refresh_token (
+ id BIGSERIAL PRIMARY KEY,
+ token_value VARCHAR(4096),
+ expiration TIMESTAMP,
+ auth_holder_id BIGINT,
+ client_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS client_resource (
+ owner_id BIGINT,
+ resource_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS client_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS token_scope (
+ owner_id BIGINT,
+ scope VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS system_scope (
+ id BIGSERIAL PRIMARY KEY,
+ scope VARCHAR(256) NOT NULL,
+ description VARCHAR(4096),
+ icon VARCHAR(256),
+ restricted BOOLEAN DEFAULT false NOT NULL,
+ default_scope BOOLEAN DEFAULT false NOT NULL,
+ UNIQUE (scope)
+);
+
+CREATE TABLE IF NOT EXISTS user_info (
+ id BIGSERIAL PRIMARY KEY,
+ sub VARCHAR(256),
+ preferred_username VARCHAR(256),
+ name VARCHAR(256),
+ given_name VARCHAR(256),
+ family_name VARCHAR(256),
+ middle_name VARCHAR(256),
+ nickname VARCHAR(256),
+ profile VARCHAR(256),
+ picture VARCHAR(256),
+ website VARCHAR(256),
+ email VARCHAR(256),
+ email_verified BOOLEAN,
+ gender VARCHAR(256),
+ zone_info VARCHAR(256),
+ locale VARCHAR(256),
+ phone_number VARCHAR(256),
+ phone_number_verified BOOLEAN,
+ address_id VARCHAR(256),
+ updated_time VARCHAR(256),
+ birthdate VARCHAR(256),
+ src VARCHAR(4096)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site (
+ id BIGSERIAL PRIMARY KEY,
+ creator_user_id VARCHAR(256),
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS whitelisted_site_scope (
+ owner_id BIGINT,
+ scope VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS pairwise_identifier (
+ id BIGSERIAL PRIMARY KEY,
+ identifier VARCHAR(256),
+ sub VARCHAR(256),
+ sector_identifier VARCHAR(2048)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set (
+ id BIGSERIAL PRIMARY KEY,
+ name VARCHAR(1024) NOT NULL,
+ uri VARCHAR(1024),
+ icon_uri VARCHAR(1024),
+ rs_type VARCHAR(256),
+ owner VARCHAR(256) NOT NULL,
+ client_id VARCHAR(256)
+);
+
+CREATE TABLE IF NOT EXISTS resource_set_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS permission_ticket (
+ id BIGSERIAL PRIMARY KEY,
+ ticket VARCHAR(256) NOT NULL,
+ permission_id BIGINT NOT NULL,
+ expiration TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS permission (
+ id BIGSERIAL PRIMARY KEY,
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS permission_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim (
+ id BIGSERIAL PRIMARY KEY,
+ name VARCHAR(256),
+ friendly_name VARCHAR(1024),
+ claim_type VARCHAR(1024),
+ claim_value VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_policy (
+ policy_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_to_permission_ticket (
+ permission_ticket_id BIGINT NOT NULL,
+ claim_id BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS policy (
+ id BIGSERIAL PRIMARY KEY,
+ name VARCHAR(1024),
+ resource_set_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS policy_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS claim_token_format (
+ owner_id BIGINT NOT NULL,
+ claim_token_format VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS claim_issuer (
+ owner_id BIGINT NOT NULL,
+ issuer VARCHAR(1024)
+);
+
+CREATE TABLE IF NOT EXISTS saved_registered_client (
+ id BIGSERIAL PRIMARY KEY,
+ issuer VARCHAR(1024),
+ registered_client VARCHAR(8192)
+);
+
+CREATE TABLE IF NOT EXISTS device_code (
+ id BIGSERIAL PRIMARY KEY,
+ device_code VARCHAR(1024),
+ user_code VARCHAR(1024),
+ expiration TIMESTAMP NULL,
+ client_id VARCHAR(256),
+ approved BOOLEAN,
+ auth_holder_id BIGINT
+);
+
+CREATE TABLE IF NOT EXISTS device_code_scope (
+ owner_id BIGINT NOT NULL,
+ scope VARCHAR(256) NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS device_code_request_parameter (
+ owner_id BIGINT,
+ param VARCHAR(2048),
+ val VARCHAR(2048)
+);
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/scopes.sql b/openid-connect-server-webapp/src/main/resources/db/psql/scopes.sql
new file mode 100644
index 000000000..140c72755
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/scopes.sql
@@ -0,0 +1,33 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+--SET AUTOCOMMIT = OFF;
+
+START TRANSACTION;
+
+--
+-- Insert scope information into the temporary tables.
+--
+
+INSERT INTO system_scope_TEMP (scope, description, icon, restricted, default_scope) VALUES
+ ('openid', 'log in using your identity', 'user', false, true),
+ ('profile', 'basic profile information', 'list-alt', false, true),
+ ('email', 'email address', 'envelope', false, true),
+ ('address', 'physical address', 'home', false, true),
+ ('phone', 'telephone number', 'bell', false, true),
+ ('offline_access', 'offline access', 'time', false, false);
+
+--
+-- Merge the temporary scopes safely into the database. This is a two-step process to keep scopes from being created on every startup with a persistent store.
+--
+
+INSERT INTO system_scope (scope, description, icon, restricted, default_scope)
+ SELECT scope, description, icon, restricted, default_scope FROM system_scope_TEMP
+ ON CONFLICT(scope)
+ DO NOTHING;
+
+COMMIT;
+
+--SET AUTOCOMMIT = ON;
+
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/security-schema.sql b/openid-connect-server-webapp/src/main/resources/db/psql/security-schema.sql
new file mode 100644
index 000000000..bc5d70b88
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/security-schema.sql
@@ -0,0 +1,14 @@
+--
+-- Tables for Spring Security's user details service
+--
+
+create table IF NOT EXISTS users(
+ username varchar(50) not null primary key,
+ password varchar(50) not null,
+ enabled boolean not null);
+
+ create table IF NOT EXISTS authorities (
+ username varchar(50) not null,
+ authority varchar(50) not null,
+ constraint fk_authorities_users foreign key(username) references users(username),
+ constraint ix_authority unique (username,authority));
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/db/psql/users.sql b/openid-connect-server-webapp/src/main/resources/db/psql/users.sql
new file mode 100644
index 000000000..537330278
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/db/psql/users.sql
@@ -0,0 +1,55 @@
+--
+-- Turn off autocommit and start a transaction so that we can use the temp tables
+--
+
+--SET AUTOCOMMIT FALSE;
+
+START TRANSACTION;
+
+--
+-- Insert user information into the temporary tables. To add users to the HSQL database, edit things here.
+--
+
+INSERT INTO users_TEMP (username, password, enabled) VALUES
+ ('admin','password',true),
+ ('user','password',true);
+
+
+INSERT INTO authorities_TEMP (username, authority) VALUES
+ ('admin','ROLE_ADMIN'),
+ ('admin','ROLE_USER'),
+ ('user','ROLE_USER');
+
+-- By default, the username column here has to match the username column in the users table, above
+INSERT INTO user_info_TEMP (sub, preferred_username, name, email, email_verified) VALUES
+ ('90342.ASDFJWFA','admin','Demo Admin','admin@example.com', true),
+ ('01921.FLANRJQW','user','Demo User','user@example.com', true);
+
+
+--
+-- Merge the temporary users safely into the database. This is a two-step process to keep users from being created on every startup with a persistent store.
+--
+
+INSERT INTO users
+ SELECT username, password, enabled FROM users_TEMP
+ ON CONFLICT(username)
+ DO NOTHING;
+
+INSERT INTO authorities
+ SELECT username, authority FROM authorities_TEMP
+ ON CONFLICT(username, authority)
+ DO NOTHING;
+
+INSERT INTO user_info (sub, preferred_username, name, email, email_verified)
+ SELECT sub, preferred_username, name, email, email_verified FROM user_info_TEMP
+ ON CONFLICT
+ DO NOTHING;
+
+--
+-- Close the transaction and turn autocommit back on
+--
+
+COMMIT;
+
+--SET AUTOCOMMIT TRUE;
+
diff --git a/openid-connect-server-webapp/src/main/resources/keystore.jwks b/openid-connect-server-webapp/src/main/resources/keystore.jwks
new file mode 100644
index 000000000..461413ffe
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/keystore.jwks
@@ -0,0 +1,12 @@
+{
+ "keys": [
+ {
+ "alg": "RS256",
+ "d": "PvBAngE3kkTnD3yDKo3wCvHJHm20kb9a0FVGLd0s2Y0E_3H2XnZC8-2zPhN6AQTjPhohSDCew20gzm76lyOvMqRiUP2Zpaopa1d2fGvNIQSdM07yKa6EivEYxqPQxa5esoZnexgnb9fom70I8n5OQRNQikwu-az26CsHX2zWMRodzSdN5CXHvb1PV09DmH8azTYwoMElPIqmcTfxiRw2Ov5ucmXXngKRFJgvfUgKd7v4ScBX7sQoQEjWEtt7ta0WvL3Ar5E1RAW4aHxuubZ6AtloxWCf17AAKw03dfP5RDm5TDmgm2B635ecJ7fTvneFmg8W_fdMTPRfBlCGNBp3wQ",
+ "e": "AQAB",
+ "n": "qt6yOiI_wCoCVlGO0MySsez0VkSqhPvDl3rfabOslx35mYEO-n4ABfIT5Gn2zN-CeIcOZ5ugAXvIIRWv5H55-tzjFazi5IKkOIMCiz5__MtsdxKCqGlZu2zt-BLpqTOAPiflNPpM3RUAlxKAhnYEqNha6-allPnFQupnW_eTYoyuzuedT7dSp90ry0ZcQDimntXWeaSbrYKCj9Rr9W1jn2uTowUuXaScKXTCjAmJVnsD75JNzQfa8DweklTyWQF-Y5Ky039I0VIu-0CIGhXY48GAFe2EFb8VpNhf07DP63p138RWQ1d3KPEM9mYJVpQC68j3wzDQYSljpLf9by7TGw",
+ "kty": "RSA",
+ "kid": "rsa1"
+ }
+ ]
+}
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/resources/log4j.xml b/openid-connect-server-webapp/src/main/resources/log4j.xml
new file mode 100644
index 000000000..caed28b32
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/resources/log4j.xml
@@ -0,0 +1,83 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/META-INF/MANIFEST.MF b/openid-connect-server-webapp/src/main/webapp/META-INF/MANIFEST.MF
new file mode 100644
index 000000000..59499bce4
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/META-INF/MANIFEST.MF
@@ -0,0 +1,2 @@
+Manifest-Version: 1.0
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
new file mode 100644
index 000000000..480b5780c
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
@@ -0,0 +1,314 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ /introspect
+ /revoke
+ /token
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/assertion-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/assertion-config.xml
new file mode 100644
index 000000000..0ec4ce7f6
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/assertion-config.xml
@@ -0,0 +1,50 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/authz-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/authz-config.xml
new file mode 100644
index 000000000..3b7a4faa8
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/authz-config.xml
@@ -0,0 +1,60 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/crypto-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/crypto-config.xml
new file mode 100644
index 000000000..c1e47a8dc
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/crypto-config.xml
@@ -0,0 +1,50 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/data-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/data-context.xml
new file mode 100644
index 000000000..67d8bd146
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/data-context.xml
@@ -0,0 +1,128 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/endpoint-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/endpoint-config.xml
new file mode 100644
index 000000000..14fbcf2ea
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/endpoint-config.xml
@@ -0,0 +1,34 @@
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/jpa-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/jpa-config.xml
new file mode 100644
index 000000000..592d56a2e
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/jpa-config.xml
@@ -0,0 +1,55 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/local-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/local-config.xml
new file mode 100644
index 000000000..3e5fef8e8
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/local-config.xml
@@ -0,0 +1,36 @@
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/locale-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/locale-config.xml
new file mode 100644
index 000000000..60cdb6b0f
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/locale-config.xml
@@ -0,0 +1,29 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/server-config.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/server-config.xml
new file mode 100644
index 000000000..544f01c98
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/server-config.xml
@@ -0,0 +1,77 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/spring-servlet.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/spring-servlet.xml
new file mode 100644
index 000000000..9306834d0
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/spring-servlet.xml
@@ -0,0 +1,37 @@
+
+
+
+
+
+
+
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/actionmenu.tag b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/actionmenu.tag
new file mode 100644
index 000000000..d391a30ad
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/actionmenu.tag
@@ -0,0 +1,20 @@
+<%@ tag language="java" pageEncoding="UTF-8"%>
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+<%@ taglib prefix="security"
+ uri="http://www.springframework.org/security/tags"%>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/copyright.tag b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/copyright.tag
new file mode 100644
index 000000000..4b0aa920a
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/copyright.tag
@@ -0,0 +1,4 @@
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+
+
diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/footer.tag b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/footer.tag
new file mode 100644
index 000000000..2b95de6dc
--- /dev/null
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/footer.tag
@@ -0,0 +1,45 @@
+<%@ attribute name="js" required="false"%>
+<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+<%@ taglib prefix="o" tagdir="/WEB-INF/tags"%>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ " >
+
+
+
+
+